I'm currently using KeePass and ssh-agent for passwordless ssh/scp access to servers. I also use the ~/.ssh/config file to make life a bit easier. I find it works quite nicely for most of my use cases.

My local system uses "openssh for windows 8.1" via a gitbash shell, server1 is debian 8 (openssh 6.7), server2 is debian 11 (openssh 8.4).

The problem I am looking to solve is when trying to scp a file between 2 remote servers.

With small files copying to/via my local machine is not a big problem, but with larger files it is, so I want a direct remote -> remote copy.

In theory I can do the following:

scp server1:/file server2:~/Downloads/

But this doesn't work.

Verbose mode states the I'm authenticated to server1 (via key), but then tries to run the scp command for the local file on server1. Server1 doesn't have the config or private-key to access server2 and I'm not happy putting them on there. Is there a way to make this work?

I think what I'm asking for is a way to forward my key and config (only for the session) so that server1 can connect to server2, but maybe that's not the best way for this to work.

I'm aware of the -3 option to scp, but that would mean the file comes via my local machine which I want to avoid. It also doesn't seem to actually work for me getting stuck on the following command (from debug) after authenticating to server1 twice:

Sending command: scp -v -f /file -- server2 scp -v -t ~/Downloads/

It would be nice for this to work too, but its not the problem I'm looking to solve.

I'm open to changing the tooling to some degree, as long as I can use ssh keys stored in a local password manager.

1 Answer 1


I have found a partial solution where the key is forwarded. This involves adding ForwardAgent yes to my local .ssh/config for the server1 definition, then modifying the command to use the username and hostname eg:

scp server1:/file [email protected]:~/Downloads/

It would still be great if this last change wasn't needed and I could use the alias in my local .ssh/config file.

There also seems to be some additional security risks/concerns when using ForwardAgent, so its not ideal either.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .