Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have my local.machine, the proxy.machine and target.machine. local.machine doesn't have direct contact with target.machine, but needs to go through proxy.machine.

I want to scp a file from target.machine to local.machine. Is this possible to do with just one command from local.machine?

share|improve this question

10 Answers 10

up vote 37 down vote accepted

I know this is a late answer, but I just found out a cool way to do this. It is basically Holger Just's answer, but in a saved config file:

You need to put this in your ~/.ssh/config file on local.machine, (creating the file if it does not exist)

Host target.machine
  User          targetuser
  HostName      target.machine
  ProxyCommand  ssh proxyuser@proxy.machine nc %h %p 2> /dev/null

After saving the file, you can just use

ssh target.machine

any time you want to connect. Scp also will work as it also respects the ssh config file. So will Nautilus, if you're using GNOME and want to use a GUI.

share|improve this answer
Thats very cool. Thanks! – grm Aug 8 '11 at 22:15
Just a quick note. If you are using an alternative identity file via the -i command line option for ssh, you need to specify that option for both the ProxyCommand configuration and the ssh command line. – BillMan May 15 '13 at 18:32
3 things that might help, 1) it would help if you also showed the Host proxy.machine lines in the same ~/.ssh/config file, 2) Mention whether these commands can be nested (ie. client connects to proxy host 1 which connects to proxy host 2 which connects and 3) what nc %h %p means – puk Nov 14 '13 at 6:00

You can do it in one command, but you need netcat (nc) installed on the proxy machine:

ssh -o "ProxyCommand ssh poxyuser@proxy.machine nc -w 1 %h 22" targetuser@target.machine

[EDIT: mixed up the order of machines...]

share|improve this answer
Nice try, but where should I add the username for proxy and for login? – grm Apr 13 '11 at 11:49
Jzst before the machine names, with an @. I edited my answer to reflect that. – Holger Just Apr 13 '11 at 18:37

If you don't mind using rsync instead of scp, you can use the following one-liner:

rsync -v --rsh "ssh proxy.machine ssh" target.machine:/remote/file /local/dir/

(you'll need passwordless access to the proxy machine)

share|improve this answer
$ ssh -f -N -L <localport>:<target.machine:port> user@proxy.machine
$ scp target-user@local.machine:/remote/file -P <localport> .

OK, actually two commands...

share|improve this answer

A one-liner? Not off the top of my head. You need to establish a proxy first and you can't do that with scp by itself.

When doing it manually, I open up a screen session for my tunnel:

screen -S tunnel

Screen is used to keep the tunnel going in a background shell. Use any technique you want to keep the tunnel open in the background (@weeheavy's answer is probably the simplest). Once in the screen session I start my tunnel like so

ssh -L 2222:target.machine:22 [user@]proxy.machine

To break that down, that basically says "On my local machine, open port 2222 and any connetion hitting localhost:2222 is proxied through proxy.machine to target.machine:22"

Once you've got the ssh connection and tunnel established, detach from the screen session with "C-a d". To get back to that screen session, type screen -raAd tunnel

Once you are back in your original shell your scp command will look like

scp -P 2222 localhost:your/file/on/target.machine local/path

Remember that localhost port 2222 is really just a tunnel going to target.machine.

share|improve this answer

You could try something like:

ssh user@proxy.machine "ssh user@target.machine 'cat > file'" < file

But it won't work if your proxy.machine needs to ask you password (that SSH is not in a TTY, so askpass will fail).

If you have more than one file, you could use tar like this (untested, I usually use a netcat that way):

tar cf - file1 file2 folder1/ | ssh user@proxy.machine "ssh user@target.machine 'tar xvf -'"
share|improve this answer

Appears that scp supports the"-o" option just like ssh does, though I'm not sure how to pass it a proxy username/password:

scp -o "ProxyCommand=nc -X connect -x proxyhost:proxyport %h %p" remote_user@remote_host:remote_path local_path

If you get nc: invalid option -- X see

share|improve this answer
dope bro, worked straightaway :) – just a random guy Jun 2 at 14:06

More recent versions of ssh have netcat-like ability built-in and don't require nc on the intermediate host. Using ssh -W host:port sets up a tunnel to the specified host and port and connects it to stdin/stdout.

This allows you proxy like this with a single command:

scp -o "ProxyCommand ssh pcreds@proxy.machine -W %h:%p" tcreds@target.machine:file .

or using configuration

Host target.machine
    ProxyCommand ssh pcreds@proxy.machine -W %h:%p

and from then on just do scp tcreds@target.machine:file .

Where pcreds and tcreds represent your proxy and target credentials if required (username, username:password, etc.).

share|improve this answer
Verified this indeed works well, and does not leave stale NC processes laying around on the proxy machine. – LaXDragon May 6 at 15:01

How about:

scp -o "ProxyCommand ssh nc %h %p" your.filename
share|improve this answer
or possibly username:password here? – rogerdpack Sep 11 '15 at 19:44

Another simple solution to transfer a source_file from the source_host to a destination_host via a proxy_host:

Log in on the proxy_server:

ssh login@proxy_host

From the proxy server, transfer the source_file from the source_host to the destination_host (you can type this as one line, omitting the \, or as two lines, as shown below):

scp login@source_host:/path_to_source_file \

This requires that the login on the source_host to the proxy_host uses an rsa_key.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .