I don't have root access to the server (i.e, I can't/don't want to change any system-wide server configuration), and I want to use scp with an alternative Identity File (e.g, .ssh/id_rsa_for_scp) to automate the download of some files from the server, but I don't want the same key to be used to access the server through ssh.

2 Answers 2


After you copy your keyfile to the server:

ssh-copy-id -i ~/.ssh/id_rsa_for_scp [email protected]

(To simplify the example, we will assume the client's machine ~/.ssh/config is already configured. For more details about ~/.ssh/config run man ssh_config)

Host testmachine
    User legendaryuser
    BatchMode yes
    IdentitiesOnly yes
    IdentityFile ~/.ssh/id_rsa_for_scp

You will need to edit the server's /home/legendaryuser/.ssh/authorized_keys file.


ssh-rsa AAAAAC3nZCXExxHUEBR...

To: (this version allows download and upload)

command="if [[ \"$SSH_ORIGINAL_COMMAND\" =~ ^scp.? ]]; then $SSH_ORIGINAL_COMMAND ; else echo Access Denied; fi" ssh-rsa AAAAAC3nZCXExxHUEBR...

If you want to limit scp to "download-only mode" and only to files from a specific directory, do:

command="if [[ \"$SSH_ORIGINAL_COMMAND\" =~ ^scp[[:space:]]-f[[:space:]]/full/path/to/dir/.? ]]; then $SSH_ORIGINAL_COMMAND ; else echo Access Denied; fi" ssh-rsa AAAAAC3nZCXExxHUEBR...

And last, lets add some more restrictions to the key, just to be safe:

command="if [[ \"$SSH_ORIGINAL_COMMAND\" =~ ^scp[[:space:]]-f[[:space:]]/full/path/to/dir/.? ]]; then $SSH_ORIGINAL_COMMAND ; else echo ERRO Access Denied; fi",no-pty,no-port-forwarding,no-agent-forwarding,no-X11-forwarding ssh-rsa AAAAAC3nZCXExxHUEBR...

You can see more details about the authorized_keys file by running:

man sshd

Ps: You can also add from=xxx.xxx.xxx.xxx to the limit the use of the key from a specific IP address or network.

Pps: Sorry for my english, I'm not a native speaker.

  • 1
    Wow. Nice answer! :) May 25, 2017 at 22:51
  • Or use the scponly, which does basically the same without writing too much regexes.
    – Jakuje
    May 26, 2017 at 8:25
  • @Jakuje, Yes, I could... if I had root access to the server. This solution is intended to help a user that doesn't have the power to make any changes on the system from which he needs to copy the files. May 26, 2017 at 12:25
  • 1
    You don't need a root access to set up scponly (if you download/install it in your home directory). It is nothing against your solution, but just for reference that there is already a tool to do that.
    – Jakuje
    May 26, 2017 at 12:29
  • 3
    @Jakuje OK, cool. Why not put that as an answer and demonstrate? I'd love to see how, too. :D May 26, 2017 at 17:15

Supplement to @Michael Richard's answer.

zsh will return an error:

zsh:1: no such file or directory: scp ...

This problem also exist in bash.

To solve it, replace

... then $SSH_ORIGINAL_COMMAND ; ...


... then $SHELL -c $SSH_ORIGINAL_COMMAND ; ...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .