The University of Otago has a fairly anally-retentive firewall configuration. SSH in or out is strictly verboten. However, mail servers do allow incoming SSH connections, and once in, it’s easy to SSH into my machines in my office. The problem comes, however, with trying to use SCP. The mail server won’t let me copy files to outside the otago.ac.nz domain, and I can’t SSH into my machines directly.

After much hunting, I have found the solution. This will work for any two-hop SCP.

scp -Cp -o "ProxyCommand ssh gatewayuser@gateway nc remotehost 22" remoteuser@remotehost:/path/to/file/on/remote /path/to/file/on/local

Here, I use the term ‘gateway’ for the mail server, and ‘remotehost’ for the machine in my office.

Problem solved.