19261079b7
Some notable changes, from upstream's release notes: - sshd(8): Remove support for obsolete "host/port" syntax. - ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes". - ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. - ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures. - ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one). - ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions. - scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default. - scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used. Additional integration work is needed to support FIDO/U2F in the base system. Deprecation Notice ------------------ OpenSSH will disable the ssh-rsa signature scheme by default in the next release. Reviewed by: imp MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D29985
310 lines
7.5 KiB
Groff
310 lines
7.5 KiB
Groff
.\"
|
|
.\" scp.1
|
|
.\"
|
|
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
|
|
.\"
|
|
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
|
.\" All rights reserved
|
|
.\"
|
|
.\" Created: Sun May 7 00:14:37 1995 ylo
|
|
.\"
|
|
.\" $OpenBSD: scp.1,v 1.100 2021/08/11 14:07:54 naddy Exp $
|
|
.\"
|
|
.Dd $Mdocdate: August 11 2021 $
|
|
.Dt SCP 1
|
|
.Os
|
|
.Sh NAME
|
|
.Nm scp
|
|
.Nd OpenSSH secure file copy
|
|
.Sh SYNOPSIS
|
|
.Nm scp
|
|
.Op Fl 346ABCOpqRrsTv
|
|
.Op Fl c Ar cipher
|
|
.Op Fl D Ar sftp_server_path
|
|
.Op Fl F Ar ssh_config
|
|
.Op Fl i Ar identity_file
|
|
.Op Fl J Ar destination
|
|
.Op Fl l Ar limit
|
|
.Op Fl o Ar ssh_option
|
|
.Op Fl P Ar port
|
|
.Op Fl S Ar program
|
|
.Ar source ... target
|
|
.Sh DESCRIPTION
|
|
.Nm
|
|
copies files between hosts on a network.
|
|
.Pp
|
|
It uses
|
|
.Xr ssh 1
|
|
for data transfer, and uses the same authentication and provides the
|
|
same security as a login session.
|
|
The scp protocol requires execution of the remote user's shell to perform
|
|
.Xr glob 3
|
|
pattern matching.
|
|
.Pp
|
|
.Nm
|
|
will ask for passwords or passphrases if they are needed for
|
|
authentication.
|
|
.Pp
|
|
The
|
|
.Ar source
|
|
and
|
|
.Ar target
|
|
may be specified as a local pathname, a remote host with optional path
|
|
in the form
|
|
.Sm off
|
|
.Oo user @ Oc host : Op path ,
|
|
.Sm on
|
|
or a URI in the form
|
|
.Sm off
|
|
.No scp:// Oo user @ Oc host Oo : port Oc Op / path .
|
|
.Sm on
|
|
Local file names can be made explicit using absolute or relative pathnames
|
|
to avoid
|
|
.Nm
|
|
treating file names containing
|
|
.Sq :\&
|
|
as host specifiers.
|
|
.Pp
|
|
When copying between two remote hosts, if the URI format is used, a
|
|
.Ar port
|
|
cannot be specified on the
|
|
.Ar target
|
|
if the
|
|
.Fl R
|
|
option is used.
|
|
.Pp
|
|
The options are as follows:
|
|
.Bl -tag -width Ds
|
|
.It Fl 3
|
|
Copies between two remote hosts are transferred through the local host.
|
|
Without this option the data is copied directly between the two remote
|
|
hosts.
|
|
Note that, when using the legacy SCP protocol (the default), this option
|
|
selects batch mode for the second host as
|
|
.Nm
|
|
cannot ask for passwords or passphrases for both hosts.
|
|
This mode is the default.
|
|
.It Fl 4
|
|
Forces
|
|
.Nm
|
|
to use IPv4 addresses only.
|
|
.It Fl 6
|
|
Forces
|
|
.Nm
|
|
to use IPv6 addresses only.
|
|
.It Fl A
|
|
Allows forwarding of
|
|
.Xr ssh-agent 1
|
|
to the remote system.
|
|
The default is not to forward an authentication agent.
|
|
.It Fl B
|
|
Selects batch mode (prevents asking for passwords or passphrases).
