TRAMP 2.6.3 User Manual

3.1 File name syntax

Remote file names have method, user and host parts prepended. All of them, and also the local file name part, are optional, in case of a missing part a default value is assumed. The default value for an empty local file name part is the remote user’s home directory. The shortest remote file name is thus /-::. The ‘-’ notation for the default method is used for syntactical reasons, Selecting a default method.

The method part describes the connection method used to reach the remote host, see below.

The user part is the user name for accessing the remote host. For the smb method, this could also require a domain name, in which case it is written as user%domain.

The host part must be a host name which can be resolved on your local host. It could be a short host name, a fully qualified domain name, an IPv4 or IPv6 address, TRAMP file name conventions. Some connection methods also support a notation for the port to be used, in which case it is written as host#port.

3.2 Using ssh and plink

If your local host runs an SSH client, and the remote host runs an SSH server, the simplest remote file name is /ssh:user@host:/path/to/file. The remote file name /ssh:: opens a remote connection to yourself on the local host, and is often used for testing TRAMP.

On MS Windows, PuTTY is often used as the SSH client. Its plink method can be used there to open a connection to a remote host running an ssh server: /plink:user@host:/path/to/file.

3.3 Using su, sudo, doas and sg

Sometimes, it is necessary to work on your local host under different permissions. For this, you can use the su or sudo connection method. On OpenBSD systems, the doas connection method offers the same functionality. These methods use ‘root’ as default user name and the return value of (system-name) as default host name. Therefore, it is convenient to open a file as /sudo::/path/to/file.

The method sg stands for “switch group”; here the user name is used as the group to change to. The default host name is the same.

3.4 Combining ssh or plink with su, sudo or doas

If the su, sudo or doas option should be performed on another host, it can be combined with a leading ssh or plink option. That means that TRAMP connects first to the other host with non-administrative credentials, and changes to administrative credentials on that host afterwards. In a simple case, the syntax looks like /ssh:user@host|sudo::/path/to/file. See Declaring multiple hops in the file name.

3.5 Using sudoedit

The sudoedit method is similar to the sudo method. However, it is a different implementation: it does not keep an open session running in the background. This is for security reasons; on the backside this method has worse performance than the sudo method, it is restricted to ‘localhost’ only, and it does not support external processes.

3.6 Using smbclient

In order to access a remote MS Windows host or Samba server, the smbclient client is used. The remote file name syntax is /smb:user%domain@host:/path/to/file. The first part of the local file name is the share exported by the remote host, ‘path’ in this example.

3.7 Using GVFS-based methods

On systems which have GVFS (the GNOME Virtual File System) installed, its offered methods can be used by TRAMP. Examples are /sftp:user@host:/path/to/file, /afp:user@host:/path/to/file (accessing Apple’s AFP file system), /dav:user@host:/path/to/file, /davs:user@host:/path/to/file (for WebDAV shares) and /mtp:device:/path/to/file (for media devices).

3.8 Using GNOME Online Accounts based methods

GVFS-based methods also include GNOME Online Accounts, which support the Files service. These are the Google Drive file system, and the OwnCloud/NextCloud file system. The file name syntax here is always /gdrive:john.doe@gmail.com:/path/to/file (‘john.doe@gmail.com’ stands here for your Google Drive account), or /nextcloud:user@host#8081:/path/to/file (‘8081’ stands for the port number) for OwnCloud/NextCloud files.

3.9 Using FUSE-based methods

FUSE (Filesystem in Userspace) allows users to mount a virtual file system. It is also used by GVFS internally, but here we discuss methods which do not use the GVFS API.

A convenient way to access system storages is the rclone program. If you have configured a storage in rclone under a name ‘storage’ (for example), you can access it via the remote file name syntax /rclone:storage:/path/to/file. User names are not needed.

On local hosts which have installed the sshfs client for mounting a file system based on sftp, this method can be used. All remote files are available via the local mount point. TRAMP aids in mounting the file system if it isn’t mounted yet, and it supports the access with the usual file name syntax /sshfs:user@host:/path/to/file.

3.10 Using Android

An Android device, which is connected via USB to your local host, can be accessed via the adb command. No user or host name is needed. The file name syntax is /adb::/path/to/file.

4.1 Types of connections to remote hosts

Inline method and external method are the two basic types of access methods. While they both use the same remote shell access programs, such as rsh, ssh, or telnet, they differ in the file access methods. Choosing the right method becomes important for editing files, transferring large files, or operating on a large number of files.

The performance of the external methods is generally better than that of the inline methods, at least for large files. This is caused by the need to encode and decode the data when transferring inline.

The one exception to this rule are the scp-based access methods. While these methods do see better performance when actually transferring files, the overhead of the cryptographic negotiation at startup may drown out the improvement in file transfer times.

External methods should be configured in such a way that they don’t require a password (with ssh-agent, or similar). Modern scp implementations offer options to reuse existing ssh connections, which TRAMP enables by default if available. If that is not possible, you should consider Reusing passwords for several connections, otherwise you will be prompted for a password for every copy action.

4.2 Inline methods

Inline methods use the same login connection to transfer file contents. Inline methods are quick and easy for small files. They depend on the availability of suitable encoding and decoding programs on the remote host. For local source and destination, TRAMP may use built-in equivalents of such programs in Emacs.

Inline methods can work in situations where an external transfer program is unavailable. Inline methods also work when transferring files between different user identities on the same host.

TRAMP checks the remote host for the availability and usability of one of the commands defined in tramp-remote-coding-commands. TRAMP uses the first reliable command it finds. TRAMP’s search path can be customized, see How TRAMP finds and uses programs on the remote host.

In case none of the commands are available, TRAMP first transfers a small Perl program to the remote host, and then tries to use that program for encoding and decoding.

To increase transfer speeds for large text files, TRAMP can use compression before encoding. The user option tramp-inline-compress-start-size specifies the file size above which to use this optimization. This feature depends on the availability and usability of one of the commands defined in tramp-inline-compress-commands.

rsh ¶

rsh is an option for connecting to hosts within local networks since rsh is not as secure as other methods. There should be no reason to use it, as ssh is a both a complete replacement and ubiquitous.

ssh ¶

ssh is a more secure option than others to connect to a remote host.

ssh can also take extra parameters as port numbers. For example, a host on port 42 is specified as host#42 (the real host name, a hash sign, then a port number). It is the same as passing ‘-p 42’ to the ssh command.

telnet ¶

Connecting to a remote host with telnet is as insecure as the rsh method.

su ¶

Instead of connecting to a remote host, su program allows editing as another user. The host can be either ‘localhost’ or the host returned by the function (system-name). See Connecting to a remote host using multiple hops for an exception to this behavior.

sudo ¶

Similar to su method, sudo uses sudo. sudo must have sufficient rights to start a shell.

For security reasons, a sudo connection is disabled after a predefined timeout (5 minutes by default). This can be changed, see Setting own connection related information.

doas ¶

This method is used on OpenBSD like the sudo command. Like the sudo method, a doas connection is disabled after a predefined timeout.

sg ¶

The sg program allows editing as different group. The host can be either ‘localhost’ or the host returned by the function (system-name). The user name must be specified, but it denotes a group name. See Connecting to a remote host using multiple hops for an exception to this behavior.

sshx ¶

Works like ssh but without the extra authentication prompts. sshx uses ‘ssh -t -t -l user -o RemoteCommand='/bin/sh -i' host’ to open a connection with a “standard” login shell. It supports changing the remote login shell /bin/sh.

Note that sshx does not bypass authentication questions. For example, if the host key of the remote host is not known, sshx will still ask “Are you sure you want to continue connecting?”. TRAMP cannot handle such questions. Connections will have to be setup where logins can proceed without such questions.

sshx is useful for MS Windows users when ssh triggers an error about allocating a pseudo tty. This happens due to missing shell prompts that confuses TRAMP.

sshx supports the ‘-p’ argument.

krlogin ¶

This method is also similar to ssh. It uses the krlogin -x command only for remote host login.

ksu ¶

This is another method from the Kerberos suite. It behaves like su.

plink ¶

plink method is for MS Windows users with the PuTTY implementation of SSH. It uses ‘plink -ssh’ to log in to the remote host. It supports changing the remote login shell /bin/sh.

Check the ‘Share SSH connections if possible’ control for that session.

plink method supports the ‘-P’ argument.

plinkx ¶

Another method using PuTTY on MS Windows with session names instead of host names. plinkx calls ‘plink -load session -t’. User names and port numbers must be defined in the session. It supports changing the remote login shell /bin/sh.

Check the ‘Share SSH connections if possible’ control for that session.

docker ¶

Integration for Docker containers. The host name may be either a running container’s name or ID, as returned by ‘docker ps’.

podman ¶

Podman is an alternative to docker which may be run rootless, if desired.

kubernetes ¶

Integration for containers in Kubernetes pods. The host name is a pod name returned by ‘kubectl get pods’. The first container in a pod is used.

