Docker Ubuntu 20.04.6 LTS: SSH Connection Works, but SCP One-Way

SCP failures in Docker Ubuntu 20.04.6 containers typically stem from missing SFTP subsystem configurations, permission errors on the target directory, or host-side firewall rules blocking port 22, rather than inherent protocol limitations. Since Ubuntu ships with a functional SFTP server by default, verifying the sftp-server binary path and ensuring the SSH daemon configuration correctly references it usually resolves one-way transfer issues without breaking root login capabilities.

Verifying the SFTP Subsystem Configuration

The Secure Copy Protocol (SCP) relies heavily on the SSH subsystem for file transfers. In modern Ubuntu versions, including 20.04 LTS, the SSH daemon (sshd) is configured to use the internal SFTP server or an external binary depending on the installation method. If SCP fails while interactive SSH sessions work, the most common culprit is a misconfigured or missing subsystem definition in the SSH daemon configuration file. Open the SSH configuration file located at /etc/ssh/sshd_config. Look for the line that defines the subsystem for SFTP. It should resemble the following:

Subsystem sftp /usr/lib/openssh/sftp-server

In some minimal Docker images or custom builds, this line might be commented out or point to a non-existent path. The internal SFTP server is often preferred in containerized environments because it does not require spawning a new shell process, which reduces overhead and potential permission conflicts. Ensure that the path points to a valid executable. You can verify the existence of the binary by running:

ls -l /usr/lib/openssh/sftp-server

If the file exists but the configuration is incorrect, update the Subsystem directive to match the actual location. After making changes, restart the SSH service within the container using:

service ssh restart

or if using systemd:

systemctl restart ssh

This step ensures that when SCP attempts to establish a data channel, the remote end correctly invokes the SFTP protocol handler. Without this, the SSH connection may succeed for authentication, but the subsequent file transfer handshake will fail silently or return generic errors.

Checking Directory Permissions and Ownership

Even with a correct subsystem configuration, SCP can fail if the user lacks write permissions to the destination directory on the container. Unlike interactive SSH, where you might manually navigate to a writable folder, SCP attempts to write directly to the specified path immediately upon connection initiation. If the target directory is owned by root and the SCP user does not have sudo privileges or specific ACLs, the transfer will abort. Inspect the permissions of the destination directory inside the container. For example, if you are trying to copy files to /var/www/html, ensure the user has write access:

ls -ld /var/www/html

If the directory is restricted, consider changing the ownership to your application user or adjusting the group permissions. Alternatively, copy files to a temporary directory like /tmp first, which is universally writable, and then move them to their final location using mv. This two-step process helps isolate whether the issue is connectivity-related or permission-related. Additionally, check for SELinux or AppArmor restrictions if they are enabled in your Docker environment. Although less common in standard Ubuntu containers, security modules can block file writes even if standard Unix permissions appear correct. Reviewing audit logs with dmesg or journalctl can reveal denied write operations.

Host Firewall and Network Connectivity

Another frequent cause of one-way SCP issues is network-level interference between the host machine and the Docker container. While SSH uses TCP port 22 for control connections, SCP may behave differently depending on how the client interprets the connection state. Some firewalls or proxy settings on the host OS might allow inbound SSH traffic but drop subsequent data streams associated with SCP sessions. Verify that no local firewall rules on the host are interfering. On Linux hosts, check iptables or ufw status:

sudo ufw status verbose

Ensure that port 22 is explicitly allowed for both incoming and outgoing traffic related to the container's IP address. If you are using Docker’s default bridge network, the container receives an internal IP that might not be directly accessible from the host without proper routing or NAT rules. Use docker inspect to find the container's IP and test connectivity using nc (netcat):

nc -zv <container_ip> 22

If the connection succeeds but SCP still fails, try forcing SCP to use a different algorithm or version. Sometimes, mismatched cryptographic algorithms between the host's OpenSSH client and the container's server can cause negotiation failures during the data phase. You can specify the cipher explicitly:

scp -c aes128-ctr file.txt user@container:/path

For more complex network setups, refer to guides on setting up secure connections between multiple Ubuntu machines to bypass firewall restrictions. See Setup SSH Connection with 3 Ubuntu Machines to Bypass a Firewall for detailed networking strategies.

Debugging with Verbose Output

When standard checks do not resolve the issue, enabling verbose mode provides critical insight into where the handshake breaks down. Run SCP with the -v flag to see the detailed exchange between client and server.

scp -v file.txt user@container:/dest

Look for messages indicating "debug1:" followed by subsystem requests. If you see errors related to "subsystem request failed" or "channel open failure," it confirms a configuration issue on the server side. If the error occurs later, such as "write failed: Broken pipe," it suggests a network timeout or permission denial during data transfer. Comparing the output with a successful rsync operation can also highlight discrepancies. Rsync uses SSH similarly but handles chunking differently. If rsync works but SCP does not, the issue is likely specific to how the SCP client initiates the session. For users experiencing broader file transfer errors on Ubuntu VPS instances, checking Unable to Submit Files via Rsync on Ubuntu VPS may provide additional context on server-side tuning.

Frequently Asked Questions

Why does SSH work but SCP fails in Docker?

SSH establishes an interactive shell session which may succeed even if the SFTP subsystem is misconfigured, whereas SCP strictly requires a functioning SFTP subsystem for file transfers. If the subsystem path is wrong or permissions are blocked, the initial connection authenticates, but the data channel fails immediately.

Can I use SFTP instead of SCP to fix this?

Yes, replacing SCP with SFTP commands often bypasses compatibility issues because SFTP is more robust against version mismatches. You can use the sftp command-line tool or GUI clients like FileZilla, which handle the protocol negotiation more gracefully than older SCP implementations.

Does upgrading OpenSSH break SCP in Ubuntu 20.04?

Upgrading OpenSSH generally maintains backward compatibility, but changes in default ciphers or key exchange algorithms can cause older SCP clients to fail. Always ensure your host and container OpenSSH versions are reasonably close, and check the server logs for rejected handshake attempts after an upgrade.

How do I check if the SFTP subsystem is active?

You can test the subsystem by attempting to run it directly via SSH: ssh user@host echo test often triggers the subsystem if configured incorrectly, but a better test is using ssh -v user@host and looking for "subsystem request for sftp". Successful initialization indicates the subsystem is ready for SCP.

What if I cannot modify the container's sshd_config?

If you lack access to the container's configuration, you must troubleshoot from the host side by ensuring your local SCP client is not enforcing restrictive policies. Try disabling strict host key checking or specifying explicit ciphers on the command line to rule out client-side negotiation failures.