How to Create and Extract Archives Over SSH with tar

The most useful SSH archive pattern is a tar pipeline: make tar write an archive to standard output on one machine, send that byte stream through ssh, and redirect or extract it on the other machine. For example, this creates a compressed backup of a remote directory directly on your computer without leaving an archive file on the server:

Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.

ssh user@host 'tar czf - /var/www' > website-backup.tar.gz

The remote command creates a gzip-compressed tar stream, SSH carries it, and the local shell saves it. The same idea works in the opposite direction, for remote extraction, and for streaming a directory straight into a local restore directory.

#	Preview	Product	Price
1		The Linux Command Line, 3rd Edition: A Complete Introduction	$27.94	Buy on Amazon
2		The Linux Command Line, 2nd Edition: A Complete Introduction	$11.34	Buy on Amazon
3		Linux Command Line: A Simple Beginner’s Guide to Linux Commands and Terminal Basics	$1.99	Buy on Amazon
4		Linux Pocket Guide: Essential Commands	$19.75	Buy on Amazon
5		Linux Command Reference Guide: 500+ Essential Commands and Examples for Everyday Use (Rheinwerk...	$33.91	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

How the SSH and tar pieces fit together

GNU tar is used to create, list, and extract tar archives. Its three core operations are create (-c), list (-t), and extract (-x). The archive file argument can be an ordinary filename, or a single hyphen. A hyphen tells tar to read archive bytes from standard input or write them to standard output. That convention is what makes an SSH pipeline possible.

SSH runs a command on the remote host and transports its standard input and output over the encrypted connection. The local shell still controls redirections that appear outside the quoted remote command. This distinction matters: in ssh user@host 'tar czf - /var/www' > website-backup.tar.gz, tar runs remotely, while the > redirection creates the file locally.

#1 Best Overall

Sale

The Linux Command Line, 3rd Edition: A Complete Introduction

$27.94

Buy on Amazon

The three tar operations

Compression flags

Compression is selected with a flag: -z for gzip, -j for bzip2, and -J for xz. GNU tar also supports lzip, lzma, lzop, zstd, and traditional compress. The -a option can select a compressor from the archive filename suffix when tar is creating an archive. When bytes arrive through standard input, there is no filename suffix for tar to inspect, so specify the matching compression flag explicitly.

Prerequisites before you stream anything

• An SSH client on the machine where you start the command and an SSH server on the destination host.
• An account that can read every source file and directory. For extraction, it must also be able to write the destination.
• tar on every side where tar runs.
• The compressor and decompressor required by your chosen mode. Gzip mode needs the gzip program, bzip2 mode needs bzip2, and xz mode needs xz support.
• Enough space at the receiving end for the archive file or the expanded contents, depending on the pipeline.

Test the connection and the remote tools before starting a long transfer. For example, ssh user@host 'command -v tar gzip' should return paths for the required programs. If the remote account cannot access a directory, changing the SSH command will not fix that permission problem; use an account or destination with the required rights.

Create an archive on a remote host and save it locally

This is the usual remote-backup pattern. Tar runs on the server, writes compressed bytes to standard output, and your local shell redirects those bytes to a file.

ssh user@host 'tar czf - /var/www' > website-backup.tar.gz

1. Replace user@host with the SSH account and host name.
2. Replace /var/www with the remote path you want to read.
3. Keep the entire remote tar command inside single quotes. This prevents the local shell from expanding remote paths, globs, or operators before SSH sends the command.
4. Put the local output redirection outside those quotes. The resulting website-backup.tar.gz is created on the computer where you run SSH.

The hyphen after czf is essential. It tells tar not to create a named file on the server and instead to emit the archive stream. The command therefore avoids a temporary archive on the remote disk. Tar may print diagnostic messages to the remote standard error stream; those messages are separate from the archive bytes written to standard output.

Choosing paths inside the archive

Tar records the path you provide. An absolute source such as /var/www can produce members rooted at that path, while a relative source such as ./project records a path relative to the directory from which tar runs. Decide which layout you want before restoring. If the archive will be moved between systems, a relative path often makes the extraction destination easier to control.