This method does not support user names.

4.3 External methods

External methods operate over multiple channels, using the remote shell connection for some actions while delegating file transfers to an external transfer program.

External methods save on the overhead of encoding and decoding of inline methods.

Since external methods have the overhead of opening a new channel, files smaller than tramp-copy-size-limit still use inline methods.

rcp ¶

This method uses the rsh and rcp commands to connect to the remote host and transfer files. This is the fastest access method available.

The alternative method remcp uses the remsh and rcp commands.

scp ¶

Using a combination of ssh to connect and scp to transfer is the most secure. While the performance is good, it is slower than the inline methods for smaller files. Though there is no overhead of encoding and decoding of the inline methods, scp’s cryptographic handshake negates those speed gains.

ssh-based methods support ‘-p’ feature for specifying port numbers. For example, host#42 passes ‘-p 42’ in the argument list to ssh, and ‘-P 42’ in the argument list to scp.

rsync ¶

ssh command to connect in combination with rsync command to transfer is similar to the scp method.

rsync performs much better than scp when transferring files that exist on both hosts. However, this advantage is lost if the file exists only on one side of the connection.

This method supports the ‘-p’ argument.

scpx ¶

scpx is useful to avoid login shell questions. It is similar in performance to scp. scpx uses ‘ssh -t -t -l user -o RemoteCommand='/bin/sh -i' host’ to open a connection. It supports changing the remote login shell /bin/sh.

scpx is useful for MS Windows users when ssh triggers an error about allocating a pseudo tty. This happens due to missing shell prompts that confuses TRAMP.

This method supports the ‘-p’ argument.

pscp

psftp ¶

These methods are similar to scp or sftp, but they use the plink command to connect to the remote host, and they use pscp or psftp for transferring the files. These programs are part of PuTTY, an SSH implementation for MS Windows.

They support changing the remote login shell /bin/sh.

Check the ‘Share SSH connections if possible’ control for that session.

These methods support the ‘-P’ argument.

fcp ¶

This method is similar to scp, but uses fsh to connect and fcp to transfer files. fsh/fcp, a front-end for ssh, reuse ssh session by submitting several commands. This avoids the startup overhead due to scp’s secure connection. Inline methods have similar benefits.

The command used for this connection is: ‘fsh host -l user /bin/sh -i’

fsh has no inline method since the multiplexing it offers is not useful for TRAMP. fsh connects to remote host and TRAMP keeps that one connection open.

nc ¶

Using telnet to connect and nc to transfer files is sometimes the only combination suitable for accessing routers or NAS hosts. These dumb devices have severely restricted local shells, such as the busybox and do not host any other encode or decode programs.

sudoedit ¶

The sudoedit method allows to edit a file as a different user on the local host. You could regard this as TRAMP’s implementation of the sudoedit. Contrary to the sudo method, all magic file name functions are implemented by single sudo … commands. The purpose is to make editing such a file as secure as possible; there must be no session running in the Emacs background which could be attacked from inside Emacs.

Consequently, external processes are not implemented.

The host name of such remote file names must represent the local host. Since the default value is already proper, it is recommended not to use any host name in the remote file name, like /sudoedit::/path/to/file or /sudoedit:user@:/path/to/file.

Like the sudo method, a sudoedit password expires after a predefined timeout.

ftp ¶

When TRAMP uses ftp, it forwards requests to whatever ftp program is specified by Ange FTP. This external program must be capable of servicing requests from TRAMP.

smb ¶

This non-native TRAMP method connects via the Server Message Block (SMB) networking protocol to hosts running file servers that are typically based on Samba or MS Windows.

Using smbclient requires a few tweaks when working with TRAMP:

The first directory in the localname must be a share name on the remote host.

Since some SMB share names end in the $ character, TRAMP must use $$ when specifying those shares to avoid environment variable substitutions.

When TRAMP is not specific about the share name or uses the generic remote directory /, smbclient returns all available shares.

Since SMB authentication is based on each SMB share, TRAMP prompts for a password even when accessing a different share on the same SMB host. This prompting can be suppressed by Reusing passwords for several connections.

To accommodate user name/domain name syntax required by MS Windows authorization, TRAMP provides for an extended syntax in user%domain format (where user is the user name, % is the percent symbol, and domain is the MS Windows domain name). An example:

/smb:daniel%BIZARRE@melancholia:/daniel$$/.emacs

where user daniel connects as a domain user to the SMB host melancholia in the MS Windows domain BIZARRE to edit .emacs located in the home directory (share daniel$).

Alternatively, for local WINS users (as opposed to domain users), substitute the domain name with the name of the local host in UPPERCASE as shown here:

/smb:daniel%MELANCHOLIA@melancholia:/daniel$$/.emacs

where user daniel connects as local user to the SMB host melancholia in the local domain MELANCHOLIA to edit .emacs located in the home directory (share daniel$).

The domain name and user name are optional for smbclient authentication. When user name is not specified, smbclient uses the anonymous user (without prompting for password). This behavior is unlike other TRAMP methods, where local user name is substituted.

The smb method is unavailable if Emacs is run under a local user authentication context in MS Windows. However such users can still access remote files using UNC file names instead of TRAMP:

//melancholia/daniel$$/.emacs

UNC file name specification does not allow the specification of a different user name for authentication like the smbclient can.

adb ¶

This method uses Android Debug Bridge program for accessing Android devices. The Android Debug Bridge must be installed locally for TRAMP to work. Some GNU/Linux distributions provide Android Debug Bridge as an installation package. Alternatively, the program is installed as part of the Android SDK. TRAMP finds the adb program either via the PATH environment variable or the absolute path set in the user option tramp-adb-program.

TRAMP connects to Android devices with adb only when the user option tramp-adb-connect-if-not-connected is not nil. Otherwise, the connection must be established outside Emacs.

TRAMP does not require a host name part of the remote file name when a single Android device is connected to adb. TRAMP instead uses /adb:: as the default name. adb devices, run in a shell outside Emacs, shows available host names.

adb method normally does not need user name to authenticate on the Android device because it runs under the adbd process. But when a user name is specified, however, TRAMP applies an su in the syntax. When authentication does not succeed, especially on un-rooted Android devices, TRAMP displays login errors.

For Android devices connected through TCP/IP, a port number can be specified using device#42 host name syntax or TRAMP can use the default value as declared in adb command. Port numbers are not applicable to Android devices connected through USB.

4.4 GVFS-based external methods

GVFS is the virtual file system for the GNOME Desktop, https://en.wikipedia.org/wiki/GVFS. Remote files on GVFS are mounted locally through FUSE and TRAMP uses this locally mounted directory internally.

Emacs uses the D-Bus mechanism to communicate with GVFS. Emacs must have the message bus system, D-Bus integration active, see (dbus)D-Bus.

afp ¶

This method is for connecting to remote hosts with the Apple Filing Protocol for accessing files on macOS volumes. TRAMP access syntax requires a leading volume (share) name, for example: /afp:user@host:/volume.

dav

davs ¶

dav method provides access to WebDAV files and directories based on standard protocols, such as HTTP. davs does the same but with SSL encryption. Both methods support the port numbers.

Paths being part of the WebDAV volume to be mounted by GVFS, as it is common for OwnCloud or NextCloud file names, are not supported by these methods. See method nextcloud for handling them.

gdrive ¶

Via the gdrive method it is possible to access your Google Drive online storage. User and host name of the remote file name are your email address of the Google Drive credentials, like /gdrive:john.doe@gmail.com:/. These credentials must be populated in your Online Accounts application outside Emacs.

Since Google Drive uses cryptic blob file names internally, TRAMP works with the display-name of the files. This could produce unexpected behavior in case two files in the same directory have the same display-name, such a situation must be avoided.

mtp ¶

Media devices, like cell phones, tablets, cameras, can be accessed via the mtp method. Just the device name is needed in order to specify the host in the file name. However, the device must already be connected via USB, before accessing it. Possible device names are visible via host name completion, File name completion.

Depending on the device type, the access could be read-only. Some devices are accessible under different names in parallel, offering different parts of their file system.

TRAMP does not require a host name as part of the remote file name when a single media device is connected. TRAMP instead uses /mtp:: as the default name.

nextcloud ¶

As the name indicates, the method nextcloud allows you to access OwnCloud or NextCloud hosted files and directories. Like the gdrive method, your credentials must be populated in your Online Accounts application outside Emacs. The method supports port numbers.

sftp ¶

This method uses sftp in order to securely access remote hosts. sftp is a more secure option for connecting to hosts that for security reasons refuse ssh connections.

When there is a respective entry in your ssh configuration, do not set the RemoteCommand option.

User Option: tramp-gvfs-methods ¶

This user option is a list of external methods for GVFS. By default, this list includes afp, dav, davs, gdrive, mtp, nextcloud and sftp. Other methods to include are ftp, http, https and smb. These methods are not intended to be used directly as GVFS-based method. Instead, they are added here for the benefit of Archive file names.

