rsync

Synopsis #

rsync synchronizes files and directories between local or remote systems, transferring changed data to reduce repeated copying. Install it from packages and use ssh(1) for encrypted remote transfers. It can also serve files through a standalone daemon; that protocol does not encrypt traffic.

Installation #

To install rsync from the OpenBSD packages collection:

doas pkg_add rsync

This installs the rsync binary and associated files to /usr/local/bin/rsync.

Client Usage #

The most common use case for rsync is as a client to synchronize files to or from a local or remote system. It supports multiple transports, with ssh(1) being the default for remote operations.

Syntax #

rsync [options] SOURCE DEST

Local Copy #

To copy a directory locally:

rsync -av /home/user/documents/ /backup/documents/

• -a: Archive mode (preserves permissions, symlinks, etc.)
• -v: Verbose output
• Trailing slash in source ensures contents are copied, not the directory itself.

Remote Copy Over SSH #

To copy files to a remote host over SSH:

rsync -avz /home/user/data/ user@remote.example.com:/home/user/backup/

To copy from a remote host:

rsync -avz user@remote.example.com:/var/log/ ./logs/

• -z: Enable compression
• -e ssh: Can be omitted; rsync defaults to SSH transport

To specify a non-standard SSH port:

rsync -av -e "ssh -p 2222" ./site/ user@remote.example.com:/var/www/

Exclude Files #

Exclude temporary files:

rsync -av --exclude '*.tmp' src/ user@host:/srv/

To exclude a list of patterns:

rsync -av --exclude-from=exclude.txt src/ user@host:/srv/

Deleting Removed Files #

Synchronize and delete files on the destination not present in the source:

rsync -av --delete ./syncdir/ user@host:/srv/syncdir/

Dry Run #

Preview the changes without making them:

rsync -av --dry-run ./docs/ user@host:/backup/docs/

Running an rsync Server #

rsync can be run as a standalone daemon to provide files over the rsync:// protocol. Unlike typical SSH-based usage, this mode does not use SSH and requires explicit configuration and activation.

rsyncd Configuration #

When running as a daemon, rsync reads its configuration from /etc/rsyncd.conf, or another file specified via the --config option. The format resembles an INI file, with one or more modules defined.

Example configuration:

uid = _rsync
gid = _rsync
use chroot = yes
max connections = 4
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid

[public]
    path = /srv/rsync/public
    comment = Public files
    read only = yes
    list = yes

[backup]
    path = /srv/rsync/private
    comment = Backup files
    auth users = backupuser
    secrets file = /etc/rsyncd.secrets
    read only = no
    list = no

This example defines two modules:

• public: A read-only public directory.
• backup: A password-protected writable module restricted to backupuser.

Authentication Secrets #

If any module uses auth users, a secrets file must be specified. This file maps usernames to passwords:

backupuser:password123

Set secure permissions on the secrets file:

doas chmod 600 /etc/rsyncd.secrets

Starting the Daemon #

The package supplies /etc/rc.d/rsyncd. Create both module directories and give _rsync the required access; only the private upload directory needs write access. Confirm the packaged account exists before setting ownership.

doas mkdir -p /srv/rsync/public /srv/rsync/private
doas chown _rsync:_rsync /srv/rsync/private
doas chmod 750 /srv/rsync/private
doas rcctl enable rsyncd
doas rcctl start rsyncd
doas rcctl check rsyncd

Public files must be readable by the daemon identity. Restrict access to the daemon port with PF and test denied authentication as well as a successful transfer.

Connecting to an rsync Daemon #

To connect to a public module on an rsync server:

rsync rsync://rsync.example.com/public/

To synchronize with authentication:

rsync -av --password-file="$HOME/.rsync.pass" rsync://backupuser@rsync.example.com/backup/ ./backup/

Create ~/.rsync.pass as the invoking user with private permissions; it contains only the password:

password123

Ensure proper file permissions:

chmod 600 "$HOME/.rsync.pass"

Comparison with Alternatives #

Security Considerations #

• When using the daemon mode (rsync://), no encryption is performed.
• Always prefer SSH-based rsync for secure transfers.
• Protect secrets files (rsyncd.secrets, --password-file) with strict permissions.
• Use chroot, UID/GID restrictions, and appropriate file permissions when exposing rsyncd.

Summary of Common Commands #