Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan NowHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
FREEDOM251

Freedom251 › Blog › File Transfer

How to Use SCP on Ubuntu: Copy Files Securely Over SSH

By Freedom251 Team · · 12 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use Ubuntu’s OpenSSH client and the scp command to copy files between your computer and an SSH-accessible host. Install the client with sudo apt install openssh-client, then run a command in the form scp source target. A remote location is written as [user@]host:path.

For example, scp report.txt [email protected]:/home/alice/ uploads a local file, while scp [email protected]:/home/alice/report.txt . downloads one. Add -r for directories, uppercase -P for a nonstandard SSH port, and -i to select a private key.

As an Amazon Associate I earn from qualifying purchases.

What SCP does and what you need

scp is the OpenSSH secure file-copy command. It transfers data through an authenticated SSH connection, so the remote computer must be reachable and must run an SSH service that accepts your account. The Ubuntu Noble scp manual defines the command around a source and a target; whichever endpoint is the source supplies the data.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The transfer itself is not a separate paid product or hardware feature. It is part of the free OpenSSH software available in Ubuntu’s repositories. You still need a valid username, hostname or IP address, authentication method, and permission to read the source or write the destination.

Install the client on the Ubuntu machine running the command

On the Ubuntu computer from which you will type scp, install the client package:

sudo apt install openssh-client

If the destination is an Ubuntu computer that must accept incoming SSH connections, install the server package on that destination:

sudo apt install openssh-server

Ubuntu’s server documentation describes sshd as the service that handles client connections. Package installation alone does not guarantee reachability: the service configuration, account permissions, firewall rules, routing, and any intermediate network controls must allow the connection.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Check SSH before attempting a transfer

Test an interactive login first. Replace the example account and host with your values:

ssh [email protected]

If this cannot connect, scp will not be able to transfer the file. Resolve the hostname, username, port, authentication, or network problem before changing copy options.

Understand SCP’s source and target syntax

The general form is:

scp [options] source target

A remote endpoint uses [user@]host:path. The user and host identify the SSH account and machine; the path is interpreted on that machine. A local path has no host prefix. The direction follows the position of the source:

Task Source Target
Upload from Ubuntu to a remote host Local file or directory [user@]host:path
Download from a remote host to Ubuntu [user@]host:path Local file, directory, or .

Only one endpoint may be remote in an ordinary copy operation. The command must also be able to read the source and write the target with the permissions of the account performing the transfer.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Upload one file

This command sends report.txt from the current local directory to Alice’s home directory:

scp report.txt [email protected]:/home/alice/

The final slash indicates the destination directory. You can instead provide a complete remote filename when you want to rename the uploaded file:

scp report.txt [email protected]:/home/alice/quarterly-report.txt

Download one file

To retrieve a remote file into the current local directory, put the remote specification first and a dot for the local working directory:

scp [email protected]:/home/alice/report.txt .

To choose a local filename explicitly, replace the dot with that path:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
scp [email protected]:/home/alice/report.txt ~/Downloads/report.txt

Use relative and absolute paths carefully

A path beginning with / is absolute. A path without that leading slash is resolved relative to the remote account’s home directory on the remote side, and a local relative path is resolved from the directory in which you run the command. Confirm the intended location when copying into a path such as backups/ rather than /var/backups/.

The command parser uses a colon to recognize a host specification. If a local filename itself contains a colon, use an explicit relative or absolute pathname so scp does not mistake the filename for host:path.

Copy directories and control the transfer

Copy a directory recursively

Add lowercase -r when the source is a directory:

scp -r project/ [email protected]:/home/alice/

This copies the directory and its contents beneath the remote destination. The same option downloads a remote directory:

scp -r [email protected]:/home/alice/project/ ~/Downloads/

Check whether the destination directory already exists. The resulting nesting depends on the destination path and the source directory name, so use a specific destination when you need predictable layout.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use a different SSH port

SSH normally listens on its configured port, but administrators sometimes use another one. Specify it with uppercase -P:

scp -P 2222 report.txt [email protected]:/home/alice/

Case matters. Lowercase -p does not select a port; it preserves source file modification times, access times, and modes. Confusing these options can produce a connection attempt on the default port instead of the port your server actually uses.

Select a particular private key

When several SSH identities are available, choose one with -i:

scp -i ~/.ssh/id_ed25519 report.txt [email protected]:/home/alice/

The private key must be readable by your local account and must correspond to a public key authorized for the remote account. If the key has a passphrase, SSH will ask for it unless an agent is already providing the unlocked identity.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Useful option combinations

Option Purpose Example
-r Recursively copy a directory and its contents. scp -r project/ user@host:/srv/
-P port Connect to the specified SSH port; the letter is uppercase. scp -P 2222 file user@host:/tmp/
-i identity_file Use a selected private key. scp -i ~/.ssh/id_ed25519 file user@host:/tmp/
-v Print verbose client-side connection and authentication diagnostics. scp -v file user@host:/tmp/
-p Preserve file times and modes; it does not set a port. scp -p file user@host:/tmp/
-O Force the legacy SCP/rcp protocol instead of the modern SFTP-backed mode. scp -O file user@host:/tmp/

Set up SSH keys to avoid repeated passwords

Password authentication works when the remote SSH server permits it, but a key pair is generally more convenient for recurring transfers and automation. Keep the private key on the Ubuntu client; install only its public counterpart on the remote account.