If you want to use GVFS-based ftp or smb methods, you must add them to tramp-gvfs-methods, and you must disable the corresponding TRAMP package by setting tramp-ftp-method or tramp-smb-method to nil, respectively:

(add-to-list 'tramp-gvfs-methods "ftp")
(customize-set-variable 'tramp-ftp-method nil)

4.5 FUSE-based external methods

Besides GVFS, there are other virtual file systems using the FUSE interface. Remote files are mounted locally through FUSE and TRAMP uses this locally mounted directory internally. When possible, TRAMP maps the remote file names to their respective local file name, and applies the file name operation on them. For some of the file name operations this is not possible, TRAMP emulates those operations otherwise.

rclone ¶

The program rclone allows to access different system storages in the cloud, see https://rclone.org/ for a list of supported systems. If the rclone program isn’t found in your PATH environment variable, you can tell TRAMP its absolute path via the user option tramp-rclone-program.

A system storage must be configured via the rclone config command, outside Emacs. If you have configured a storage in rclone under a name ‘storage’ (for example), you could access it via the remote file name

/rclone:storage:/path/to/file

User names are part of the rclone configuration, and not needed in the remote file name. If a user name is contained in the remote file name, it is ignored.

Internally, TRAMP mounts the remote system storage at location /tmp/tramp.rclone.storage, with storage being the name of the configured system storage.

The mount point and optional flags to the different rclone operations could be passed as connection properties, See Setup of rclone method.

Access via rclone is slow. If you have an alternative method for accessing the system storage, you should use it. GVFS-based external methods for example, methods gdrive and nextcloud.

sshfs ¶

On local hosts which have installed the sshfs client for mounting a file system based on sftp, this method can be used, see https://github.com/libfuse/sshfs/blob/master/README.rst/. If the sshfs program isn’t found in your PATH environment variable, you can tell TRAMP its absolute path via the user option tramp-sshfs-program.

All remote files are available via the local mount point. TRAMP aids in mounting the file system if it isn’t mounted yet. The remote file name syntax is

/sshfs:user@host#port:/path/to/file

User name and port number are optional. This method does not support password handling, the file system must either be mounted already, or the connection must be established passwordless via ssh keys.

The mount point and mount arguments could be passed as connection properties, See Setup of sshfs method.

4.6 Selecting a default method

In a remote file name, the use of a default method is indicated by the pseudo method -, TRAMP file name conventions.

User Option: tramp-default-method ¶

Default method is for transferring files. The user option tramp-default-method sets it. TRAMP uses this user option to determine the default method for remote file names that do not have one specified.

(customize-set-variable 'tramp-default-method "ssh")

User Option: tramp-default-method-alist ¶

Default methods for transferring files can be customized for specific user and host combinations through the user option tramp-default-method-alist.

For example, the following two lines specify to use the ssh method for all user names matching ‘john’ and the rsync method for all host names matching ‘lily’. The third line specifies to use the su method for the user ‘root’ on the host ‘localhost’.

(add-to-list 'tramp-default-method-alist '("" "john" "ssh"))
(add-to-list 'tramp-default-method-alist '("lily" "" "rsync"))
(add-to-list 'tramp-default-method-alist
             '("\\`localhost\\'" "\\`root\\'" "su"))

External methods performance faster for large files. see Inline methods. see External methods.

Choosing the access method also depends on the security environment. For example, rsh and telnet methods that use clear text password transfers are inappropriate for over the Internet connections. Secure remote connections should use ssh that provide encryption.

• Which method to use?

C-x C-f /ssh:root@otherhost:/etc/motd RET

C-x C-f /su::/etc/motd RET

4.7 Selecting a default user

User Option: tramp-default-user ¶

A TRAMP file name can omit the user name part since TRAMP substitutes the currently logged-in user name. However this substitution can be overridden with tramp-default-user. For example:

(customize-set-variable 'tramp-default-user "root")

User Option: tramp-default-user-alist ¶

Instead of a single default user, tramp-default-user-alist allows multiple default user values based on access method or host name combinations. The alist can hold multiple values. For example, to use the ‘john’ as the default user for the domain ‘somewhere.else’ only:

(add-to-list 'tramp-default-user-alist
             '("ssh" ".*\\.somewhere\\.else\\'" "john"))

A Caution: TRAMP will override any default user specified in the configuration files outside Emacs, such as ~/.ssh/config. To stop TRAMP from applying the default value, set the corresponding alist entry to nil:

(add-to-list 'tramp-default-user-alist
             '("ssh" "\\`here\\.somewhere\\.else\\'" nil))

The last entry in tramp-default-user-alist should be reserved for catch-all or most often used login.

(add-to-list 'tramp-default-user-alist
             '(nil nil "jonas") t)

4.8 Selecting a default host

User Option: tramp-default-host ¶

When host name is omitted, TRAMP substitutes the value from the tramp-default-host user option. It is initially populated with the local host name where Emacs is running. The default method, default user and default host can be overridden as follows:

(custom-set-variables
 '(tramp-default-method "ssh")
 '(tramp-default-user "john")
 '(tramp-default-host "target"))

With all defaults set, ‘/-::’ will connect TRAMP to John’s home directory on target via ssh.

User Option: tramp-default-host-alist ¶

Instead of a single default host, tramp-default-host-alist allows multiple default host values based on access method or user name combinations. The alist can hold multiple values. While tramp-default-host is sufficient in most cases, some methods, like adb, require defaults overwritten.

4.9 Connecting to a remote host using multiple hops

Multi-hops are methods to reach hosts behind firewalls or to reach the outside world from inside a bastion host. With multi-hops, TRAMP can negotiate these hops with the appropriate user/host authentication at each hop. All methods until now have been the single hop kind, where the start and end points of the connection did not have intermediate check points.

User Option: tramp-default-proxies-alist ¶

tramp-default-proxies-alist specifies proxy hosts to pass through. This user option is list of triples consisting of (host user proxy).

The first match is the proxy host through which passes the file name and the target host matching user@host. host and user are regular expressions or nil, interpreted as a regular expression which always matches.

proxy is a literal TRAMP file name whose local name part is ignored, and the method and user name parts are optional.

The method must be an inline method (see Inline methods). If proxy is nil, no additional hop is required reaching user@host.

For example, to pass through the host ‘bastion.your.domain’ as user ‘bird’ to reach remote hosts outside the local domain:

(add-to-list 'tramp-default-proxies-alist
             '("\\." nil "/ssh:bird@bastion.your.domain:"))
(add-to-list 'tramp-default-proxies-alist
             '("\\.your\\.domain\\'" nil nil))

Note: add-to-list adds elements at the beginning of a list. Therefore, most relevant rules must come last in the list.

Proxy hosts can be cascaded in the alist. If there is another host called ‘jump.your.domain’, which is the only host allowed to connect to ‘bastion.your.domain’, then:

(add-to-list 'tramp-default-proxies-alist
             '("\\`bastion\\.your\\.domain\\'"
               "\\`bird\\'"
               "/ssh:jump.your.domain:"))

proxy can take patterns %h or %u for host or user respectively. Ports or domains, if they are part of a hop file name, are not expanded by those patterns.

To login as ‘root’ on remote hosts in the domain ‘your.domain’, but login as ‘root’ is disabled for non-local access, then use this alist entry:

(add-to-list 'tramp-default-proxies-alist
             '("\\.your\\.domain\\'" "\\`root\\'" "/ssh:%h:"))

Opening /sudo:randomhost.your.domain: first connects to ‘randomhost.your.domain’ via ssh under your account name, and then performs sudo -u root on that host.

It is key for the sudo method in the above example to be applied on the host after reaching it and not on the local host. TRAMP checks therefore, that the host name for such hops matches the host name of the previous hop.

host, user and proxy can also take Lisp forms. These forms when evaluated must return either a string or nil.

To generalize (from the previous example): For all hosts, except my local one, first connect via ssh, and then apply sudo -u root:

(add-to-list 'tramp-default-proxies-alist
             '(nil "\\`root\\'" "/ssh:%h:"))
(add-to-list 'tramp-default-proxies-alist
             `(,(regexp-quote (system-name)) nil nil))

Passing through hops involves dealing with restricted shells, such as rbash. If TRAMP is made aware, then it would use them for proxies only.

User Option: tramp-restricted-shell-hosts-alist ¶

An alist of regular expressions of hosts running restricted shells, such as rbash. TRAMP will then use them only as proxies.

To specify the bastion host from the example above as running a restricted shell:

(add-to-list 'tramp-restricted-shell-hosts-alist
             "\\`bastion\\.your\\.domain\\'")

4.10 Passing firewalls

Sometimes, it is not possible to reach a remote host directly. A firewall might be in the way, which could be passed via a proxy server.

