Summary

  • OpenSSH 8.7 introduced experimental SFTP mode for scp in 2021 and changed remote-to-remote copies to pass through the local host by default. OpenSSH 9.0 made SFTP the default transfer protocol on 8 April 2022.
  • The 9.0 release notes identify the compatibility bill: the old protocol used the remote shell for wildcard expansion and double quoting. -O remained a route back to that protocol for older servers and path patterns.

Two meanings of a familiar command

scp host:*.txt . reads like a request to collect a set of remote files. Under the legacy SCP/RCP protocol, the remote shell helped decide what that wildcard meant. The OpenSSH 9.0 release notes explain the consequence: characters with special meaning to the shell could require double quoting in an scp command line. A user had to satisfy the local shell and the remote shell at once. The filename was a parcel, but its punctuation could also be read as instructions to the warehouse.

This was not an argument about whether SSH encrypted the connection. Both transfer modes used SSH. The fault line was the file-transfer protocol and who interpreted a remote path. In the old mode, the remote user's shell did work that the command's neat syntax concealed. The current scp(1) manual still warns that legacy mode performs wildcard matching through that shell and requires careful quoting of special characters.

In OpenSSH 8.7, released in August 2021, the project added an experimental SFTP transfer mode behind scp -s. Its notes said SFTP offered more predictable filename handling and no longer needed remote-shell glob expansion. The same release changed remote-to-remote copies to travel through the local host by default. That avoided placing credentials on the origin hop and the three-way shell interpretation of filenames at local machine, origin and destination. The replacement was being tested in pieces before it became the ordinary road.

The default changed in 2022

OpenSSH 9.0, released on 8 April 2022, made SFTP the default protocol for scp. The command spelling survived. Its transport over SSH survived. What changed was the transfer conversation beneath the command. The project was explicit about a small but important incompatibility: old double quoting intended for a remote shell could now cause an SFTP-mode transfer to fail. OpenSSH called removal of the brittle quoting a benefit and declined to imitate the old behavior for the sake of compatibility.

Another edge involved paths beginning ~user/. SFTP had no native rule to expand another user's home directory. The 8.7 notes record a server-side OpenSSH path-expansion extension added to help with such paths. The 9.0 notes explain that an older SFTP server may lack the extension. A new client alone could not make that server understand an old path convention.

OpenSSH left a lever on the counter. scp -O requests the legacy SCP/RCP protocol. The current manual lists old servers without SFTP, particular wildcard patterns and old-server tilde expansion as reasons an operator might pull it. Pulling it also returns to the remote-shell parsing burden. Compatibility was a deliberate exception, with the old machinery and its sharp edges attached.

The command name was not the contract

The official OpenBSD 7.3 manual describes scp as using SFTP over an SSH connection and keeps -O for the original protocol. The current manual says the SFTP default began with OpenSSH 9.0. Those records make the historical change precise. scp did not disappear. Its default file-transfer protocol did change. The name on a command line stayed steady while the responsibility for path interpretation moved away from a remote shell.

That move changed where errors appeared. A script built around elaborate shell quoting could fail under the new default. A server lacking SFTP might require the old route. A ~user path might depend on a server extension. The practical migration was therefore a negotiation among clients, servers and saved command lines. A release could choose the default; every remote endpoint and automation script still had to live with that choice.

There is a small joke in the durable name. scp continued to advertise a secure copy, while the thing doing the copying changed. The historical lesson is not that names lie. It is that users often treat the command name as the entire interface, when the actual interface includes the protocol, the remote shell, the server's extensions and the scripts written years earlier.