SCP

scp [options] source ... target
scp file.txt host:/remote/dir/             # local to remote
scp host:/remote/file.txt ./local/         # remote to local
scp alice@host:/path/file .                # explicit user
scp -r ./dir host:/srv/                    # recursive; follows symlinks it meets
scp 'host:/var/log/*.log' ./logs/          # quote so the local shell does not expand the glob
scp 'host:/tmp/my file.txt' .              # SFTP mode: one level of quoting is enough
scp a.example.com:/f b.example.com:/f      # remote to remote, relayed through this machine
scp file '[2001:db8::1]:/tmp/'             # IPv6 literal needs brackets
scp ./a:b.txt host:/tmp/                   # a local name containing ':' needs a path prefix

rsync -avzP ./dir/ host:/srv/dir/                  # trailing slash on the source copies its contents
rsync -av --delete --dry-run ./dir/ host:/srv/dir/ # preview what --delete would remove
tar czf - ./dir | ssh host 'tar xzf - -C /srv'     # fast for thousands of small files
ssh host 'tar czf - /var/log/nginx' > nginx-logs.tgz

sftp host                         # interactive session; ssh_config applies
sftp -P 2222 -i ~/.ssh/id_deploy alice@host
sftp host:/var/log/app.log .      # non-interactive single download
sftp host:/var/log/               # opens the session in that directory

cat > upload.sftp <<'EOF'
-mkdir /srv/app/releases
cd /srv/app/releases
put -p my-app-1.4.2.tar.gz
ls -l my-app-1.4.2.tar.gz
EOF
sftp -q -b upload.sftp deploy@host      # -q hides the progress meter; exit status reflects the batch

rsync -av ./dir/ host:/srv/dir/                     # -a = -rlptgoD: recurse, links, perms, times, owner, group, devices
rsync -avz --partial --progress big.iso host:/srv/  # -z compresses; --partial keeps a half-sent file for resumption
rsync -av -e 'ssh -p 2222 -i ~/.ssh/id_deploy' ./dir/ host:/srv/dir/   # options for the transport
rsync -avn --itemize-changes ./dir/ host:/srv/dir/  # -n dry run, -i shows what would change and why
rsync -av --files-from=list.txt / host:/backup/     # absolute paths in list.txt, relative to the / given
rsync -av --exclude='*.log' --exclude='.git/' ./dir/ host:/srv/dir/
rsync -av --bwlimit=5m ./dir/ host:/srv/dir/        # rate in KiB/s unless suffixed; 5m = 5 MiB/s
rsync -av --rsync-path='sudo rsync' ./dir/ host:/etc/app/   # write as root without root login
rsync -avc ./dir/ host:/srv/dir/                    # -c compares checksums, not size and mtime; slow but exact
rsync -av --link-dest=/backup/prev ./dir/ host:/backup/today/   # unchanged files become hard links to prev

rsync -av --include='*/' --include='*.conf' --exclude='*' ./etc/ host:/srv/etc/   # only .conf files, keeping the tree

rsync -a ./dir/ host:/srv/dir/                       # pipelines the file list; best for repeated syncs
tar cf - -C ./dir . | ssh host 'tar xf - -C /srv/dir'   # one stream; add z on both sides only for compressible data
tar cf - -C ./dir . | ssh -o Compression=yes host 'tar xf - -C /srv/dir'   # compress the SSH channel instead
scp -r ./dir host:/srv/                              # last resort; follows symlinks and needs a round trip per file

xargs -a hosts.txt -P8 -I{} scp -q -B -o ConnectTimeout=10 config.yaml {}:/etc/app/

sha256sum big.iso                                      # local
ssh host 'sha256sum /srv/big.iso'                      # remote; compare by eye or with the script below
ssh host 'cd /srv && sha256sum -c -' < checksums.txt   # remote verification of many files from a local manifest

# Copy, then compare checksums on both ends
scp app.tar host:/tmp/ && ssh host 'sha256sum /tmp/app.tar' && sha256sum app.tar

# Fan a file out to many hosts, 8 at a time
printf '%s\n' web{1..10}.example.com | xargs -P8 -I{} scp -q -B config.yaml {}:/etc/app/

# Pull the same log from each host into a per-host file
for h in web1 web2; do scp -q "$h:/var/log/app.log" "app-$h.log"; done

# Copy only if the remote copy is older
rsync -avu file host:/srv/

# Resume an interrupted large transfer
rsync --partial --progress --append-verify big.iso host:/srv/

# Tune SFTP concurrency for a high-latency link (defaults: 64 requests, 32 KB buffer)
scp -X nrequests=128 big.iso host:/srv/

# Restrict a deploy key to file transfer only, in authorized_keys
# restrict,command="internal-sftp" ssh-ed25519 AAAA...placeholder deploy@ci

# Copy through a bastion without landing the file on it
scp -J bastion.example.com app.tar host:/tmp/

# Upload with a non-default port and key without touching ssh_config
scp -P 2222 -i ~/.ssh/id_deploy -p app.tar deploy@host:/srv/

# Keep a connection open for 10 minutes so repeated copies skip the handshake
scp -o ControlMaster=auto -o ControlPath=~/.ssh/cm-%r@%h:%p -o ControlPersist=10m app.tar host:/tmp/