Both OpenSSH and PuTTY support such proxy settings, using an HTTP tunnel via the CONNECT command (conforming to RFC 2616, 2817 specifications). Proxy servers using HTTP 1.1 or later protocol support this command.

• Tunneling with ssh
• Tunneling with PuTTY

Host host.other.domain
     ProxyCommand nc -X connect -x proxy.your.domain:3128 %h %p

4.11 Using Non-Standard Methods

The tramp-methods variable currently has an exhaustive list of predefined methods. Any part of this list can be modified with more suitable settings. Refer to the Lisp documentation of that variable, accessible with C-h v tramp-methods RET.

In the ELPA archives, there are several examples of such extensions. They can be installed with Emacs’s Package Manager. This includes

‘lxc-tramp’ ¶

Integration for LXC containers. A container is accessed via /lxc:container:/path/to/file, ‘container’ has the same meaning as with the docker method. A ‘user’ specification is ignored.

‘lxd-tramp’ ¶

Integration for LXD containers. A container is accessed via /lxd:user@container:/path/to/file, ‘user’ and ‘container’ have the same meaning as with the docker method.

‘magit-tramp’ ¶

Browsing Git repositories with magit. A versioned file is accessed via /git:rev@root-dir:/path/to/file. ‘rev’ is a Git revision, and ‘root-dir’ is a virtual host name for the root directory, specified in magit-tramp-hosts-alist.

‘tramp-hdfs’ ¶

Access of a hadoop/hdfs file system. A file is accessed via /hdfs:user@node:/path/to/file, where ‘user’ is the user that you want to use, and ‘node’ is the name of the hadoop server.

‘tramp-nspawn’ ¶

Access to environments provided by systemd-nspawn. A file is accessed via /nspawn:user@container:/path/to/file, where ‘user’ is the (optional) user that you want to use, and ‘container’ is the container to connect to. systemd-nspawn and its container utilities often require super user access to run, use multi-hop file names with doas or sudo to raise your privileges.

‘vagrant-tramp’ ¶

Convenience method to access vagrant boxes. It is often used in multi-hop file names like /vagrant:box|sudo:box:/path/to/file, where ‘box’ is the name of the vagrant box.

4.12 Selecting config files for user/host name completion

tramp-completion-function-alist uses predefined files for user and host name completion (see File name completion). For each method, it keeps a set of configuration files and a function that can parse that file. Each entry in tramp-completion-function-alist is of the form (method pair1 pair2 …).

Each pair is composed of (function file). function is responsible for extracting user names and host names from file for completion. There are two functions which access this variable:

Function: tramp-get-completion-function method ¶

This function returns the list of completion functions for method.

Example:

(tramp-get-completion-function "rsh")

     ⇒ ((tramp-parse-rhosts "/etc/hosts.equiv")
         (tramp-parse-rhosts "~/.rhosts"))

Function: tramp-set-completion-function method function-list ¶

This function sets function-list as list of completion functions for method.

Example:

(tramp-set-completion-function "ssh"
 '((tramp-parse-sconfig "/etc/ssh_config")
   (tramp-parse-sconfig "~/.ssh/config")))

     ⇒ ((tramp-parse-sconfig "/etc/ssh_config")
         (tramp-parse-sconfig "~/.ssh/config"))

The following predefined functions parsing configuration files exist:

tramp-parse-rhosts ¶

This function parses files which are syntactical equivalent to ~/.rhosts. It returns both host names and user names, if specified.

tramp-parse-shosts ¶

This function parses files which are syntactical equivalent to ~/.ssh/known_hosts. Since there are no user names specified in such files, it can return host names only.

tramp-parse-sconfig ¶

This function returns the host nicknames defined by Host entries in ~/.ssh/config style files.

tramp-parse-shostkeys ¶

SSH2 parsing of directories /etc/ssh2/hostkeys/* and ~/ssh2/hostkeys/*. Hosts are coded in file names hostkey_portnumber_host-name.pub. User names are always nil.

tramp-parse-sknownhosts ¶

Another SSH2 style parsing of directories like /etc/ssh2/knownhosts/* and ~/ssh2/knownhosts/*. This case, hosts names are coded in file names host-name.algorithm.pub. User names are always nil.

tramp-parse-hosts ¶

A function dedicated to /etc/hosts for host names.

tramp-parse-passwd ¶

A function which parses /etc/passwd for user names.

tramp-parse-etc-group ¶

A function which parses /etc/group for group names.

tramp-parse-netrc ¶

A function which parses ~/.netrc and ~/.authinfo-style files.

To keep a custom file with custom data in a custom structure, a custom function has to be provided. This function must meet the following conventions:

Function: my-tramp-parse file ¶

file must be either a file on the host, or nil. The function must return a list of (user host), which are taken as candidates for completion for user and host names.

Example:

(my-tramp-parse "~/.my-tramp-hosts")

     ⇒ ((nil "toto") ("daniel" "melancholia"))

4.13 Reusing passwords for several connections

To avoid repeated prompts for passwords, consider native caching mechanisms, such as ssh-agent for ssh-like methods, or pageant for plink-like methods.

TRAMP offers alternatives when native solutions cannot meet the need.

• Using an authentication file
• Caching passwords

machine melancholia port scp login daniel password geheim

machine melancholia#4711 port davs login daniel%BIZARRE password geheim

machine host port sudo login user password secret

(customize-set-variable 'ange-ftp-netrc-filename "~/.authinfo.gpg")

(connection-local-set-profile-variables
 'remote-without-auth-sources '((auth-sources . nil)))

(connection-local-set-profiles
 '(:application tramp) 'remote-without-auth-sources)

4.14 Reusing connection related information

For faster initial connection times, TRAMP stores previous connection properties in a file specified by the user option tramp-persistency-file-name.

The default file name for tramp-persistency-file-name is ~/.emacs.d/tramp.

TRAMP reads this file during Emacs startup, and writes to it when exiting Emacs. Delete this file for TRAMP to recreate a new one on next Emacs startup.

Set tramp-persistency-file-name to nil to disable storing connections persistently.

When TRAMP detects a change in the operating system version in a remote host (via the command uname -sr), it flushes all connection related information for that host and creates a new entry.

4.15 Setting own connection related information

For more precise customization, parameters specified by tramp-methods can be overwritten manually.

Set tramp-connection-properties to manually override tramp-methods. Properties in this list are in the form (regexp property value). regexp matches remote file names. Use nil to match all. property is the property’s name, and value is the property’s value.

property is any method specific parameter contained in tramp-methods. The parameter key in tramp-methods is a symbol name tramp-<foo>. To overwrite that property, use the string "<foo>" for property. For example, this changes the remote shell:

(add-to-list 'tramp-connection-properties
             (list (regexp-quote "/ssh:user@randomhost.your.domain:")
                   "remote-shell" "/bin/ksh"))

(add-to-list 'tramp-connection-properties
             (list (regexp-quote "/ssh:user@randomhost.your.domain:")
                   "remote-shell-login" '("-")))

The parameters tramp-remote-shell and tramp-remote-shell-login in tramp-methods now have new values for the remote host.

property could also be any property found in tramp-persistency-file-name.

• Relevant connection properties to override

4.16 How TRAMP finds and uses programs on the remote host

TRAMP requires access to and rights to several commands on remote hosts: ls, test, find and cat.

Besides there are other required programs for Inline methods and External methods of connection.

To improve performance and accuracy of remote file access, TRAMP uses perl (or perl5) and grep when available.

User Option: tramp-remote-path ¶

tramp-remote-path specifies which remote directory paths TRAMP can search for How TRAMP finds and uses programs on the remote host.

TRAMP uses standard defaults, such as /bin and /usr/bin, which are reasonable for most hosts. To accommodate differences in hosts and paths, for example, /bin:/usr/bin on Debian GNU/Linux or /usr/xpg4/bin:/usr/ccs/bin:/usr/bin:/opt/developerstudio12.6/bin on Solaris, TRAMP queries the remote host with getconf PATH and updates the symbol tramp-default-remote-path.

For instances where hosts keep obscure locations for paths for security reasons, manually add such paths to local .emacs as shown below for TRAMP to use when connecting.

(add-to-list 'tramp-remote-path "/usr/local/perl/bin")

Another way to find the remote path is to use the path assigned to the remote user by the remote host. TRAMP does not normally retain this remote path after login. However, tramp-own-remote-path preserves the path value, which can be used to update tramp-remote-path.

(add-to-list 'tramp-remote-path 'tramp-own-remote-path)

Note that this works only if your remote /bin/sh shell supports the login argument ‘-l’.

tramp-remote-path can also be set per host via connection-local variables. You could define your own search directories like this:

(connection-local-set-profile-variables 'remote-path-with-bin
   '((tramp-remote-path . ("~/bin" tramp-default-remote-path))))

(connection-local-set-profile-variables 'remote-path-with-apply-pub-bin
   '((tramp-remote-path . ("/appli/pub/bin" tramp-default-remote-path))))

(connection-local-set-profiles
   '(:application tramp :machine "randomhost") 'remote-path-with-bin)

(connection-local-set-profiles
   '(:application tramp :user "anotheruser" :machine "anotherhost")
     'remote-path-with-apply-pub-bin)

When remote search paths are changed, local TRAMP caches must be recomputed. To force TRAMP to recompute afresh, call M-x tramp-cleanup-this-connection RET or friends (see Cleanup remote connections).

