Rsync Daemon Over SSH for Secure Linux Sync

This article explains how Linux integrates the file-transfer utility rsync with the Secure Shell (SSH) protocol to achieve fast, encrypted remote data synchronization. You will learn the mechanics behind tunneling rsync traffic through SSH, why this approach replaces legacy unencrypted daemon configurations, and the practical commands used to run remote synchronization securely.

The Architecture of Rsync Over SSH

By default, the standalone rsync daemon (rsyncd) listens on TCP port 873. While efficient, this native protocol transmits authentication credentials and file contents in plain text unless encapsulated by an external cryptographic layer.

Linux avoids exposing port 873 across public networks by using SSH as a transport shell. When executed over SSH, the local rsync client initiates a standard SSH connection to the remote host. Once the SSH session is authenticated, it spawns a remote rsync process in server mode (rsync --server) or invokes a preconfigured daemon setup. The local and remote rsync processes communicate directly through the encrypted standard input and output (stdio) streams of the SSH tunnel.

How the Process Operates

The synchronization workflow follows four key stages:

1. Connection and Authentication: The local machine contacts the remote server on port 22 using SSH. Authentication is handled entirely by the SSH subsystem via public key cryptography, PAM, or passwords.
2. Remote Execution: After authentication, the SSH daemon on the target host launches the rsync binary automatically with operational flags passed from the client.
3. Data Comparison: Both instances of rsync examine file metadata (modification times, sizes, or checksums) across the encrypted pipe to determine the differences.
4. Encrypted Delta-Transfer: Only the modified blocks of data are compressed and sent through the SSH stream, ensuring both minimal bandwidth usage and end-to-end encryption.

Command Execution Methods

Linux administrators utilize rsync over SSH primarily in two operational modes:

1. Standard Remote Shell Invocation

The most common implementation bypasses /etc/rsyncd.conf entirely, relying on native user accounts:

rsync -avz -e ssh /local/directory/ username@remote_host:/remote/directory/

• -a preserves file permissions, ownerships, and timestamps.
• -v enables verbose output.
• -z compresses data during transfer.
• -e ssh specifies the remote shell to use (this is the default in modern Linux distributions).

2. Accessing a Predefined Daemon Module via SSH

When centralized access policies or module definitions from /etc/rsyncd.conf are required, you can connect to daemon-defined modules directly over an SSH transport using the double-colon syntax:

rsync -avz -e ssh /local/directory/ username@remote_host::module_name/

Alternatively, you can tunnel directly to the local daemon socket:

rsync -avz --rsh="ssh -l username" remote_host::module_name /local/destination/

In this configuration, SSH establishes the outer security perimeter, while the target host directs the input stream to the local rsync configuration, eliminating the need to expose port 873 to the outside world.

Key Advantages of This Implementation

• Single Port Exposure: Systems only need to expose SSH (port 22), reducing firewall complexity and the attack surface.
• Robust Access Control: Leveraging SSH enables advanced security measures, such as hardware security keys (FIDO2), SSH key restrictions via authorized_keys, and fail2ban protection.
• Integrity and Privacy: Data packets cannot be inspected or altered in transit, protecting sensitive files from network sniffing and man-in-the-middle attacks.