97

I wonder if there is a way for me to SCP the file from remote2 host directly from my local machine by going through a remote1 host.

The networks only allow connections to remote2 host from remote1 host. Also, neither remote1 host nor remote2 host can scp to my local machine.

Is there something like:

scp user1@remote1:user2@remote2:file .

First window: ssh remote1, then scp remot2:file ..

Second shell: scp remote1:file .

First window: rm file; logout

I could write a script to do all these steps, but if there is a direct way, I would rather use it.

Thanks.

EDIT: I am thinking something like opening SSH tunnels but i'm confused on what value to put where.

At the moment, to access remote1, i have the following in $HOME/.ssh/config on my local machine.

Host remote1
   User     user1
   Hostname localhost
   Port     45678

Once on remote1, to access remote2, it's the standard local DNS and port 22. What should I put on remote1 and/or change on localhost?

8 Answers 8

101

I don't know of any way to copy the file directly in one single command, but if you can concede to running an SSH instance in the background to just keep a port forwarding tunnel open, then you could copy the file in one command.

Like this:

# First, open the tunnel
ssh -L 1234:remote2:22 -p 45678 user1@remote1
# Then, use the tunnel to copy the file directly from remote2
scp -P 1234 user2@localhost:file .

Note that you connect as user2@localhost in the actual scp command, because it is on port 1234 on localhost that the first ssh instance is listening to forward connections to remote2. Note also that you don't need to run the first command for every subsequent file copy; you can simply leave it running.

4
  • 1
    Thanks, this seems to be near what I need. So I created the tunnel, the fingerprint matches the one of the server, but I have a "Permision denied (publickey)" error. I think I need to ask my network/sysadmin why it's not working.
    – Danosaure
    Feb 6, 2012 at 5:19
  • 3
    Thanks! I had to change -p 45678 to -p 22 as my remote1 SSH is listening to port 22
    – Montaro
    Nov 29, 2015 at 14:46
  • I also had to use -p 22 instead of -p 45678. Also scp -P 1234 ... doesn't work for me. I am getting ssh: connect to host localhost port 1234: Connection refused. When I tried with scp -P 22 ... it works but it is copying the file in remote 1 and not on my local machine (remote2).
    – sinner
    Oct 27, 2017 at 9:53
  • Any UI tool for same? Jun 18, 2018 at 9:56
77

Double ssh

Even in your complex case, you can handle file transfer using a single command line, simply with ssh ;-)
And this is useful if remote1 cannot connect to localhost:

ssh user1@remote1 'ssh user2@remote2 "cat file"' > file

tar

But you loose file properties (ownership, permissions...).

However, tar is your friend to keep these file properties:

ssh user1@remote1 'ssh user2@remote2 "cd path2; tar c file"' | tar x

You can also compress to reduce network bandwidth:

ssh user1@remote1 'ssh user2@remote2 "cd path2; tar cj file"' | tar xj

And tar also allows you transferring a recursive directory through basic ssh:

ssh user1@remote1 'ssh user2@remote2 "cd path2; tar cj ."' | tar xj

ionice

If the file is huge and you do not want to disturb other important network applications, you may miss network throughput limitation provided by scp and rsync tools (e.g. scp -l 1024 user@remote:file does not use more than 1 Mbits/second).

But, a workaround is using ionice to keep a single command line:

ionice -c2 -n7 ssh u1@remote1 'ionice -c2 -n7 ssh u2@remote2 "cat file"' > file

Note: ionice may not be available on old distributions.

4
  • Thanks for all the description, but I think Dolda2000's solution is easier. It was something I was trying but couldn't figure it out.
    – Danosaure
    Feb 6, 2012 at 8:44
  • 6
    This is a spectacularly good answer and deserves more votes. Also it's much easier than the accepted answer in my opinion. Mar 2, 2017 at 13:39
  • 2
    I agree this is a better solution than the accepted answer. This way, the connection is automatically cleaned up.
    – Doug
    Feb 13, 2018 at 20:28
  • Thank you, very nice answer! How about the other way around, copying from local to remote?
    – DomTomCat
    Sep 7, 2018 at 2:20
33

This will do the trick:

scp -o 'Host remote2' -o 'ProxyCommand ssh user@remote1 nc %h %p' \ 
    user@remote2:path/to/file .