4.17 Remote shell setup hints

• Changing the default remote or local shell
• Other remote shell setup hints

(add-to-list 'tramp-connection-properties
             (list (regexp-quote "/sshx:user@host:")
                   "remote-shell" "/usr/bin/zsh"))

(customize-set-variable 'tramp-encoding-shell "/usr/bin/zsh")

4.18 Ssh setup hints

The most common TRAMP connection family is based on either ssh or scp of OpenSSH, or plink or pscp of PuTTY on MS Windows. In the following, some configuration recommendations are given.

• Using ssh config include for host name completion
• Detection of session hangouts
• Using ssh connection sharing
• Configure direct copying between two remote servers
• Issues with Cygwin and MS Windows ssh

Include ~/.ssh/conf.d/*

(tramp-set-completion-function
 "ssh" (append (tramp-get-completion-function "ssh")
               (mapcar (lambda (file) `(tramp-parse-sconfig ,file))
                       (directory-files
                        "~/.ssh/conf.d/"
                        'full directory-files-no-dot-files-regexp))))

Host *
     ServerAliveInterval 5
     ServerAliveCountMax 2

(customize-set-variable
 'tramp-ssh-controlmaster-options
 (concat
   "-o ControlPath=/tmp/ssh-ControlPath-%%r@%%h:%%p "
   "-o ControlMaster=auto -o ControlPersist=yes"))

(customize-set-variable 'tramp-use-ssh-controlmaster-options nil)

Host *
     ControlMaster      auto
     ControlPath        tramp.%C
     ControlPersist     no

scp -p -T -R -q -r source:/path/to/file target:/path/to/another/file

Pseudo-terminal will not be allocated because stdin is not a terminal.

4.19 FUSE setup hints

The FUSE file systems are mounted by default at /tmp/tramp.method.user@host#port. The user name and port number are optional. If the file system is already mounted, it will be used as it is. If the mount point does not exist yet, TRAMP creates this directory.

The mount point can be overwritten by the connection property "mount-point", Setting own connection related information. Example:

(add-to-list 'tramp-connection-properties
             `(,(regexp-quote "/sshfs:user@host:")
               "mount-point"
               ,(expand-file-name "sshfs.user@host" user-emacs-directory)))

The user option tramp-fuse-unmount-on-cleanup, when set to non-nil, controls, whether a mount point is unmounted on connection cleanup or on Emacs exiting.

• rclone setup
• sshfs setup

4.20 Android shell setup hints

TRAMP uses the adb method to access Android devices. Android devices provide a restricted shell access through an USB connection. The local host must have the adb program installed. Usually, it is sufficient to open the file /adb::/. Then you can navigate in the file system via dired.

Alternatively, applications such as Termux or SSHDroid that run sshd process on the Android device can accept any ssh-based methods provided these settings are adjusted:

• sh must be specified for remote shell since Android devices do not provide /bin/sh. sh will then invoke whatever shell is installed on the device with this setting:

  (add-to-list 'tramp-connection-properties
               (list (regexp-quote "192.168.0.26") "remote-shell" "sh"))
  

  where ‘192.168.0.26’ is the Android device’s IP address. (see Setting own connection related information).

• On the Android device the directory names are prefixed with an application specific prefix, which is /data/data/com.termux/files/usr/bin instead of /usr/bin in the Termux case. You must adapt the file names in tramp-remote-path, for example via connection-local settings:

  (connection-local-set-profile-variables
   'tramp-connection-local-termux-profile
   `((tramp-remote-path
      . ,(mapcar
  	(lambda (x)
  	  (if (stringp x) (concat "/data/data/com.termux/files" x) x))
  	(copy-tree tramp-remote-path)))))
  
  (connection-local-set-profiles
   '(:application tramp :machine "192.168.0.26")
   'tramp-connection-local-termux-profile)
  

• When the Android device is not ‘rooted’, specify a writable directory for temporary files:

  (add-to-list 'tramp-connection-properties
               (list (regexp-quote "192.168.0.26")
  		   "tmpdir" "/data/data/com.termux/files/home/tmp"))
  

• Open a remote connection with the command C-x C-f /ssh:192.168.0.26#2222: RET, where sshd is listening on port ‘2222’.

  To add a corresponding entry to the ~/.ssh/config file (recommended), use this:

  Host android
       HostName 192.168.0.26
       User root
       Port 2222
  

  To use the host name ‘android’ instead of the IP address shown in the previous example, fix the connection properties as follows:

  (add-to-list 'tramp-connection-properties
               (list (regexp-quote "android") "remote-shell" "sh"))
  (add-to-list 'tramp-connection-properties
               (list (regexp-quote "android")
  		   "tmpdir" "/data/data/com.termux/files/home/tmp"))
  (connection-local-set-profiles
   '(:application tramp :machine "android")
   'tramp-connection-local-termux-profile)
  

  Open a remote connection with the more concise command C-x C-f /ssh:android: RET.

4.21 Auto-save, File Lock and Backup configuration

To avoid TRAMP from saving backup files owned by ‘root’ to locations accessible to others, default backup settings in backup-directory-alist have to be altered.

Here’s a scenario where files could be inadvertently exposed. Emacs by default writes backup files to the same directory as the original files unless changed to another location, such as ~/.emacs.d/backups/. Such a directory will also be used by default by TRAMP when using, say, a restricted file /su:root@localhost:/etc/secretfile. The backup file of the secretfile is now owned by the user logged in from TRAMP and not ‘root’.

When backup-directory-alist is nil (the default), such problems do not occur.

To “turn off” the backup feature for remote files and stop TRAMP from saving to the backup directory, use this:

(add-to-list 'backup-directory-alist
             (cons tramp-file-name-regexp nil))

Disabling backups can be targeted to just the su and sudo methods:

(setq backup-enable-predicate
      (lambda (name)
        (and (normal-backup-enable-predicate name)
             (not
              (let ((method (file-remote-p name 'method)))
                (when (stringp method)
                  (member method '("su" "sudo"))))))))

Another option is to create better backup file naming with user and host names prefixed to the file name. For example, transforming /etc/secretfile to ~/.emacs.d/backups/!su:root@localhost:!etc!secretfile, set the TRAMP user option tramp-backup-directory-alist from the existing user option backup-directory-alist.

Then TRAMP backs up to a file name that is transformed with a prefix consisting of the DIRECTORY name. This file name prefixing happens only when the DIRECTORY is an absolute local file name.

Example:

(add-to-list 'backup-directory-alist
             (cons "." "~/.emacs.d/backups/"))
(customize-set-variable
 'tramp-backup-directory-alist backup-directory-alist)

The backup file name of /su:root@localhost:/etc/secretfile would be /su:root@localhost:~/.emacs.d/backups/!su:root@localhost:!etc!secretfile~.

Just as for backup files, similar issues of file naming affect auto-saving remote files. Auto-saved files are saved in the directory specified by the user option auto-save-file-name-transforms. By default this is set to the local temporary directory. But in some versions of Debian GNU/Linux, this points to the source directory where the Emacs was compiled. Reset such values to a valid directory.

Set auto-save-file-name-transforms to nil to save auto-saved files to the same directory as the original file.

Alternatively, set the user option tramp-auto-save-directory to direct all auto saves to that location.

An alternative to auto-save-mode is auto-save-visited-mode. In this mode, auto-saving is identical to explicit saving. If you want to disable this behavior for remote files, set user option remote-file-name-inhibit-auto-save-visited to non-nil.

And still more issues to handle. Since Emacs 28, file locks use a similar user option as auto-save files, called lock-file-name-transforms. By default this user option is nil, meaning to keep file locks in the same directory as the original file.

If you change lock-file-name-transforms in order to keep file locks for remote files somewhere else, you will lose Emacs’s feature to warn you, if a file is changed in parallel from different Emacs sessions, or via different remote connections. Be careful with such settings.

Setting remote-file-name-inhibit-locks to non-nil prevents the creation of remote lock files at all.

Per default, TRAMP asks for confirmation if a ‘root’-owned remote backup, auto-save or lock file has to be written to your local temporary directory. If you want to suppress this confirmation question, set user option tramp-allow-unsafe-temporary-files to t.

4.22 Protect remote files by encryption

Note: File encryption in TRAMP is experimental, don’t use it in production systems!

Sometimes, it is desirable to protect files located on remote directories, like cloud storages. In order to do this, you might instruct TRAMP to encrypt all files copied to a given remote directory, and to decrypt such files when accessing. This includes both file contents and file names.

