How to Extract and Create Archives Over SSH

The short answer: use tar with a hyphen archive name and pipe its stdout or stdin through ssh. For example, this creates a compressed archive of a remote directory and saves it on your computer without leaving an archive file on the server:

Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.

ssh user@host 'tar czf - /var/www' > website-backup.tar.gz

The same pattern works in reverse for uploading an archive, extracting a local archive remotely, or streaming a remote directory straight into a local destination. The important details are which side runs tar, where the shell redirection occurs, and which compression flag matches the data.

#	Preview	Product	Price
1		The Linux Command Line, 3rd Edition: A Complete Introduction	$27.94	Buy on Amazon
2		The Linux Command Line, 2nd Edition: A Complete Introduction	$11.34	Buy on Amazon
3		Linux Command Line: A Simple Beginner’s Guide to Linux Commands and Terminal Basics	$1.99	Buy on Amazon
4		The Linux Command Line Beginner's Guide	$2.99	Buy on Amazon
5		Linux Command Reference Guide: 500+ Essential Commands and Examples for Everyday Use (Rheinwerk...	$33.91	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

How the SSH tar pipeline works

tar creates, lists, and extracts archive members. Its three core operations are -c (create), -t (list or test the member names), and -x (extract). The -f option names the archive file. If that name is a single hyphen, tar does not open a disk file: it reads the archive from standard input or writes it to standard output.

That hyphen is what makes a pipeline possible. In tar czf - /path, the remote tar process writes gzip-compressed bytes to stdout. ssh carries that byte stream over its encrypted connection, and the local shell can redirect it into a file or pipe it into another tar process. In the opposite direction, a local tar can write to stdout while a remote command reads stdin.

#1 Best Overall

Sale

The Linux Command Line, 3rd Edition: A Complete Introduction

$27.94

Buy on Amazon

Quote the complete remote command. Without quotes, your local shell may expand a wildcard, interpret a redirection, or substitute a local variable before the command reaches the server.

Prerequisites and planning

• An SSH account on the host, with permission to read the source files or write the destination.
• ssh on the computer initiating the connection.
• tar on every side that creates, lists, or extracts an archive.
• The matching compressor and decompressor when using gzip, bzip2, or xz modes.
• A destination directory that exists or can be created by the account running the extraction.

Before starting, decide where the archive bytes should exist, which machine should perform compression or extraction, and whether you need a persistent archive file. A tar-over-SSH stream avoids an intermediate file, but it is not a resumable transfer by itself. If an interrupted stream must be restarted, run the command again or choose a tool designed for synchronization.

Create an archive on a remote host and save it locally

This is the usual remote-backup pattern:

ssh user@host 'tar czf - /var/www' > website-backup.tar.gz

1. ssh user@host starts the remote command.
2. tar czf - /var/www creates an archive, applies gzip compression, and writes the result to stdout because the archive name is -.
3. The local > website-backup.tar.gz redirect writes the received bytes to a file on your computer.

The redirect is deliberately outside the quotes. It is evaluated locally, so the archive is saved on your computer rather than on the server. To use another compression format, change the flag and the local filename:

ssh user@host 'tar cjf - /var/www' > website-backup.tar.bz2
ssh user@host 'tar cJf - /var/www' > website-backup.tar.xz

The remote account must be able to read every item under the source path. If the path contains files that the account cannot read, tar reports errors and the resulting stream may be incomplete; check the command’s exit status and the remote permissions rather than assuming a file was complete.

Create a local archive and save it on the remote host

Reverse the pipeline when the source is local and the archive should remain on the server:

tar czf - ./project | ssh user@host 'cat > project.tar.gz'

The local tar emits gzip-compressed bytes. SSH transports them, and the quoted remote command uses cat to write stdin to project.tar.gz. Because the redirection is inside the quotes, the file is created remotely.