|
|
.It Fl C
|
|
Compression enable.
|
|
Passes the
|
|
.Fl C
|
|
flag to
|
|
.Xr ssh 1
|
|
to enable compression.
|
|
.It Fl c Ar cipher
|
|
Selects the cipher to use for encrypting the data transfer.
|
|
This option is directly passed to
|
|
.Xr ssh 1 .
|
|
.It Fl D Ar sftp_server_path
|
|
When using the SFTP protocol support via
|
|
.Fl M ,
|
|
connect directly to a local SFTP server program rather than a
|
|
remote one via
|
|
.Xr ssh 1 .
|
|
This option may be useful in debugging the client and server.
|
|
.It Fl F Ar ssh_config
|
|
Specifies an alternative
|
|
per-user configuration file for
|
|
.Nm ssh .
|
|
This option is directly passed to
|
|
.Xr ssh 1 .
|
|
.It Fl i Ar identity_file
|
|
Selects the file from which the identity (private key) for public key
|
|
authentication is read.
|
|
This option is directly passed to
|
|
.Xr ssh 1 .
|
|
.It Fl J Ar destination
|
|
Connect to the target host by first making an
|
|
.Nm
|
|
connection to the jump host described by
|
|
.Ar destination
|
|
and then establishing a TCP forwarding to the ultimate destination from
|
|
there.
|
|
Multiple jump hops may be specified separated by comma characters.
|
|
This is a shortcut to specify a
|
|
.Cm ProxyJump
|
|
configuration directive.
|
|
This option is directly passed to
|
|
.Xr ssh 1 .
|
|
.It Fl l Ar limit
|
|
Limits the used bandwidth, specified in Kbit/s.
|
|
.It Fl O
|
|
Use the legacy SCP protocol for file transfers instead of the SFTP protocol.
|
|
Forcing the use of the SCP protocol may be necessary for servers that do
|
|
not implement SFTP or for backwards-compatibility for particular filename
|
|
wildcard patterns.
|
|
This mode is the default.
|
|
.It Fl o Ar ssh_option
|
|
Can be used to pass options to
|
|
.Nm ssh
|
|
in the format used in
|
|
.Xr ssh_config 5 .
|
|
This is useful for specifying options
|
|
for which there is no separate
|
|
.Nm scp
|
|
command-line flag.
|
|
For full details of the options listed below, and their possible values, see
|
|
.Xr ssh_config 5 .
|
|
.Pp
|
|
.Bl -tag -width Ds -offset indent -compact
|
|
.It AddressFamily
|
|
.It BatchMode
|
|
.It BindAddress
|
|
.It BindInterface
|
|
.It CanonicalDomains
|
|
.It CanonicalizeFallbackLocal
|
|
.It CanonicalizeHostname
|
|
.It CanonicalizeMaxDots
|
|
.It CanonicalizePermittedCNAMEs
|
|
.It CASignatureAlgorithms
|
|
.It CertificateFile
|
|
.It CheckHostIP
|
|
.It Ciphers
|
|
.It Compression
|
|
.It ConnectionAttempts
|
|
.It ConnectTimeout
|
|
.It ControlMaster
|
|
.It ControlPath
|
|
.It ControlPersist
|
|
.It GlobalKnownHostsFile
|
|
.It GSSAPIAuthentication
|
|
.It GSSAPIDelegateCredentials
|
|
.It HashKnownHosts
|
|
.It Host
|
|
.It HostbasedAcceptedAlgorithms
|
|
.It HostbasedAuthentication
|
|
.It HostKeyAlgorithms
|
|
.It HostKeyAlias
|
|
.It Hostname
|
|
.It IdentitiesOnly
|
|
.It IdentityAgent
|
|
.It IdentityFile
|
|
.It IPQoS
|
|
.It KbdInteractiveAuthentication
|
|
.It KbdInteractiveDevices
|
|
.It KexAlgorithms
|
|
.It KnownHostsCommand
|
|
.It LogLevel
|
|
.It MACs
|
|
.It NoHostAuthenticationForLocalhost
|
|
.It NumberOfPasswordPrompts
|
|
.It PasswordAuthentication
|
|
.It PKCS11Provider
|
|
.It Port
|
|
.It PreferredAuthentications
|
|
.It ProxyCommand
|
|
.It ProxyJump
|
|
.It PubkeyAcceptedAlgorithms
|
|
.It PubkeyAuthentication
|
|
.It RekeyLimit
|
|
.It SendEnv
|
|
.It ServerAliveInterval
|
|
.It ServerAliveCountMax
|
|
.It SetEnv
|
|
.It StrictHostKeyChecking
|
|
.It TCPKeepAlive
|
|
.It UpdateHostKeys
|
|
.It User
|
|
.It UserKnownHostsFile
|
|
.It VerifyHostKeyDNS
|
|
.El
|
|
.It Fl P Ar port
|
|
Specifies the port to connect to on the remote host.