TRAMP does this transparently. Although both files and file names are encrypted on the remote side, they are accessible inside Emacs as they wouldn’t be transformed as such.

Internally, TRAMP uses the encfs package. Therefore, this feature is available only if this package is installed on the local host. TRAMP does not keep and ‘encfs mountpoint’ permanently. Instead, it encrypts / decrypts files and file names on the fly, using encfsctl.

Command: tramp-crypt-add-directory name ¶

This command marks the existing remote directory name for encryption. Files in that directory and all subdirectories will be encrypted before copying to, and decrypted after copying from that directory. File and directory names will be also encrypted.

User Option: tramp-crypt-encfs-option ¶

If a remote directory is marked for encryption, it is initialized via encfs the very first time a file in this directory is accessed. This user option controls, which default encfs configuration option will be selected, it can be "--standard" or "--paranoia". See the ‘encfs(1)’ man page for details.

However, TRAMP must adapt these configuration sets. The chainedNameIV configuration option must be disabled; otherwise TRAMP couldn’t handle file name encryption transparently.

A password protected encfs configuration file is created the very first time you access an encrypted remote directory. It is kept in your user-emacs-directory with the url-encoded directory name as part of the basename, and encfs6.xml as suffix. If you, for example, mark the remote directory /nextcloud:user@host:/path/to/dir for encryption, the configuration file is saved as tramp-%2Fnextcloud%3Auser%40host%3A%2Fpath%2Fto%2Fdir%2F.encfs6.xml in user-emacs-directory. Do not lose this file and the corresponding password; otherwise there is no way to decrypt your encrypted files.

User Option: tramp-crypt-save-encfs-config-remote ¶

If this user option is non-nil (the default), the encfs configuration file .encfs6.xml is also kept in the encrypted remote directory. It depends on you, whether you regard the password protection of this file as sufficient. The advantage would be, that such a remote directory could be accessed by different Emacs sessions, different users, without presharing the configuration file between the users.

The command encfsctl, the workhorse for encryption / decryption, needs the configuration file password every call. Therefore, it is recommend to cache this password in Emacs. This can be done using auth-sources, Using an authentication file. An entry needs the url-encoded directory name as machine, your local user name as user, and the password. The port is optional, if given it must be the string "crypt". The example above would require the following entry in the authentication file ("yourname" is the result of (user-login-name)):

machine %2Fnextcloud%3Auser%40host%3A%2Fpath%2Fto%2Fdir%2F \
        login yourname port crypt password geheim

If you use a remote file name with a quoted localname part, this localname and the corresponding file will not be encrypted / decrypted. If you have an encrypted remote directory /nextcloud:user@host:/path/to/dir, the command

C-x d /nextcloud:user@host:/path/to/dir

will show the directory listing with the plain file names, and the command

C-x d /nextcloud:user@host:/:/path/to/dir

will show the directory listing with the encrypted file names, and visiting a file will show its encrypted contents. However, it is highly discouraged to mix encrypted and not encrypted files in the same directory.

Command: tramp-crypt-remove-directory name ¶

This command should be used to indicate that files in name should no longer be encrypted. Existing encrypted files and subdirectories will remain encrypted.

5.1 TRAMP file name conventions

/method:host:/path/to/file opens file /path/to/file on the remote host host, using the method method.

/ssh:melancholia:.emacs

For the file .emacs located in the home directory, on the host melancholia, using method ssh.

/ssh:melancholia.danann.net:.emacs

For the file .emacs specified using the fully qualified domain name of the host.

/ssh:melancholia:~/.emacs

For the file .emacs specified using the ~, which is expanded.

/ssh:melancholia:~daniel/.emacs

For the file .emacs located in daniel’s home directory on the host, melancholia. The ~<user> construct is expanded to the home directory of that user on the remote host.

/ssh:melancholia:/etc/squid.conf

For the file /etc/squid.conf on the host melancholia.

host can take IPv4 or IPv6 address, as in /ssh:127.0.0.1:.emacs or /ssh:[::1]:.emacs. For syntactical reasons, IPv6 addresses must be embedded in square brackets [ and ].

By default, TRAMP will use the current local user name as the remote user name for log in to the remote host. Specifying a different name using the proper syntax will override this default behavior: /method:user@host:path/to/file.

/ssh:daniel@melancholia:.emacs is for file .emacs in daniel’s home directory on the host, melancholia, accessing via method ssh.

For specifying port numbers, affix #<port> to the host name. For example: /ssh:daniel@melancholia#42:.emacs.

All method, user name, host name, port number and local name parts are optional, See Selecting a default method, See Selecting a default user, See Selecting a default host. For syntactical reasons, the default method must be indicated by the pseudo method -.

5.2 Alternative file name syntax

The syntax described in TRAMP file name conventions is the default syntax, which is active after Emacs startup. However, this can be changed.

Command: tramp-change-syntax syntax ¶

This command changes the syntax TRAMP uses for remote file names. Beside the default value, syntax can be

• simplified

  This remote file name syntax is similar to the syntax used by Ange FTP. A remote file name has the form /user@host:path/to/file. The user@ part is optional, and the method is determined by Selecting a default method.

• separate

  This remote file name syntax originated in the XEmacs text editor. A remote file name has the form /[method/user@host]path/to/file. The method and user@ parts are optional.

Variable: tramp-file-name-regexp ¶

This variable keeps a regexp which matches the selected remote file name syntax. Its value changes after every call of tramp-change-syntax. However, it is not recommended to use this variable in external packages, a call of file-remote-p is much more appropriate.

5.3 File name completion

TRAMP can complete the following TRAMP file name components: method names, user names, host names, and file names located on remote hosts.

For example, type C-x C-f / s TAB, TRAMP completion choices show up as

sbin/

scp:

scpx:

sftp:

sg:

smb:

srv/

ssh:

sshx:

su:

sudo:

sys/

‘ssh:’ is a possible completion for the respective method, and ‘sbin/’ stands for the directory /sbin on your local host.

Type s h : for the minibuffer completion to ‘/ssh:’. Typing TAB shows host names TRAMP extracts from ~/.ssh/config file, for example:

ssh:127.0.0.1:

ssh:192.168.0.1:

ssh:[::1]:

ssh:localhost:

ssh:melancholia.danann.net:

ssh:melancholia:

Choose a host from the above list and then continue to complete file names on that host.

When the configuration (see Selecting config files for user/host name completion) includes user names, then the completion lists will account for the user names as well.

Results from auth-sources search (see Using an authentication file) are added to the completion candidates. This search could be annoying, for example due to a passphrase request of the ~/.authinfo.gpg authentication file. The user option tramp-completion-use-auth-sources controls, whether such a search is performed during completion.

Remote hosts previously visited or hosts whose connections are kept persistently (see Reusing connection related information) will be included in the completion lists. If you want to suppress this completion because there are invalid entries in the persistency file, for example if the host configuration changes often, or if you plug your laptop to different networks frequently, you can set the user option tramp-completion-use-cache to nil.

After remote host name completion comes completion of file names on the remote host. It works the same as with local host file completion except that killing with double-slash // kills only the file name part of the TRAMP file name syntax. A triple-slash stands for the default behavior.

Example:

C-x C-f /ssh:melancholia:/usr/local/bin//etc TAB
     -| /ssh:melancholia:/etc

C-x C-f /ssh:melancholia://etc TAB
     -| /ssh:melancholia:/etc

C-x C-f /ssh:melancholia:/usr/local/bin///etc TAB
     -| /etc

5.4 Declaring multiple hops in the file name

TRAMP file name syntax can accommodate ad-hoc specification of multiple proxies without using tramp-default-proxies-alist configuration setup (see Connecting to a remote host using multiple hops).

Each proxy is specified using the same syntax as the remote host specification minus the file name part. Each hop is separated by a ‘|’. Chain the proxies from the starting host to the destination remote host name and file name. For example, hopping over a single proxy ‘bird@bastion’ to a remote file on ‘you@remotehost’:

C-x C-f /ssh:bird@bastion|ssh:you@remotehost:/path RET

Each involved method must be an inline method (see Inline methods).

TRAMP adds the ad-hoc definitions on the fly to tramp-default-proxies-alist and is available for reuse during that Emacs session. Subsequent TRAMP connections to the same remote host can then use the shortcut form: ‘/ssh:you@remotehost:/path’.

User Option: tramp-show-ad-hoc-proxies ¶

If this user option is non-nil, ad-hoc definitions are kept in remote file names instead of showing the shortcuts.

(customize-set-variable 'tramp-show-ad-hoc-proxies t)

Ad-hoc definitions are removed from tramp-default-proxies-alist via the command M-x tramp-cleanup-all-connections RET (see Cleanup remote connections).

User Option: tramp-save-ad-hoc-proxies ¶

For ad-hoc definitions to be saved automatically in tramp-default-proxies-alist for future Emacs sessions, set tramp-save-ad-hoc-proxies to non-nil.

