Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a group of servers all properly configured with SSH agent forwarding. It is a typical bastion server style configuration where the only machine you can connect to from the outside is server A. From server A you can use agent forwarding to connect to servers B, C, D, etc. It is all working perfectly.

Sometimes I want to copy a file from my local machine to server B. In order to do this I have to first scp the file to server A. Then ssh to server A and scp the file to server B. Then I delete the file from server A.

Is there a way to copy the file directly from my computer to server B via server A in just one command executed on my local machine?

share|improve this question
up vote 3 down vote accepted

If your sshd is configured to allow TCP forwarding then you can set up a tunnel from your computer to B via A and then use it to copy things through. Create the tunnel

ssh -f -L 2050:B:22 A -N
  • -f background the ssh command so you get your terminal back to use.
  • -L 2050:B22 bind localhost port 2050 to host B port 22
  • -N do not execute a remote command.

then to copy from your computer to B

scp -P 2050 filetocopy localhost:/destination/path 

EDIT: If you use

ssh -L 2050:B:22 A -N &

Then you will be told the PID of the ssh command when it backgrounds.

share|improve this answer
how do I close the tunnel afterwards? – Apreche Feb 2 '12 at 20:03
You would have to use ps to identify the PID of the ssh command that is doing the tunnelling. Alternatively see my edit. – Iain Feb 2 '12 at 20:07

Put something like this into .ssh/config:

Host B-p C-p D-p
        ProxyCommand ssh -W %h:%p
Host B-p
Host C-p
Host D-p

and just ssh or scp to/from B-p. You can omit the -p suffix and configure the ProxyCommand directly on the etc. if you are always "outside".

This incurs a little traffic overhead between your machine and the bastion host, but works without agent forwarding.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.