scp Command

Purpose

Securely copy files between a local and a remote host, or between two remote hosts, in a restricted PowerVC environment.

Syntax

To copy a file from source to target

scp [ -o ] [ -p ] [ -P <port> ] [ -q ] [ -r ] [ -v ] <source> <destination>

To copy multiple files into a directory

scp [ -o ] [ -p ] [ -P <port> ] [ -q ] [ -r ] [ -v ] <source1> <source2> … <directory>

Description

The scp command that is provided in the PowerVC environment is a wrapper around the standard scp utility. The scp command in PowerVC enforces path restrictions on local source and destination files to prevent unauthorized access to sensitive areas of the file system.

The remote path that contains a colon (:) in their path name are unrestricted. Relative paths and symbolic links are not resolved before the check. The path is evaluated exactly as written.

Flags

Any valid flag that is accepted by the standard scp command might be used with the PowerVC scp command.

Table 1. Flags
Item	Description
-p	Preserves the modification times, access times, and modes.
-r	Recursively copies directories.
-v	Verbose mode.
-q	Quiet mode. This parameter suppresses the progress meter.
-P `port`	Specifies the port to connect to on the remote host.
-o `option`	Passes an option to the Secure Shell (SSH). For example, `-o StrictHostKeyChecking=no`.
`source`	Specifies the path from where files must be copied from the local system. It is allowed to copy files from the following directories: $HOME /tmp /powervclog /var/log /powervchome/backups /var/opt/ibm/powervc/backups /powervchome/diagnostics /powervchome/powervc-images /powervchome/powervc-images/ova /var/opt/ibm/powervc/ova
`destination`	Specifies the path where files must be copied to in the local system. It is allowed to copy files to the following directories: $HOME /tmp /powervchome/backups /powervchome/diagnostics /powervchome/powervc-images /powervchome/powervc-images/ova

Note: Run the following command to display help for the scp command.

scp -h

or

scp --help

Path restriction Policy

A directory path is allowed if it starts with any of the configured prefixes.
In appliance-to-appliance transfers, path restrictions apply to both source and destination.
In transfers that involve a nonappliance system, the side that is using standard /usr/bin/scp path has no path restrictions.

Examples

To copy a local diagnostic file to a remote host, enter the following command:
```
scp /powervchome/diagnostics/diag.tar.gz user@remotehost:/tmp/
```
To copy a file from a remote host to an allowed local directory, enter the following command:
```
scp user@remotehost:/tmp/report.log /powervchome/backups/
```
To recursively copy an OVA image from local to remote, enter the following command:
```
scp -r /powervchome/powervc-images/ova/myimage.ova user@remotehost:~/images/
```
To attempt to copy a file from a restricted path, enter the following command:
```
scp /etc/passwd user@remotehost:/tmp/
```
The attempt to copy a file from a restricted path fails with the following message:
```
Permission denied: Access to restricted source path blocked for scp: /etc/passwd
```