(customize-set-variable 'tramp-save-ad-hoc-proxies t)

Ad-hoc proxies can take patterns %h or %u like in tramp-default-proxies-alist. The following file name expands to user ‘root’ on host ‘remotehost’, starting with an ssh session on host ‘remotehost’: ‘/ssh:%h|su:remotehost:’.

On the other hand, if a trailing hop does not specify a host name, the host name of the previous hop is reused. Therefore, the following file name is equivalent to the previous example: ‘/ssh:remotehost|su::’.

5.5 Expanding ~ to home directory

Home directories on remote hosts can be typed as tilde ~. If possible, they are expanded to the remote user’s home directory on the remote host. Example:

/ssh:user@host:~
⇒ /ssh:user@host:/home/user

This works in general for ssh-like methods, and for sudoedit. These methods allow also the home directory expansion for another user, like

/sudoedit::~otheruser
⇒ /sudoedit:root@localhost:/home/otheruser

For other methods, a home directory can be expanded only if supported. This happens for example for the sftp method. Methods, which require a share directory in the remote file name (afp, smb), use the value of this share directory as home directory:

/smb:user@host:~
⇒ /smb:user@host:/share

Since TRAMP cannot know in advance which share directory is intended to use, this expansion can be applied only when a share directory has been used already.

The methods adb, rclone and sshfs do not support home directory expansion at all. However, TRAMP keeps the home directory in the cache. Therefore, those methods could be configured to expand a home directory via a connection property, See Setting own connection related information. Example:

(add-to-list 'tramp-connection-properties
             (list (regexp-quote "/sshfs:user@randomhost.your.domain:")
                   "~user" "/home/user"))

When your remote file name does not contain a ‘user’ part, the connection property "~" must be used instead.

5.6 Integration with other Emacs packages

TRAMP supports starting new running processes on the remote host for discovering remote file names. Emacs packages on the remote host need no specific modifications for TRAMP’s use.

This type of integration does not work with the ftp method, and does not support the pty association as specified in start-file-process.

process-file and start-file-process work on the remote host when the variable default-directory is remote:

(let ((default-directory "/ssh:remote.host:"))
  (start-file-process "grep" (get-buffer-create "*grep*")
                      "/bin/sh" "-c" "grep -e tramp *"))

For a local process, process-file returns either the exit code of the process, or a string describing a signal, when the process has been interrupted. Since it cannot be determined reliably whether a remote process has been interrupted, process-file will always returns the exit code for it. When the user option process-file-return-signal-string is non-nil, process-file treats all exit codes greater than 128 as an indication that the process has been interrupted, and returns a corresponding string.

This remote process handling does not apply to GVFS (see GVFS-based external methods) because the remote file system is mounted on the local host and TRAMP accesses it by changing the default-directory.

TRAMP starts a remote process when a command is executed in a remote file or directory buffer. As of now, these packages have been integrated to work with TRAMP: shell.el, eshell.el, compile.el (commands like compile and grep) and gud.el (gdb or perldb).

TRAMP always modifies the INSIDE_EMACS environment variable for remote processes. By default, this environment variable shows the Emacs version. TRAMP adds its own version string, so it looks like ‘27.2,tramp:2.4.5.1’. However, other packages might also add their name to this environment variable, like ‘27.2,comint,tramp:2.4.5.1’.

For TRAMP to find the command on the remote, it must be accessible through the default search path as setup by TRAMP upon first connection. Alternatively, use an absolute path or extend tramp-remote-path (see How TRAMP finds and uses programs on the remote host):

(add-to-list 'tramp-remote-path "~/bin")
(add-to-list 'tramp-remote-path "/appli/pub/bin")

Customize user option tramp-remote-process-environment to suit the remote program’s environment for the remote host. tramp-remote-process-environment is a list of strings structured similar to process-environment, where each element is a string of the form ‘ENVVARNAME=VALUE’.

To avoid any conflicts with local host environment variables set through local configuration files, such as ~/.profile, use ‘ENVVARNAME=’ to unset them for the remote environment.

Use add-to-list to add entries:

(add-to-list 'tramp-remote-process-environment "JAVA_HOME=/opt/java")

Modifying or deleting already existing values in the tramp-remote-process-environment list may not be feasible on restricted remote hosts. For example, some system administrators disallow changing HISTORY environment variable. To accommodate such restrictions when using TRAMP, fix the tramp-remote-process-environment by the following code in the local .emacs file:

(let ((process-environment tramp-remote-process-environment))
  (setenv "HISTORY" nil)
  (setq tramp-remote-process-environment process-environment))

Setting the ENV environment variable instructs some shells to read an initialization file. By default, TRAMP disables this. You can override this behavior by evaluating

(let ((process-environment tramp-remote-process-environment))
  (setenv "ENV" "$HOME/.profile")
  (setq tramp-remote-process-environment process-environment))

In addition to tramp-remote-process-environment, you can set environment variables for individual remote process calls by let-binding process-environment. TRAMP applies any entries not present in the global default value of process-environment (overriding tramp-remote-process-environment settings, if they conflict). For example:

(let ((process-environment (cons "HGPLAIN=1" process-environment)))
  (process-file …))

Let-binding in this way works regardless of whether the process to be called is local or remote, since TRAMP would add just the HGPLAIN setting and local processes would take whole value of process-environment along with the new value of HGPLAIN.

For integrating other Emacs packages so TRAMP can execute remotely, please file a bug report. See Reporting Bugs and Problems.

• Running remote programs that create local X11 windows
• Running shell on a remote host
• Running shell-command on a remote host
• Running eshell on a remote host
• Running a debugger on a remote host
• Running remote processes on MS Windows hosts
• Remote process connection type
• Process properties of asynchronous remote processes
• Improving performance of asynchronous remote processes

(add-to-list 'tramp-remote-process-environment
             (format "DISPLAY=%s" (getenv "DISPLAY")))

(connection-local-set-profile-variables
  'remote-bash
  '((explicit-shell-file-name . "/bin/bash")
    (explicit-bash-args . ("-i"))))

(connection-local-set-profile-variables
  'remote-ksh
  '((explicit-shell-file-name . "/bin/ksh")
    (explicit-ksh-args . ("-i"))))

(connection-local-set-profiles
  '(:application tramp :protocol "ssh" :machine "localhost")
  'remote-bash)

(connection-local-set-profiles
  `(:application tramp :protocol "sudo"
    :user "root" :machine ,(system-name))
  'remote-ksh)

C-x C-f /sudo:: RET
M-& tail -f /var/log/syslog.log RET

~ $ cd /sudo::/etc RET
/sudo:root@host:/etc $ hostname RET
host
/sudo:root@host:/etc $ id RET
uid=0(root) gid=0(root) groups=0(root)
/sudo:root@host:/etc $ find-file shadow RET
#<buffer shadow>
/sudo:root@host:/etc $

~ $ cd /ssh:user@remotehost:/etc RET
/ssh:user@remotehost:/etc $ find-file shadow RET
File is not readable: /ssh:user@remotehost:/etc/shadow
/ssh:user@remotehost:/etc $ sudo find-file shadow RET
#<buffer shadow>

/ssh:user@remotehost:/etc $ su - RET
/su:root@remotehost:/root $ id RET
uid=0(root) gid=0(root) groups=0(root)
/su:root@remotehost:/root $

M-x gdb RET
Run gdb (like this): gdb -i=mi /ssh:host:~/myprog RET

&"warning: GDB: Failed to set controlling terminal: Operation not permitted\n"

M-x perldb RET
Run perldb (like this): perl -d myprog.pl RET

(setq explicit-shell-file-name "cmd"
      explicit-cmd-args '("/q"))

(setq explicit-shell-file-name "powershell"
      explicit-powershell-args '("-file" "-"))

    PID  EUID EUSER     EGID EGROUP   COMMAND                                  S
      1     0 root         0 root     systemd                                  S
   1610     0 root         0 root     NFSv4 callback                           S
   …

((pid . numberp) (euid . numberp) (user . stringp)
 (egid . numberp) (group . stringp) (comm . 40) (state . stringp))

(connection-local-set-profiles
 '(:application tramp :machine "mybsdhost")
 'tramp-connection-local-bsd-ps-profile)

(add-to-list 'tramp-connection-properties
             (list (regexp-quote "/ssh:user@host:")
                   "direct-async-process" t))

5.7 Cleanup remote connections

TRAMP provides several ways to flush remote connections.

Command: tramp-cleanup-connection vec &optional keep-debug keep-password ¶

This command flushes all connection related objects. vec is the internal representation of a remote connection. When called interactively, this command lists active remote connections in the minibuffer. Each connection is of the format /method:user@host:.

Flushing remote connections also cleans the password cache (see Reusing passwords for several connections), file cache, connection cache (see Reusing connection related information), and recentf cache. It also deletes session timers (see Setting own connection related information) and connection buffers.