Generate an Ed25519 key pair

  1. On the Ubuntu client, create an Ed25519 key pair:
ssh-keygen -t ed25519
  1. When prompted, accept the default path or specify a dedicated filename. Enter a passphrase to protect the private key if the computer could be accessed by someone else.
  2. Do not copy the private-key file to the server or place it in a publicly readable directory.

The command creates a private key and a matching public key. The private key stays on the client; the public key is the one that can be installed for the remote account.

Install the public key on the remote account

Ubuntu documents ssh-copy-id for adding the public key:

ssh-copy-id [email protected]

You normally authenticate with the remote account’s password once while the key is installed. Afterward, test the login:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
ssh [email protected]

If the key is stored under a nondefault name, select it explicitly for the test and for scp:

ssh -i ~/.ssh/my_transfer_key [email protected]
scp -i ~/.ssh/my_transfer_key report.txt [email protected]:/home/alice/

Use host-specific settings when you have several servers

Ubuntu’s OpenSSH guide also describes host-specific entries in ~/.ssh/config. A configuration entry can associate a short alias with a hostname, username, port, and identity file, after which both ssh and scp can use that alias. Protect the configuration and private key as you would any other authentication material.

Know which protocol your SCP client is using

Modern OpenSSH behavior differs from many older tutorials. OpenSSH 9.0, released on 2022-04-08, changed scp to use the SFTP protocol by default. The OpenSSH 9.0 release notes state: “This release switches scp(1) from using the legacy scp/rcp protocol to using the SFTP protocol by default.”

For a current Ubuntu installation documented by the Noble manual, an ordinary command such as scp file user@host:/path/ therefore uses the SFTP-backed implementation. SFTP does not rely on the remote shell to expand wildcards in the same way as the old protocol.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

When to use legacy mode

Some older SSH servers, appliances, or restricted implementations may not support the SFTP behavior expected by a newer client. In that compatibility case, force the old SCP/rcp protocol with uppercase -O:

scp -O file user@host:/path/

Do not treat -O as the normal setting on a modern server. Use it only when the actual server requires the legacy protocol or when an otherwise unexplained protocol compatibility error has been confirmed.

Understand wildcard and shell-metacharacter differences

Legacy SCP expands remote wildcards through the remote shell. Shell metacharacters therefore require careful quoting, and an unquoted pattern can be expanded on the wrong side or interpreted unexpectedly. The OpenSSH release notes and the Ubuntu manuals document this behavior. SFTP-backed operation avoids that particular remote-shell expansion step, but you should still quote paths containing spaces or shell-significant characters according to your local shell.

Ubuntu releases do not all ship the same OpenSSH generation. The Jammy scp manual documents an older package generation, while Noble documents current behavior. If a command behaves differently from an old tutorial, check the installed client version and the server’s SFTP support before forcing legacy mode.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Practical transfer recipes

Upload several named files

List multiple local files before the single remote target:

scp report.txt figures.csv [email protected]:/home/alice/incoming/

Make sure every local source exists and that the remote account can write to the destination directory.

Download several remote files

With modern SFTP-backed scp, patterns are handled by the client protocol rather than the old remote-shell mechanism. A command such as the following requests matching files from the remote directory:

scp [email protected]:/home/alice/incoming/*.csv ~/Downloads/

If the server is old or the command is being run with -O, revisit quoting and wildcard behavior before relying on a pattern. When in doubt, copy a specific filename or use an interactive SFTP workflow that exposes the remote directory contents.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Copy a project to a custom-port server with a key

scp -r -P 2222 -i ~/.ssh/id_ed25519 project/ [email protected]:/home/alice/

Combining options is useful for a known server configuration, but test a single file first when introducing a new port, key, or destination.

Download a backup directory

scp -r -i ~/.ssh/id_ed25519 [email protected]:/srv/backups/ ~/backups/

Ensure the local account has enough free space and that the remote account can read every file beneath the source directory. A permission failure partway through a recursive copy can leave a partial local result.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Troubleshoot failed transfers methodically

Start with the endpoint details rather than changing security settings at random. Check the hostname, username, remote path, port, authentication method, and read/write permissions in that order.

