Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup a Single-purpose key for copying data to a remote server (using scp), but I'm not sure what the command="" on the key should look like in this case.

Any ideas?


share|improve this question
up vote 8 down vote accepted

When you talk about command="" I assume you refer to the entry you can put in a ~/.ssh/authorized_keys, limiting what command a public ssh key can be used to execute?

When transferring a file across ssh using scp you spawn the following process on the remote side: "scp -t /destination/directory". Hence, if you want an entry only allowing you to scp files into the /tmp directory you will use the following

command="scp -t /tmp"

To my knowledge there is no command="" entry restring a key only to use scp, but at the same time allowing transfers into any destination directory. A completely different solution, which might very well not be what you are after, is using a restrictive shell like scponly.

share|improve this answer
Very nice thanks! I was just starting to go with the scponly script, but was uneasy with the unnecessary freedom it gives (as there was only a single target folder). Your solution is just what I needed. – Robert Gould Dec 15 '09 at 8:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.