111

I have a file on server A (which is behind a NAT so not directly addressable). The file needs to be copied to server B in a directory restricted to root. I have an account on server B with sudo privileges. What is the syntax for the scp command?

Improve this question
1
  • I have answered on another posting how you can customize scp do the sudo for you directly. This is similar to what WinSCP does.
    – YoYo
    Sep 2, 2016 at 22:56

7 Answers 7

Reset to default
94

First, you need to copy the file to a place where you have write access without sudo,

scp yourfile serverb:

Then move the file using sudo

ssh serverb sudo mv yourfile /path/to/the/destination

If you do not have a writable place, make a temporary dir with write permission for your user.

ssh serverb sudo mkdir tempdir && sudo chmod 777 tempdir
scp yourfile serverb:tempdir
ssh serverb mv tempdir/yourfile /path/to/the/destination
Improve this answer
6
  • 9
    /tmp is a good place for writing temporary files that (usually) all users have access to.
    – Doug Harris
    May 7, 2010 at 23:28
  • 4
    @Doug: Note that /tmp could be in RAM or in / mounting point, and not necessarily large enough to host big files.
    – Ravachol
    Dec 12, 2011 at 16:38
  • 8
    Whatever you are trying to accomplish, chmod 777 is usually the wrong way to do it. Consider what could happen if somebody else was logged in and knew you were about to run this code.
    – tripleee
    Jul 23, 2014 at 13:39
  • 1
    ssh sudo doesn't work for me -- complains "no tty present and no askpass program specified"?
    – Ross Presser
    Sep 15, 2017 at 17:56
  • 1
    @RossPresser sorry for late answer, but you either need to setup passwordless sudo on serverb or you need to ssh serverb separately, then run sudo ... after logged in.
    – Johan
    Oct 9, 2019 at 12:26
92

With SCP, you have to do in two steps, however, you can do it in one with rsync as follows:

rsync --rsync-path="sudo rsync" <LOCALFILE> USER@SERVER2:/root

Note: This does require NOPASSWD sudo configuration. If you have to enter the password for sudo, then the two step way is needed.

To copy directory, you need to add -r parameter. And -v for verbose output.

To use above method with credentials, you need to add them into your ~/.ssh/config file, e.g.

Host SERVER2
  HostName server2.example.colm
  User USER
  #IdentityFile ~/.ssh/custom_key.pem
Improve this answer
4
  • 7
    This is by far the simplest way to do it.
    – Matt White
    Jul 23, 2014 at 20:55
  • Error sudo: sorry, you must have a tty to run sudo fixed by -e "ssh -tt".
    – mj41
    Feb 3, 2015 at 13:26
  • 5
    @mj41 With -e "ssh -tt", I get protocol version mismatch -- is your shell clean?. Any hints on how to fix that?
    – ax.
    Dec 19, 2017 at 18:34
  • 1
    This should be the accepted answer :)
    – Synox
    Mar 27, 2020 at 8:05
21

You can use ssh and tar to work around this:

ssh -t host 'sudo -v'
ssh -C host 'cd /; sudo tar cf - path/to/file/or/dir' | tar xpsf - --preserve

This first updates your sudo timestamp (asking for a password if necessary, which requires a tty (ssh -t)), and then uses sudo to create a tarball remotely and extract it locally.

"tar" on RedHat 5 requires the "--preserve" options to come after the "xpsf -" command.

Improve this answer
3
  • Just a note: if you get tar: Invalid replacement string, removing -s in the seems to fix it (not sure what you need the s for anyway). Many thanks; this is awesome.
    – Lucas Wiman
    Feb 15, 2013 at 21:55
  • This would require tty_tickets to be disabled, correct?
    – Jacob Budin
    Mar 31, 2016 at 22:04
  • @JacobBudin yes.
    – blueyed
    Apr 2, 2016 at 23:58
5

You can use sftp with sudo command, for instance:

sftp -s 'sudo -u REMOTE_SUDO_USER /usr/libexec/openssh/sftp-server' REMOTE_USER@HOST
Improve this answer
2
  • 1
    This and the rsync methods are probably the most direct way of doing it in one step. It is unfortunate that the scp task in ant does not support it. You can set it to use sftp, but you cannot modify the remote sub-program. Note that the sub-program will be different depending on the type of server (solaris might be different).
    – YoYo
    Feb 15, 2017 at 2:53
  • I don't see where in this solution you actually specify the local file to be transferred to the server.
    – Nathan Bubna
    Oct 15, 2020 at 21:15
2

First, you need to copy the file to a place where you have write access without sudo, You can do the following two steps.

Step 1: scp filename newserver

Step 2: ssh newserver sudo mv filename /path/to/the/destination

for more information read scp tutorial

Improve this answer
1

If you need to type password for sudo every-time, you can save it to a file:

echo "Enter password: "; read -s password; echo $password > password_file

and then send it along with the source file.

cat password_file source_file | ssh remote_host 'sudo -S sponge target_file'

You can use tee instead of sponge if you don’t have moreutils.

Improve this answer
-1 
current server $ sudo scp username@server:source/path/filename /tmp/

It will copy specific file from source to /tmp/ in current server

Improve this answer
3
  • 1
    It will execute the sudo locally, giving you no elevated privileges remotely.
    – YoYo
    Feb 17, 2017 at 22:58
  • This just won't work, as @Yoyo says.
    – Mani
    Mar 2, 2018 at 11:46
  • scp won't probably connect, because it will reads the key of root
    – Pierre-Olivier Vares
    Aug 10, 2018 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.