You can also have a remote tar read the stream directly:

Rank #2

The Linux Command Line, 2nd Edition: A Complete Introduction

$11.34

Buy on Amazon

tar czf - ./project | ssh user@host 'tar xzf - -C /srv/project'

This form extracts the local directory’s contents into the remote destination without creating a remote tarball. The destination must be writable by the remote account, and the -C directory must be an intentional extraction target.

Extract a local archive on a remote host

Pipe the local archive into an SSH command that extracts from standard input:

cat project.tar.gz | ssh user@host 'tar xzf - -C /srv/project'

Here, cat supplies the archive bytes locally. The remote tar uses -x to extract, -z to decode gzip data, -f - to read from stdin, and -C /srv/project to select the destination.

When tar reads compressed data from stdin, it cannot use an archive filename suffix to infer the format. Always provide the matching compression flag: -z for gzip, -j for bzip2, or -J for xz.

For an uncompressed archive, omit the compression flag:

cat project.tar | ssh user@host 'tar xf - -C /srv/project'

Extract a remote archive stream locally

You do not need to create a local archive file if the remote data only needs to be unpacked locally:

ssh user@host 'tar czf - /var/log/app' | tar xzf - -C ./app-log-copy

The first tar creates a gzip stream on the server. The second reads that stream from stdin and extracts it locally. Create the destination first if necessary:

Rank #3

Linux Command Line: A Simple Beginner’s Guide to Linux Commands and Terminal Basics

$1.99

Buy on Amazon

mkdir -p ./app-log-copy
ssh user@host 'tar czf - /var/log/app' | tar xzf - -C ./app-log-copy

The same structure works for bzip2 and xz by changing both sides to j or J. The compression mode must match at both ends.

Compression options and archive commands

These are the common GNU tar forms for ordinary files and streams:

The short options can be combined, so czf means create, gzip, and use the following archive name. GNU tar also supports -a, which selects a compression program from the archive filename suffix when creating an archive. That inference is unavailable when the archive name is -, so streamed commands should state the compression flag explicitly.

GNU tar supports additional compression formats, including lzip, lzma, lzop, zstd, and traditional compress, when the corresponding programs and options are available. For a portable SSH pipeline, use a format installed on both machines and specify it explicitly.

Inspect an archive before extracting it

Listing members is a quick safety and correctness check. For a gzip archive, run:

tar tzf website-backup.tar.gz

For an archive arriving through SSH, list it without saving it:

ssh user@host 'tar czf - /var/www' | tar tzf -

Review the names for unexpected absolute paths, parent-directory components such as ../, surprising top-level directories, or files outside the intended project. An archive’s member names determine where extraction attempts to write. Archives from an untrusted source deserve particular caution; do not extract them into a sensitive directory until their contents and paths have been reviewed.

Rank #4

Sale

The Linux Command Line Beginner's Guide

$2.99

Buy on Amazon

Use an explicit destination with -C rather than relying on whatever directory happens to be current:

mkdir -p ./restore
tar xzf website-backup.tar.gz -C ./restore

On a remote host, use the same deliberate approach:

ssh user@host 'mkdir -p /srv/restore && tar xzf - -C /srv/restore' < website-backup.tar.gz

Permissions, ownership, and special files

By default, extraction is subject to the destination account’s normal permissions and the system’s ownership rules. Add -p only when restoring archived permissions is intentional and the account is permitted to apply them. On a shared server, preserving every mode or ownership attribute may be undesirable or impossible.

Run the read and write checks as the same account that will execute the pipeline. A successful SSH login does not guarantee access to a protected source directory, and a directory that is readable may still be unwritable at the extraction destination.

Choosing tar over SSH, scp, sftp, or rsync

OpenSSH supplies ssh for remote commands and commonly includes scp and sftp for transfer. rsync can use SSH as its remote shell. Choose based on the desired result: an archive file, an unpacked tree, or an ongoing synchronized copy.

Useful command variations

Archive several paths

Pass multiple source paths after the archive name:

ssh user@host 'tar czf - /etc/myapp /srv/myapp' > myapp-config-and-data.tar.gz

Use paths that the remote account can read. Absolute paths make the source unambiguous, while relative paths are interpreted from the remote command’s working directory.