To SCP the file from the host remote2 directly, add the two options (Host and ProxyCommand) to your ~/.ssh/config file (see also this answer on superuser). Then you can run:

scp user@remote2:path/to/file .

from your local machine without having to think about remote1.

3
  • Nice approach! Though -o 'Host remote2' does not seem to be really required when launching from command line (i.e. to copy once without touching ~/.ssh/config)
    – Mike
    Feb 3, 2014 at 14:57
  • Same here. This works for me without -o 'Host remote2'. Thanks.
    – sinner
    Oct 27, 2017 at 9:54
  • After adding the lines to my .ssh/config file, I was able to run ssh remote2 But because my interest was to push a directory to remote2 instead, I went with: scp -r SourceDirectory remote2:DestinationDirectory
    – analyst_47
    Jul 29, 2021 at 22:15
8

With openssh version 7.3 and up it is easy. Use ProxyJump option in the config file.

# Add to ~/.ssh/config 
Host bastion
    Hostname bastion.client.com
    User userForBastion
    IdentityFile ~/.ssh/bastion.pem

Host appMachine
    Hostname appMachine.internal.com
    User bastion
    ProxyJump bastion                   # openssh 7.3 version new feature ProxyJump
    IdentityFile ~/.ssh/appMachine.pem. #no need to copy pem file to bastion host  

Commands to run to login or copy

ssh appMachine   # no need to specify any tunnel. 
scp helloWorld.txt appMachine:.   # copy without intermediate jumphost/bastion host copy.** 

ofcourse you can specify bastion Jump host using option "-J" to ssh command, if not configured in config file.

Note scp does not seems to support "-J" flag as of now. (i could not find in man pages. However above scp works with config file setting)

1
  • 1
    There is no need to add the bastion server to the config file if it is only used for proxing (i.e. no different IdentityFile etc.), simply add ProxyJump bastion.client.com to the appMachine section. Sep 5, 2018 at 13:46
3

There is a new option in scp that add recently for exactly this same job that is very convenient, it is -3.

TL;DR For the current host that has authentication already set up in ssh config files, just do:

scp -3 remote1:file remote2:file

Your scp must be from recent versions.

All other mentioned technique requires you to set up authentication from remote1 to remote2 or vice versa, which not always is a good idea.
Argument -3 means you want to move files from two remote hosts by using current host as intermediary, and this host actually does the authentication to both remote hosts, so they don't have to have access to each other.
You just have to setup authentication in ssh config files, which is fairly easy and well documented, and then just run the command in TL;DR

The source for this answer is https://superuser.com/a/686527/713762

1

This configuration works nice for me:

Host jump
   User username
   Hostname jumphost.yourorg.intranet
Host production
   User username
   Hostname production.yourorg.intranet
   ProxyCommand ssh -q -W %h:%p jump

Then the command

scp myfile production:~

Copies myfile to production machine.

0

Small addition to Olibre's solution here, which I worked with using this source.

Just as you have the three ways to use tar for copying from remote host to local, the following works for local host to remote host copying in double ssh situations: (run them in the directory where the files have to be copied from, otherwise use fullpath/filename)

Transfer single file without compression:

tar c filename |  ssh user1@remote1 'ssh -Y user2@remote2 "path2 && tar x"'

Transfer single file with compression:

tar cj filename |  ssh user1@remote1 'ssh -Y user2@remote2 "path2 && tar xj"'

Recursive directory transfer:

tar cj . |  ssh user1@remote1 'ssh -Y user2@remote2 "path2 && tar xj"'

The && here prevents the command from running if the first half of the command does not work - for example if the directory is missing or there is an error in the source/destination path names.

0

a simpler way:

scp -o 'ProxyJump your.jump.host' /local/dir/myfile.txt remote.internal.host:/remote/dir

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.