If keep-debug is non-nil, the debug buffer is kept. A non-nil keep-password preserves the password cache.

Command: tramp-cleanup-this-connection ¶

Flushes the current buffer’s remote connection objects, the same as in tramp-cleanup-connection.

Command: tramp-cleanup-all-connections ¶

Flushes all active remote connection objects, the same as in tramp-cleanup-connection. This command removes also ad-hoc proxy definitions (see Declaring multiple hops in the file name).

Command: tramp-cleanup-all-buffers ¶

Just as for tramp-cleanup-all-connections, all remote connections and ad-hoc proxy definition are cleaned up in addition to killing all buffers related to remote connections.

5.8 Renaming remote files

Sometimes, it is desirable to safe file contents of buffers visiting a given remote host. This could happen for example, if the local host changes its network integration, and the remote host is not reachable anymore.

Command: tramp-rename-files source target ¶

Replace in all buffers the visiting file name from source to target. source is a remote directory name, which could contain also a localname part. target is the directory name source is replaced with. Often, target is a remote directory name on another host, but it can also be a local directory name. If target has no local part, the local part from source is used.

If target is nil, it is selected according to the first match in tramp-default-rename-alist. If called interactively, this match is offered as initial value for selection.

On all buffers, which have a buffer-file-name matching source, this name is modified by replacing source with target. This is applied by calling set-visited-file-name. The new buffer-file-name is prompted for modification in the minibuffer. The buffers are marked modified, and must be saved explicitly.

If user option tramp-confirm-rename-file-names is nil, changing the file name happens without confirmation. This requires a matching entry in tramp-default-rename-alist.

Remote buffers related to the remote connection identified by source, which are not visiting files, or which are visiting files not matching source, are not modified.

Interactively, target is selected from tramp-default-rename-alist without confirmation if the prefix argument is non-nil.

The remote connection identified by source is flushed by tramp-cleanup-connection.

Command: tramp-rename-these-files target ¶

Replace visiting file names to target. The current buffer must be related to a remote connection. In all buffers, which are visiting a file with the same directory name, the buffer file name is changed.

Interactively, target is selected from tramp-default-rename-alist without confirmation if the prefix argument is non-nil.

User Option: tramp-default-rename-alist ¶

The default target for renaming remote buffer file names. This is an alist of cons cells (source . target). The first matching item specifies the target to be applied for renaming buffer file names from source via tramp-rename-files. source is a regular expressions, which matches a remote file name. target must be a directory name, which could be remote (including remote directories TRAMP infers by default, such as ‘/method:user@host:’).

target can contain the patterns %m, %u or %h, which are replaced by the method name, user name or host name of source when calling tramp-rename-files.

source could also be a Lisp form, which will be evaluated. The result must be a string or nil, which is interpreted as a regular expression which always matches.

Example entries:

("/ssh:badhost:/path/to/dir/"
 . "/ssh:goodhost:/path/to/another/dir/")

would trigger renaming of buffer file names on ‘badhost’ to ‘goodhost’, including changing the directory name.

("/ssh:.+\\.company\\.org:" . "/ssh:multi.hop|ssh:%h:")

routes all connections to a host in ‘company.org’ via ‘/ssh:multi.hop:’, which might be useful when using Emacs outside the company network.

(nil . "~/saved-files/%m:%u@%h/")

saves all remote files locally, with a directory name including method name, user name and host name of the remote connection.

User Option: tramp-confirm-rename-file-names ¶

Whether renaming a buffer file name by tramp-rename-files or tramp-rename-these-files must be confirmed.

5.9 Archive file names

TRAMP offers also transparent access to files inside file archives. This is possible only on hosts which have installed GVFS (the GNOME Virtual File System), GVFS-based external methods. Internally, file archives are mounted via the GVFS archive method.

A file archive is a regular file of kind /path/to/dir/file.EXT. The extension ‘.EXT’ identifies the type of the file archive. To examine the contents of an archive with Dired, open file name as if it were a directory (i.e., open /path/to/dir/file.EXT/). A file inside a file archive, called archive file name, has the name /path/to/dir/file.EXT/dir/file.

Most of the (elisp)magic file name operations, are implemented for archive file names, exceptions are all operations which write into a file archive, and process related operations. Therefore, functions like

(copy-file "/path/to/dir/file.tar/dir/file" "/somewhere/else")

work out of the box. This is also true for file name completion, and for libraries like dired or ediff, which accept archive file names as well.

File archives are identified by the file name extension ‘.EXT’. Since GVFS uses internally the library libarchive(3), all suffixes, which are accepted by this library, work also for archive file names. Accepted suffixes are listed in the constant tramp-archive-suffixes. They are

• ‘.7z’ — 7-Zip archives
• ‘.apk’ — Android package kits
• ‘.ar’ — UNIX archiver formats
• ‘.cab’, ‘.CAB’ — Microsoft Windows cabinets
• ‘.cpio’ — CPIO archives
• ‘.crate’ — Cargo (Rust) packages
• ‘.deb’ — Debian packages
• ‘.depot’ — HP-UX SD depots
• ‘.epub’ — Electronic publications
• ‘.exe’ — Self extracting Microsoft Windows EXE files
• ‘.iso’ — ISO 9660 images
• ‘.jar’ — Java archives
• ‘.lzh’, ‘.LZH’ — Microsoft Windows compressed LHA archives
• ‘.msu’, ‘.MSU’ — Microsoft Windows Update packages
• ‘.mtree’ — BSD mtree format
• ‘.odb’, ‘.odf’, ‘.odg’, ‘.odp’, ‘.ods’, ‘.odt’ — OpenDocument formats
• ‘.pax’ — Posix archives
• ‘.rar’ — RAR archives
• ‘.rpm’ — Red Hat packages
• ‘.shar’ — Shell archives
• ‘.tar’, ‘.tbz’, ‘.tgz’, ‘.tlz’, ‘.txz’, ‘.tzst’ — (Compressed) tape archives
• ‘.warc’ — Web archives
• ‘.xar’ — macOS XAR archives
• ‘.xpi’ — XPInstall Mozilla addons
• ‘.xps’ — Open XML Paper Specification (OpenXPS) documents
• ‘.zip’, ‘.ZIP’ — ZIP archives

File archives could also be compressed, identified by an additional compression suffix. Valid compression suffixes are listed in the constant tramp-archive-compression-suffixes. They are ‘.bz2’, ‘.gz’, ‘.lrz’, ‘.lz’, ‘.lz4’, ‘.lzma’, ‘.lzo’, ‘.uu’, ‘.xz’, ‘.Z’, and ‘.zst’. A valid archive file name would be /path/to/dir/file.tar.gz/dir/file. Even several suffixes in a row are possible, like /path/to/dir/file.tar.gz.uu/dir/file.

An archive file name could be a remote file name, as in /ftp:anonymous@ftp.gnu.org:/gnu/tramp/tramp-2.4.5.tar.gz/INSTALL. Since all file operations are mapped internally to GVFS operations, remote file names supported by tramp-gvfs perform better, because no local copy of the file archive must be downloaded first. For example, ‘/sftp:user@host:...’ performs better than the similar ‘/scp:user@host:...’. See the constant tramp-archive-all-gvfs-methods for a complete list of tramp-gvfs supported method names.

If url-handler-mode is enabled, archives could be visited via URLs, like https://ftp.gnu.org/gnu/tramp/tramp-2.4.5.tar.gz/INSTALL. This allows complex file operations like

(progn
  (url-handler-mode 1)
  (ediff-directories
   "https://ftp.gnu.org/gnu/tramp/tramp-2.4.4.tar.gz/tramp-2.4.4"
   "https://ftp.gnu.org/gnu/tramp/tramp-2.4.5.tar.gz/tramp-2.4.5" ""))

It is even possible to access file archives in file archives, as

(progn
  (url-handler-mode 1)
  (find-file
   "https://ftp.debian.org/debian/pool/main/c/coreutils/\
coreutils_8.28-1_amd64.deb/control.tar.gz/control"))

In order to disable file archives, you could add the following form to your init file:

(customize-set-variable 'tramp-archive-enabled nil)

8.1 Splitting a localname into its component parts

TRAMP package redefines lisp functions file-name-directory and file-name-nondirectory to accommodate the unique file naming syntax that TRAMP requires.

The replacements dissect the file name, use the original handler for the localname, take that result, and then re-build the TRAMP file name. By relying on the original handlers for localnames, TRAMP benefits from platform specific hacks to the original handlers.

8.2 Integrating with external Lisp packages

In general, it is not recommended to use TRAMP functions and variables not described in this manual. They might change their signature and/or semantics without any announcement.

• File name completion
• File attributes cache
• Timers

(let ((non-essential t))
  …)

(let (process-file-side-effects)
  …)

(unless (memq (process-status proc) '(run open))
  (dired-uncache remote-directory))

(ignore-error 'remote-file-error
  …)