|
|
Note that this option is written with a capital
|
|
.Sq P ,
|
|
because
|
|
.Fl p
|
|
is already reserved for preserving the times and modes of the file.
|
|
.It Fl p
|
|
Preserves modification times, access times, and modes from the
|
|
original file.
|
|
.It Fl q
|
|
Quiet mode: disables the progress meter as well as warning and diagnostic
|
|
messages from
|
|
.Xr ssh 1 .
|
|
.It Fl R
|
|
Copies between two remote hosts are performed by connecting to the origin
|
|
host and executing
|
|
.Nm
|
|
there.
|
|
This requires that
|
|
.Nm
|
|
running on the origin host can authenticate to the destination host without
|
|
requiring a password.
|
|
.It Fl r
|
|
Recursively copy entire directories.
|
|
Note that
|
|
.Nm
|
|
follows symbolic links encountered in the tree traversal.
|
|
.It Fl S Ar program
|
|
Name of
|
|
.Ar program
|
|
to use for the encrypted connection.
|
|
The program must understand
|
|
.Xr ssh 1
|
|
options.
|
|
.It Fl s
|
|
Use the SFTP protocol for file transfers instead of the legacy SCP protocol.
|
|
Using SFTP avoids invoking a shell on the remote side and provides
|
|
more predictable filename handling, as the SCP protocol
|
|
relied on the remote shell for expanding
|
|
.Xr glob 3
|
|
wildcards.
|
|
.Pp
|
|
A near-future release of OpenSSH will make the SFTP protocol the default.
|
|
This option will be deleted before the end of 2022.
|
|
.It Fl T
|
|
Disable strict filename checking.
|
|
By default when copying files from a remote host to a local directory
|
|
.Nm
|
|
checks that the received filenames match those requested on the command-line
|
|
to prevent the remote end from sending unexpected or unwanted files.
|
|
Because of differences in how various operating systems and shells interpret
|
|
filename wildcards, these checks may cause wanted files to be rejected.
|
|
This option disables these checks at the expense of fully trusting that
|
|
the server will not send unexpected filenames.
|
|
.It Fl v
|
|
Verbose mode.
|
|
Causes
|
|
.Nm
|
|
and
|
|
.Xr ssh 1
|
|
to print debugging messages about their progress.
|
|
This is helpful in
|
|
debugging connection, authentication, and configuration problems.
|
|
.El
|
|
.Sh EXIT STATUS
|
|
.Ex -std scp
|
|
.Sh SEE ALSO
|
|
.Xr sftp 1 ,
|
|
.Xr ssh 1 ,
|
|
.Xr ssh-add 1 ,
|
|
.Xr ssh-agent 1 ,
|
|
.Xr ssh-keygen 1 ,
|
|
.Xr ssh_config 5 ,
|
|
.Xr sftp-server 8 ,
|
|
.Xr sshd 8
|
|
.Sh HISTORY
|
|
.Nm
|
|
is based on the rcp program in
|
|
.Bx
|
|
source code from the Regents of the University of California.
|
|
.Sh AUTHORS
|
|
.An Timo Rinne Aq Mt tri@iki.fi
|
|
.An Tatu Ylonen Aq Mt ylo@cs.hut.fi
|