Rank #2

The Linux Command Line, 2nd Edition: A Complete Introduction

$11.34

Buy on Amazon

Create an archive locally and save it on the remote host

Reverse the pipeline when the source data is on your computer and the archive file belongs on the server:

tar czf - ./project | ssh user@host 'cat > project.tar.gz'

Local tar reads ./project, compresses it with gzip, and writes to standard output. The pipe feeds that stream to SSH. On the remote side, cat > project.tar.gz writes the received bytes to a file. Because the redirection is inside the quoted remote command, the file is created on the remote host rather than locally.

This command does not extract the files on the server; it stores one archive there. To restore it later, inspect it with ssh user@host 'tar tzf project.tar.gz', then extract it into a deliberate directory.

Extract a local archive on a remote host

When an archive already exists locally, stream it into tar running remotely:

cat project.tar.gz | ssh user@host 'tar xzf - -C /srv/project'

1. cat reads the local archive and sends its bytes into the pipe.
2. SSH forwards those bytes as standard input to the remote command.
3. Remote tar uses x to extract, z to decode gzip, and f - to read the archive from standard input.
4. -C /srv/project selects the remote extraction directory.

The destination must already exist or be creatable by the remote account. If it is a protected system location, use an appropriate account and confirm that writing there is intended. Do not omit the compression flag merely because the stream has a .gz filename on your computer; the remote tar process sees bytes from standard input, not that filename.

Rank #3

Linux Command Line: A Simple Beginner’s Guide to Linux Commands and Terminal Basics

$1.99

Buy on Amazon

A direct redirection variant

You can use input redirection instead of cat:

ssh user@host 'tar xzf - -C /srv/project' < project.tar.gz

Here the local shell supplies the archive as SSH standard input, while the remote tar command still reads from its own standard input. Both forms transfer the same bytes; choose the one that is clearer in your scripts.

Extract a remote directory locally without creating a remote archive

This pipeline creates the archive stream remotely and extracts it immediately on your machine:

ssh user@host 'tar czf - /var/log/app' | tar xzf - -C ./app-log-copy

The first tar process runs on the remote host. The second tar process runs locally, decodes gzip, and writes members into ./app-log-copy. No .tar.gz file is stored on either side unless you add a redirection. This is useful when you need a one-time copy of a directory and have space for the expanded files but do not need an intermediate archive.

Create or select the local destination deliberately. If it does not exist, create it before extraction with your normal directory-creation command, then run the pipeline. A destination such as ./app-log-copy makes it clear where files will land and avoids accidentally unpacking into an unrelated current directory.

Inspect an archive before extracting it

Listing is a safety step, not just a convenience. For an uncompressed archive, run:

Rank #4

Sale

Linux Pocket Guide: Essential Commands

$19.75

Buy on Amazon

tar tf backup.tar

For gzip, use:

tar tzf backup.tar.gz

For a remote archive, list it over SSH without extracting:

ssh user@host 'tar tzf project.tar.gz'

Review the member names, top-level directories, and any unexpected absolute paths or parent-directory components. Archives from an untrusted source deserve particular care: extract only after you understand what each member name will do, and use a dedicated destination rather than a sensitive system directory. GNU tar documents untrusted extraction as a separate safety concern because archive names can affect locations outside the directory you intended.

Preserve or avoid permissions intentionally

By default, extraction is subject to the destination’s normal ownership and permission rules. Add tar’s -p option only when restoring permissions is intentional and the account is allowed to do so. On a game server or shared host, blindly restoring ownership or mode bits can make files inaccessible to the service account or expose them more broadly than expected. If ordinary content restoration is the goal, leave -p out and let the destination’s normal rules apply.

