Securely copy files with scp

I have to copy files from machine to machine all the time. Most of the time this copying is done over a network connection. When using that transport method I always like to ensure my copying is being done securely. Fortunately Linux has an app for that (sorry, couldn't resist). That app is scp.

Scp is a part of the secure shell application. If you have installed ssh (secure shell) then you have scp installed on your machine. The only problem with scp is figuring out exactly how to use it. It's not predictable and the man page is absolutely no help. That's where gHacks comes in. In this article you will learn how to securely copy files from one machine to another using scp.

The Setup

Let's first get out of the way the setup of a test network. We'll use MachineA, with an IP address of 192.168.1.1, for the local machine and MachineB, with an IP address of 192.168.1.2, for the remote machine. Both machines will be Linux machines and both will have ssh installed. For the examples we will be copying the file sample.pdf and the directory /home/jlwallen/TEMP. The username we will use is jlwallen.

The syntax

The syntax of the scp command is basically:

scp FILENAME USERNAME@ADDRESS_OF_REMOTE_SERVER:FILENAME

One very important issue is that the FILENAME should be the full path to the file to be copied.

Copy file from A to B (While logged into A)

To copy sample.pdf from A to B when you're logged into A issue the command:

scp /home/jlwallen/sample.pdf jlwallen@192.168.1.2:/home/jlwallen/sample.pdf

You will be prompted for jlwallen's password. Once you enter that password the copy will occur.

Copy file from A to B (While logged into B)

scp jlwallen@192.168.1.1:/home/jlwallen/sample.pdf /home/jlwallen/sample.pdf

You will be prompted for jlwallen's password.

Copy Directory from A to B(While logged into A)

scp -r /home/jlwallen/TEMP jlwallen@192.168.1.2:/home/jlwallen/TEMP

You will be prompted for jlwallen's password. This command will copy the entire contents of the TEMP directory.

Copy Director from B to A (While logged into B)

scp -r jlwallen@192.168.1.1:/home/jlwallen/TEMP /home/jlwallen/TEMP

Pretty simple stuff once you actually know the structure of the command.

Make it passwordless

If you're like me you like to automate things. You can do this with scp but you have to set it up so you can log in without passwords. The best way to do this is by using keys. Here is how it is done:

On the local machine generate a keypair with the following:

ssh-keygen -t rsa

You will accept the defaults and just hit enter. Do not give this a passphrase.

This will generate two files in the ~/.ssh directory: id_rsa and id_rsa.pub. You need to first give your id_rsa the right permissions with the command chmod 700 ~/.ssh/id_rsa. Now you need to copy the id_rsa.pub file over to the server you want to log into. Do this with the command:

scp ~/.ssh/id_rsa.pub 192.168.1.2:~/.ssh/authorized_keys

Now log into the remote machine (via ssh) and make sure the ~/.ssh directory has the right permissions with the command chmod 700 .ssh

The next step is to configure ssh and sshd. On the local machine open up the file /etc/ssh/ssh_config and look for the line:

ForwardAgent yes

This line will most likely be commented out. Remove the "#" character and save the file.

Now on the remote machine open up the /etc/ssh/sshd_config file and make sure you have the following lines:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile????? .ssh/authorized_keys

Save that file and restart sshd with the command /etc/rc.d/init.d/sshd restart

Back on the local machine issue the two following commands:

ssh-agent

ssh-add

You shouldn't be prompted for a password for the second command.

Now attempt to ssh to the remote machine like so:

ssh 192.168.1.2

You should not be prompted for a password. You are now able to ssh and scp without having to enter a password.

Final Thoughts

Now that you know how to scp (and do so without user intervention), you can create all sorts of fun automated backup scripts that will backup a local machine to a remote server. There is one warning I will issue: if someone can get your id_rsa file they might be able to get into your machine. So make sure the machine that holds that file is safe.

Advertisement