# Fail fast instead of hanging when a host is down
scp -q -B -o ConnectTimeout=10 config.yaml host:/etc/app/

# Cap at 1 Mbit/s so a backup does not saturate an office link
scp -l 1000 backup.tgz host:/backup/

# Download every .conf under a remote tree, keeping the directory structure
rsync -avm --include='*/' --include='*.conf' --exclude='*' host:/etc/app/ ./app-etc/

# Preview exactly what a mirror sync would add, change and delete
rsync -avn --delete --itemize-changes ./site/ host:/var/www/site/

# Mirror with a safety net: overwritten and deleted files go to a dated backup directory
rsync -av --delete --backup --backup-dir="/srv/.rsync-backup/$(date +%F)" ./site/ host:/var/www/site/

# One overall progress line for a large tree instead of one per file
rsync -a --info=progress2 ./data/ host:/srv/data/

# Copy as root on the target using sudo without root login
rsync -av --rsync-path='sudo rsync' ./etc-app/ host:/etc/app/

# Pull a remote directory and delete files on the remote only after they arrived
rsync -av --remove-source-files host:/var/spool/out/ ./inbox/

# Stream a directory as a tarball with throughput display
tar cf - -C ./dir . | pv | ssh host 'tar xf - -C /srv/dir'

# Pull a remote directory as a tarball, compressed on the remote
ssh host 'tar czf - -C /var/lib app' > app.tgz

# Pipe a remote database dump straight to a local file with no intermediate copy
ssh db.example.com 'pg_dump -Fc my-db' > my-db.dump

# Fetch a single file non-interactively with sftp
sftp -q host:/var/log/app.log .

# Resume a half-downloaded file
sftp host <<< 'reget /srv/big.iso big.iso'

# Batch upload that aborts on the first failure and returns non-zero
printf 'cd /srv/app\nput -p release.tgz\n' | sftp -q -b - deploy@host

# Verify many files on the remote against a local manifest
sha256sum ./dist/* | sed 's# ./dist/# #' | ssh host 'cd /srv/app && sha256sum -c -'

# Copy a directory between two remotes directly (origin must authenticate to target)
scp -R -r a.example.com:/srv/app b.example.com:/srv/

# Copy a file to a name containing spaces on the remote (SFTP mode: quote once)
scp report.pdf 'host:/srv/docs/Q3 report.pdf'

# Force IPv4 when a dual-stack host has broken IPv6
scp -4 app.tar host:/tmp/

# Find what changed on the remote since the last sync without transferring anything
rsync -avnc host:/etc/app/ ./app-etc/ | grep -v '/$'

# Sync only files modified in the last day (GNU find), keeping relative paths
find ./logs -type f -mtime -1 -print0 | rsync -av --files-from=- --from0 ./ host:/backup/logs/

# Hard-link snapshot backup: unchanged files cost no space
rsync -a --link-dest=../prev ./data/ host:/backup/snap-"$(date +%F)"/

#!/usr/bin/env bash
set -euo pipefail
# usage: fanout.sh <file> <remote-dir> < hosts.txt
file=${1:?file required}; dest=${2:?remote dir required}
sum=$(sha256sum "$file" | cut -d' ' -f1)
tmp=$(mktemp -d); trap 'rm -rf -- "$tmp"' EXIT

push() {                                     # one host per invocation; called by xargs
  local host=$1
  if scp -q -B -o ConnectTimeout=10 "$file" "$host:$dest/" \
     && [[ $(ssh -o BatchMode=yes "$host" "sha256sum '$dest/${file##*/}'" | cut -d' ' -f1) == "$sum" ]]; then
    printf '%s ok\n' "$host"
  else
    printf '%s FAILED\n' "$host" >&2; printf '%s\n' "$host" >> "$tmp/failed"
  fi
}
export -f push; export file dest sum tmp
xargs -P8 -I{} bash -c 'push "$@"' _ {}

if [[ -s "$tmp/failed" ]]; then
  printf 'failed hosts:\n' >&2; cat "$tmp/failed" >&2; exit 1
fi

#!/usr/bin/env bash
set -euo pipefail
src=${1:?source dir required}; dest=${2:?user@host:/path required}
log=/var/log/mirror-$(date +%F).log
common=(-a --delete --human-readable --stats --log-file="$log")
backup_dir=".rsync-backup/$(date +%FT%H%M%S)"

changes=$(rsync "${common[@]}" --dry-run --itemize-changes "$src/" "$dest/" | grep -cE '^[<>ch*]' || true)
printf '%s changes pending\n' "$changes"
(( changes > 0 )) || exit 0

rsync "${common[@]}" --backup --backup-dir="$backup_dir" "$src/" "$dest/"
printf 'done; backups of replaced files under %s/%s\n' "$dest" "$backup_dir"

#!/usr/bin/env bash
set -euo pipefail
# usage: collect.sh out-dir host... ; collects the paths listed in $PATHS (space separated)
out=${1:?output dir required}; shift
PATHS=${PATHS:-/etc/os-release /var/log/app.log}
rc=0
for host in "$@"; do
  mkdir -p "$out/$host"
  for p in $PATHS; do
    if ! timeout 60s scp -q -B -o ConnectTimeout=10 "$host:$p" "$out/$host/${p##*/}"; then
      printf '%s: failed to fetch %s\n' "$host" "$p" >&2; rc=1
    fi
  done
done
exit "$rc"