Well, obviously you need SSH access to do this.  You also need your IOS device to be set up as an SCP server.  If you aren’t set that way, you’ll get this:

scp ~/Downloads/c2960x-universalk9-mz.152-2.E5.bin sysadmin1@192.0.2.1:flash2:/
Password:
Administratively disabled.

To fix that, get into config mode and run:

ip scp server enable

Save, try again:

scp ~/Downloads/c2960x-universalk9-mz.152-2.E5.bin sysadmin1@192.0.2.1:flash2:/
Password:
Privilege denied.

Okay, now the reason you’re receiving this is because you need privilege level 15 to do remote file copy, and if you’ve got your switch set up the ‘old fashioned’ way, it won’t work.  By ‘old fashioned’, I mean the classic way people have been configuring Cisco IOS for decades, where you’ve got a user you ssh (or console, or formerly telnet) in as, and then you ‘enable’ with a separate enable password to get config access.  You need to SSH in as a user with privilege 15.

Let’s set that up, and for the hell of it, let’s switch to modern key-based authentication.  I’m also going to lock things down to ONLY ssh access for network access.  A word of warning, don’t proceed with these if you use any type of remote authentication like TACACS+, RADIUS, etc. as it may break.  Also don’t use this if you use telnet; it will break.

Let’s add this config:

line con 0
exec-timeout 30 0
logging synchronous
line vty 0 4
exec-timeout 30 0
logging synchronous
transport input ssh
line vty 5 15
exec-timeout 30 0
logging synchronous
transport input ssh
!
aaa new-model
aaa authorization exec default local if-authenticated
ip ssh version 2
ip ssh pubkey-chain
username admin1
key-string

The “aaa authorization exec default local if-authenticated” is to give your locally authenticated user exec privilege (i.e. level 15).  Now it’s at this point where you would normally enter your entire SSH public key, including the leading ssh-rsa.  However, you can’t do that, because Cisco’s interface sucks.  If you try to paste it in, you’ll get this:

%SSH: Failed to decode the Key Value

It will only take <250 characters, so any modern ssh key won’t fit.  You have to enter it as multiple lines.  If you’re on a unix system or a Mac, from a command prompt, use the handy ‘fold’ command to spit out your ssh key in happy chunks.  Here’s how to spit out no more than 100 characters per line, for example:

# fold -w 100 ~/.ssh/testkey.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFl7glLz+aBi5fWruLFY2LJXEufRCZe23Mj5DDYgUNFDXaSARBPOmuzInKwlQB
NGsst90ozWMfyA891ciAKrcuv04k7y0I4M+QU0MD1X0Fu8PC4Dduh6/sDWCsmo3GAuYSEIwyHvGf1I950amuCVqmks+ZdWHFehrw
EXH5UOxDGZ0N8CiZs5LRUG4XXpZ/bX6Z3MBmhKy8GAR3zhHj9PomGOf9Exrf4Uxp4b730AI6axSQ+cXPgz2nVQiDnaehhUzb/gOp
tCX521lbAqBq/y7Di9iuQspV/xf6oBVacXGUzwbOPwmjF2s3w+R8Iv47rjOOt4U8BuL4T6cS5rZJ3KfZ

Now you can just paste that into the IOS prompt and follow it up by “exit” on a line by itself to let IOS know you’re done entering the key:

swh-1(config)#ip ssh pubkey-chain
swh-1(conf-ssh-pubkey)#username sysadmin1
swh-1(conf-ssh-pubkey-user)#key-string
swh-1(conf-ssh-pubkey-data)#ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFl7glLz+aBi5fWruLFY2LJXEufRCZe23Mj5DDYgUNFDXaSARBPOmuzInKwlQB
swh-1(conf-ssh-pubkey-data)#NGsst90ozWMfyA891ciAKrcuv04k7y0I4M+QU0MD1X0Fu8PC4Dduh6/sDWCsmo3GAuYSEIwyHvGf1I950amuCVqmks+ZdWHFehrw
swh-1(conf-ssh-pubkey-data)#EXH5UOxDGZ0N8CiZs5LRUG4XXpZ/bX6Z3MBmhKy8GAR3zhHj9PomGOf9Exrf4Uxp4b730AI6axSQ+cXPgz2nVQiDnaehhUzb/gOp
swh-1(conf-ssh-pubkey-data)#tCX521lbAqBq/y7Di9iuQspV/xf6oBVacXGUzwbOPwmjF2s3w+R8Iv47rjOOt4U8BuL4T6cS5rZJ3KfZ
swh-1(conf-ssh-pubkey-data)#exit
swh-1(conf-ssh-pubkey-user)#end
swh-1#

Woohoo, at this point, you should be able to simply ssh in as your username and immediately be given a privilege 15 exec prompt.

If that’s all good, you should be able to scp your new IOS file to the device now.  For an added bonus, if this is a stack,  here’s how you SCP it to what would be the second switch in the stack (flash2):

scp ~/Downloads/c2960x-universalk9-mz.152-2.E5.bin sysadmin1@192.0.2.1:flash2:/c2960x-universalk9-mz.152-2.E5.bin

The tricky part about the above is if you attempt to just give a target directory, like normal unix to unix scp, it will fail.  So, if your intent was to get the image onto switch2’s flash, by doing this:

scp ~/Downloads/c2960x-universalk9-mz.152-2.E5.bin sysadmin1@192.0.2.1:flash2:/

 

that won’t work, you’ll get:

scp: flash2:/: No such file or directory

So, just give it the flash2 and full filename for the target; it will work.  Now, what I can’t figure out for the life of me is why scp operations are so slow….  Ended up taking 15 minutes:

c2960x-universalk9-mz.152-2.E5.bin           100%   20MB  21.9KB/s   15:50

No, there’s no port/speed/duplex issues, I’m plugged into the switch directly at gig and scp’ing to it from the management vlan which I’m also on, so no routing.  Only unusual part of the scenario is the management IP is obviously that of the stack master, and the target is the second switch in the stack; maybe that causes it to do something stupid.  Ha; better, but no huge difference from a time wasted perspective, even though it was a third less time from a statistics perspective; weird.

c2960x-universalk9-mz.152-2.E5.bin 100% 20MB 33.8KB/s 10:14