Symptom Checks and corrective action
“Could not resolve hostname” or a name lookup error Verify the hostname spelling, DNS configuration, or use the correct reachable IP address. Confirm that the host is on the network you expect.
Connection refused or timed out Confirm the remote machine is online, the SSH service is running, the port is correct, and firewall or routing rules permit access. Use -P with the exact nondefault port.
Permission denied during login Check the remote username, password or key, whether the server permits that authentication method, and whether the selected private key matches the authorized public key.
Permission denied for a file or directory Verify that the remote account can read the source or write the destination. A successful SSH login does not grant access to every path.
No such file or directory Check local and remote path spelling, relative-versus-absolute interpretation, capitalization, and whether the destination directory already exists.
Protocol or subsystem error Consider whether the server supports SFTP as expected by a modern client. Confirm the actual server implementation before trying scp -O for legacy compatibility.
A command works in an old tutorial but not on your Ubuntu release Compare the installed OpenSSH generation with the tutorial. OpenSSH 9.0 and later use SFTP by default, unlike legacy-default clients.

Turn on client diagnostics

Add -v to print verbose client-side connection and authentication details:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
scp -v report.txt [email protected]:/home/alice/

The output can show which host and port were selected, which identities were offered, and where negotiation or authentication stopped. The command returns status 0 when the transfer succeeds and a nonzero status when an error occurs, which is useful in scripts.

Inspect logs when you administer the remote Ubuntu server

On a remote Ubuntu server you control, follow the SSH service log while reproducing the failure:

sudo journalctl -fu ssh.service

These logs can distinguish a rejected account, key, subsystem, or server-side policy from a client-side path mistake.

Validate server configuration before restarting

If you changed the remote SSH configuration, test it before restarting the service:

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo sshd -t

Ubuntu’s OpenSSH guidance recommends this check because a syntax or policy error can lock administrators out after a restart. This is server-administration procedure, not a routine step required for every client-side copy.

Do not bypass host-key warnings casually

A changed host key can indicate a legitimate server rebuild, but it can also indicate that you are connecting to the wrong machine or that traffic is being intercepted. Verify the new key with the server owner or administrator. Do not disable host-key checking merely to make scp continue.

Password authentication versus SSH keys

Method Advantages Responsibilities and limitations
Password Available immediately when the server permits it; no key files to create. Requires interactive entry for each connection unless another credential mechanism is configured; subject to the server’s password policy.
Ed25519 key pair Convenient for repeated transfers and scripts; the private key remains on the client and can be protected by a passphrase. Requires initial key generation and installation; losing or exposing the private key requires prompt replacement and server-side removal of the old public key.

Neither method removes the need to verify the hostname, protect the client, and grant only the remote account permissions it needs. A passphrase protects a private key if the file is copied or read, while an SSH agent can reduce repeated passphrase prompts during a work session.

Security and operational checklist

  • Use the correct hostname and verify unexpected host-key changes with an administrator.
  • Give the remote account access only to the directories it must read or write.
  • Protect private keys with a passphrase and keep them out of shared or world-readable locations.
  • Use uppercase -P only for the intended SSH port; do not confuse it with lowercase -p.
  • Test a small file before starting a large recursive transfer to a new destination.
  • Check available disk space on the destination and confirm that a partial copy will not be mistaken for a complete backup.
  • For server changes, run sudo sshd -t before restarting SSH.
  • Use verbose output and server logs to diagnose failures instead of disabling authentication or host verification.

When SCP is the right tool

scp is a straightforward choice for a finite upload or download when SSH access already exists and you want one command that names the source and destination. It handles single files, recursive directories, custom ports, and selected identities without requiring a separate graphical client.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Its behavior is tied to the SSH server and the OpenSSH version on the client. For modern clients, ordinary scp commands use SFTP underneath; legacy protocol mode is an exception for compatibility. If you need an interactive file-management session, advanced synchronization, resumable workflows, or a server whose SFTP subsystem is unavailable, evaluate a tool designed for that specific requirement rather than assuming every environment supports every SCP mode.

Quick reference

Goal Command
Install the Ubuntu client sudo apt install openssh-client
Install an Ubuntu SSH server sudo apt install openssh-server
Upload a file scp file user@host:/remote/path/
Download a file scp user@host:/remote/file .
Copy a directory scp -r directory/ user@host:/remote/path/
Use port 2222 scp -P 2222 file user@host:/remote/path/
Use a specific key scp -i ~/.ssh/id_ed25519 file user@host:/remote/path/
Show diagnostics scp -v file user@host:/remote/path/
Force legacy SCP/rcp scp -O file user@host:/remote/path/
Generate an Ed25519 key ssh-keygen -t ed25519
Install the public key ssh-copy-id user@host

For option definitions and current behavior, consult the Ubuntu Noble scp manual. For installing and administering the SSH service, use Ubuntu’s OpenSSH server documentation. The protocol change is documented in the OpenSSH 9.0 release notes; older package behavior is described in the Ubuntu Jammy manual.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

File TransferLinuxSCPSSHUbuntu

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.