Quote remote commands correctly

There are two shells to think about: your local shell and the shell started by SSH on the host. Single-quote the complete remote command whenever it contains paths, wildcards, pipes, or redirections that should be interpreted remotely.

ssh user@host 'tar czf - /srv/game-data' > game-data.tar.gz

In this example, the remote shell interprets the tar command, while the local shell interprets the final redirection. Moving the redirection inside the quotes changes the destination:

Best Value

Sale

Linux Command Reference Guide: 500+ Essential Commands and Examples for Everyday Use (Rheinwerk Computing)

$33.91

Buy on Amazon

ssh user@host 'tar czf - /srv/game-data > game-data.tar.gz'

Now the archive file is created on the remote host. This is often useful, but it is a different operation. Keep the placement of every pipe and redirection deliberate.

Choosing tar over SSH, scp, sftp, or rsync

OpenSSH supplies ssh, scp, and sftp. Rsync can use SSH as its remote shell. Use scp or sftp when an archive already exists and you simply need to copy it. Use tar over SSH when packaging and transport belong in one operation. Choose rsync for repeated updates to a directory tree, especially when sending a complete archive every time would be inefficient.

Practical backup patterns for game servers

Game-server worlds, configuration directories, and log trees are ordinary files from tar’s point of view. The important decisions are consistency, permissions, and destination. If the service is actively writing files, stop it or use the server’s own save procedure before archiving when consistent state matters; tar can only capture the filesystem state it encounters while reading.

Save a remote world locally

ssh admin@game-host 'tar czf - /srv/game/world' > world-backup.tar.gz

This keeps the compressed backup on the administrator’s machine. Use a filename that identifies the server and backup time according to your own retention scheme.

Restore a local world to a remote staging directory

cat world-backup.tar.gz | ssh admin@game-host 'tar xzf - -C /srv/game/staging'

List the archive first, confirm that the recorded top-level directory is what you expect, and restore into staging before replacing a live directory. Apply -p only if preserving the archive’s permission bits is part of the recovery plan.

Reliability checklist for long streams

• Confirm the source path is correct and readable by the SSH account.
• Confirm the receiving file system has enough space for the archive or extracted tree.
• Verify that tar and the required compressor exist on the machine where each tar process runs.
• Quote the remote command so expansion and redirection happen on the intended side.
• Use an explicit -C destination when extracting.
• Inspect members with tar tf or tar tzf before unpacking an archive you did not create yourself.
• Do not add -p unless restoring permissions is intentional and permitted.
• Check the command’s exit status after completion. A connection failure, read error, or write error means the resulting archive or extraction may be incomplete.

Troubleshooting common failures

A concise decision guide

1. If you need a compressed file on your computer from a remote directory, run ssh user@host 'tar czf - /remote/path' > local.tar.gz.
2. If you need to store a local directory as an archive on the server, run tar czf - ./local/path | ssh user@host 'cat > remote.tar.gz'.
3. If you have a local gzip archive and want it extracted remotely, run cat local.tar.gz | ssh user@host 'tar xzf - -C /remote/destination'.
4. If you want a one-time remote-to-local copy without an intermediate archive, run ssh user@host 'tar czf - /remote/path' | tar xzf - -C ./local-destination.
5. If the archive already exists and only needs copying, use scp or sftp.
6. If the directory will be synchronized repeatedly, use rsync over SSH instead of rebuilding and retransmitting a complete tarball.

Tar’s standard-input and standard-output behavior is the key: replace the archive filename with -, place SSH between the two tar processes when necessary, and keep every redirection on the side where the file should actually be created. With an explicit compression flag, a deliberate extraction directory, and a member listing before untrusted restores, the same small set of commands covers remote backups, migrations, staging restores, and routine server maintenance.

Quick Recap

SaleBestseller No. 1

The Linux Command Line, 3rd Edition: A Complete Introduction

$27.94

Bestseller No. 2

The Linux Command Line, 2nd Edition: A Complete Introduction

$11.34

Bestseller No. 3

Linux Command Line: A Simple Beginner’s Guide to Linux Commands and Terminal Basics

$1.99

SaleBestseller No. 4

Linux Pocket Guide: Essential Commands

$19.75

SaleBestseller No. 5

Linux Command Reference Guide: 500+ Essential Commands and Examples for Everyday Use (Rheinwerk Computing)

$33.91

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.