Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to copy a file from my machine A to server C, but only have access to server C through server B.

Instead of first transferring to server B, log in and then transfer to server C, Is is possible to transfer the file directly with SCP or similar programs?

(Emacs tramp-mode has this feature for editing files remotely).

share|improve this question

Assuming OpenSSH, add to your SSH configuration in .ssh/config

Host distant
ProxyCommand ssh near nc distant 22

This will cause SSH to be able to connect "directly" to the machine named distant by proxying through the machine named near. It can then use applications like scp and sftp to the distant machine.

For this to work you need 'nc' aka netcat installed on the machine named near. But a lot of modern systems will have it already.

towo's tar solution is more effective for one-shot problems, assuming you've memorised tar's syntax and rules of operation.

share|improve this answer
This is the same method I use ... In this example 'distant' would be server C and 'near' would be server B for clarification... – Jeremy Bouse Jul 8 '09 at 13:19
A lot of modern machines don't have 'nc': it's normally available only to Linux machines and only by request (not part of the standard install). – Mei Jul 8 '09 at 14:32
ssh has now -W option, that does this automatically without 'nc', but I wonder why there isn't scp -W – kubanczyk Dec 4 '11 at 11:13
In case I'm not the only one this wasn't obvious to: if the username on near is different from the username on distant, the near user goes into ProxyCommand ssh nearuser@near..., and the distant user goes into a separate User distantuser line. – Mu Mind Feb 18 '12 at 4:30
Just type ssh multi hope and press Google I am feeling lucky – chandank Mar 20 '13 at 1:15

You can add -o options to scp instead of .ssh/config.

scp -o ProxyCommand="ssh $jump_host nc $host 22" $local_path $host:$destination_path

$jump_host is your "server B" in this case.

share|improve this answer
Thi si my preferred way to do this. Messing up .ssh/config for multihopping is not the best solution if you access the same host either from a gateway and directly. – GabrieleV Aug 26 '11 at 22:57

You can ssh to server B using something like

ssh -L 5022:<server C IP>:22 <user_serverB>@<server B IP>

Then you can ssh to server C using

ssh -p 5022 <user_serverC>@localhost 

Similarly scp would work using

scp -P 5022 foo.txt <user_serverc>@localhost:

Remember to use correct case of p with scp and ssh

share|improve this answer

With more recent versions of ssh on the server near (B) machine the following will work without netcat:

Host distant
    ProxyCommand ssh near -W distant:22

It will however require AllowTcpForwarding to be yes (the default) on the near (B) machine

edit: requires OpenSSH 5.4+ on B

share|improve this answer
works like a charm :) – gongzhitaao Sep 19 '13 at 4:32

If you want to be really wicked, you could chain ssh and tar, something like tar c mydir | ssh server "ssh otherserver | tar x", but this can run into all hands of problems.

The easier way would be just to set up an SSH tunnel with the built-in methods of SSH; look at the -D switch in the manpage and just forward some port to the other server's ssh port.

share|improve this answer

Try adapring the following example openssh config for a setup that can be used for multiple hosts:

Host uat-*
     ProxyCommand ssh bastion-uat nc %h %p

This presumes a set of servers that begin with "uat-" that are only accessible via the jumpbox/gateway server "bastion-uat". You probably also want to add ForwardAgent yes if you are using a key to login.

share|improve this answer
Don't use ForwardAgent yes for this. Agent forwarding is not necessary in this case because no ssh client will be running on the bastion, and forwarding an agent when it isn't needed is just going to reduce security. And I think ssh is missing from your command. If a recent ssh version is being used you don't need nc, you can type ssh -W %h:%p bastion-uat instead. – kasperd Jun 25 '14 at 12:10
@kasperd Edited to include ssh . Re ForwardAgent; a ssh client will run in order to run the nc command itself. Perhaps you are referring to the shell? – Benjamin Goodacre Jun 25 '14 at 12:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.