How do I transfer a file into a protected application directory?
Upload to your account’s staging area first. After checking content and integrity, an authorised administrator can place the selected file into its final application location with the correct owner and mode. SCP itself does not run sudo at the destination.
Instructions
1. Upload to a separate staging filename
The example uploads a nonsecret application configuration for later review.
scp ".\app.conf" adminuser@203.0.113.10:app.conf.pendingConfirm this staging filename is unused. No protected application directory is changed by this upload.
2. Inspect the staged file and final target
Check content privately, calculate a hash and confirm the destination’s required owner, group and mode. Validate the configuration with the application’s own checker before using it.
ls -l "$HOME/app.conf.pending"
sha256sum "$HOME/app.conf.pending"These checks identify the staged file. They do not establish that its syntax is valid for the application.
3. Apply the approved single-file deployment
The example final path is illustrative and must be replaced by the authorised application path.
sudo install -o root -g root -m 640 "$HOME/app.conf.pending" /etc/example-app/app.confThis copies one file and sets explicit attributes. It overwrites the named destination if present and does not automatically reload the application.
Check the result
- The final file has the approved content, owner, group and permissions.
- The application’s validation and authorised reload checks succeed.
Troubleshooting
- The application cannot read the file
- Its service account or group may differ from this example; use the application’s documented ownership model.
- Configuration validation fails
- Do not reload the service. Correct the staged file and repeat validation first.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.