Change the remote working directory

To avoid storing a long leading path in member names, change directory before invoking tar:

Best Value

Sale

Linux Command Reference Guide: 500+ Essential Commands and Examples for Everyday Use (Rheinwerk Computing)

$33.91

Buy on Amazon

ssh user@host 'cd /srv && tar czf - myapp' > myapp.tar.gz

The archive then records myapp relative to /srv. Keep the command quoted so the cd, path interpretation, and archive creation all occur remotely.

Use a non-default SSH port or identity

SSH options go before the host:

ssh -p 2222 -i ~/.ssh/backup_key user@host 'tar czf - /var/www' > website-backup.tar.gz

The tar portion is unchanged; only the connection parameters differ.

Troubleshooting common failures

“Archive is compressed. Use -z option”

This message means compressed bytes arrived through stdin but tar was not told which compression format to decode. Use tar tzf - to list a gzip stream or tar xzf - to extract one. Substitute j or J for bzip2 or xz.

Permission denied

Check both sides of the pipeline. The SSH account needs read access to every source path and write access to the destination archive or extraction directory. A local redirect such as > backup.tar.gz is performed by your local shell, so your local user must be able to create or overwrite that file.

tar or compressor not found

The command runs on the side where it appears. Verify that tar exists on the remote host when you invoke it inside quotes, and that the selected compressor or decompressor is installed there. A local extraction also requires the corresponding local program.

The output file is empty or unexpectedly small

Confirm that the remote command writes the archive to stdout by using -f -. Make sure the redirection is on the intended side of the SSH command: outside the quotes saves locally, while a redirection inside the quotes writes remotely. Also check for source-path errors and read-permission failures.

The archive lists the wrong paths

Inspect the member names with tar tf or the compressed equivalent. If the archive contains an unwanted leading directory, use a remote cd and a relative source path when creating it. Do not change extraction behavior until you have reviewed the names you are about to write.

The connection stops partway through

A pipeline is a live stream. Network loss, an SSH timeout, or a command failure interrupts the archive and leaves a partial output. Remove or quarantine the partial file, reconnect, and run the complete command again. For repeated transfers where avoiding a full restart matters, evaluate rsync over SSH instead of rebuilding a complete tar stream.

A reliable workflow

1. Test SSH access with a harmless command such as ssh user@host 'printf ready'.
2. Check that tar and the required compressor exist on the machine that will create or extract the archive.
3. Verify source readability and destination writability using the actual account.
4. Choose the direction of the stream and place shell redirections on the correct side of the SSH quotes.
5. Use -z, -j, or -J explicitly whenever compressed data is sent through stdin or stdout.
6. For an existing archive, list its members before extraction.
7. Extract with -C into a deliberate directory, especially for archives received from someone else.
8. Check the command’s exit status and inspect the destination after completion.

Which command should you use?

Use ssh ... 'tar czf - source' when you need a compressed archive on your local machine. Use tar czf - source | ssh ... 'cat > file.tar.gz' when the archive belongs on the remote machine. Use a tar-to-tar pipeline when you want the files unpacked on the other host without storing a temporary tarball. Use scp or sftp for a straightforward copy of an archive that already exists, and use rsync over SSH when the job is recurring synchronization rather than a one-time archive.

Quick Recap

SaleBestseller No. 1

The Linux Command Line, 3rd Edition: A Complete Introduction

$27.94

Bestseller No. 2

The Linux Command Line, 2nd Edition: A Complete Introduction

$11.34

Bestseller No. 3

Linux Command Line: A Simple Beginner’s Guide to Linux Commands and Terminal Basics

$1.99

SaleBestseller No. 4

The Linux Command Line Beginner's Guide

$2.99

SaleBestseller No. 5

Linux Command Reference Guide: 500+ Essential Commands and Examples for Everyday Use (Rheinwerk Computing)

$33.91

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.