Plain rsync daemon transfers move fast but move in the clear, and rsync-ssl fixes that by wrapping the connection in SSL/TLS. The examples use rsync-ssl 3.2.7 from the installed rsync package. Allow about fifteen minutes, plus the time needed to get the daemon's hostname, module name and access details from whoever runs it.
This guide assumes the server is already configured for SSL/TLS and that you have a normal rsync daemon target such as backup.example.net::archives/. It does not configure the server, create certificates or put credentials into a shell history. Those are separate administrative tasks.
Start with read-only checks. No elevated privileges are needed for these commands:
$ command -v rsync-ssl
/usr/bin/rsync-ssl
$ rsync-ssl --version
rsync 3.2.7-1ubuntu1.5
$ dpkg-query -W -f='${Package} ${Version}\n' rsync
rsync 3.2.7-1ubuntu1.5The local manual page is current for rsync 3.2.7. The helper is a wrapper around rsync, so its ordinary rsync options pass straight through. The important difference is that the source or destination must use daemon syntax: either hostname::module/ or an rsync://hostname/ URL.
Checkpoint: if your target is an SSH path such as user@host:/srv/data, stop here. That is not an rsync daemon target and does not belong in an rsync-ssl command.
For a first connection, copy into a new directory that you can inspect. A local destination normally needs no sudo:
$ mkdir -p "$HOME/rsync-ssl-check"
$ rsync-ssl -aiv backup.example.net::archives/reports/ "$HOME/rsync-ssl-check/"Replace both the hostname and module path with values supplied by the server administrator. The trailing slash on the source means copy the contents of reports into the destination; without it, rsync's usual directory-copy rules apply. -aiv requests archive mode, itemised changes and verbose output: rsync options, not special rsync-ssl options.
On a successful run, expect itemised lines for transferred files followed by rsync's transfer summary. An already current tree may show no file changes but still finish with an exit status of zero:
$ printf 'exit status: %s\n' "$?"
exit status: 0
$ find "$HOME/rsync-ssl-check" -maxdepth 2 -type f -print
/home/you/rsync-ssl-check/example.txtThe exact file list is server-specific. Do not treat an empty destination as proof the connection worked: the module might simply contain no files, or a filter might exclude them.
By default, the script searches for an SSL program using a simple heuristic. Set RSYNC_SSL_TYPE or put the first argument in the exact --type=... form when you want a reviewable choice:
$ rsync-ssl --type=openssl -aiv backup.example.net::archives/reports/ "$HOME/rsync-ssl-check/"The documented values are openssl and stunnel. The equal sign is required in the command-line form. The installed script also contains a gnutls path, but the local manual warns that gnutls-cli was dropping output in the release covered by that page. Use the documented backends unless you have tested the installed version and have a reason to pick another.
If you prefer an environment setting for a short session, keep it visible and unset it afterwards:
$ RSYNC_SSL_TYPE=openssl rsync-ssl -aiv backup.example.net::archives/reports/ "$HOME/rsync-ssl-check/"This only affects that one command. It does not change a service, a system configuration file or the server.
SSL rsync connections use port 874 by default, one above the ordinary rsync daemon port 873. If the administrator gave you another port, pass it explicitly:
$ rsync-ssl -aiv --port 9874 backup.example.net::archives/reports/ "$HOME/rsync-ssl-check/"With rsync 3.2.0 and later, you can also put the port in the URL:
$ rsync-ssl -aiv rsync://backup.example.net:9874/archives/reports/ "$HOME/rsync-ssl-check/"Do not guess a port or mix both forms casually: the resulting precedence is harder to review, and a wrong value will look like a certificate or firewall problem. For a reusable default, set RSYNC_SSL_PORT in the command's environment:
$ RSYNC_SSL_PORT=9874 rsync-ssl -aiv backup.example.net::archives/reports/ "$HOME/rsync-ssl-check/"Check the administrator's firewall and daemon configuration if the connection times out. A timeout is not evidence that certificate validation succeeded.
Security boundary: certificate options are security-sensitive. Do not disable verification merely to make a connection succeed, and do not paste a private key into a command line where it can be exposed in process listings or shell history.
The helper recognises these environment variables:
RSYNC_SSL_CERT names a client certificate file.RSYNC_SSL_KEY names the private key for that certificate.RSYNC_SSL_CA_CERT names a CA certificate file used to validate the connection.For openssl, an unset CA variable uses the normal CA collection in the installed script; setting it to a file selects that CA file instead. The local manual specifically warns that the stunnel path does not verify against the system CA collection, so provide the certificate environment settings when that backend is required. An explicitly empty RSYNC_SSL_CA_CERT disables verification in the helper. Avoid that setting for real transfers.
Inspect certificate files without changing them, and restrict private-key permissions if you are responsible for the files:
$ test -r /path/to/ca.pem && echo 'CA file is readable'
CA file is readable
$ ls -l /path/to/client.key /path/to/client.crt /path/to/ca.pemIf the key needs permission changes, that is a state change and may require elevated privileges depending on its directory. A typical owner-only key mode is chmod 600, but confirm ownership and service requirements before changing a shared key.
Recovery: to undo a mode-only change, restore the previous mode recorded by ls -l; do not delete the key.
First separate argument errors from network errors. This deliberately omits a daemon-style target and should fail before a transfer:
$ rsync-ssl --type=openssl /tmp/source "$HOME/rsync-ssl-check/"
You must use rsync-ssl with a daemon-style hostname.If you see that message, correct the source or destination syntax. For a connection failure, rerun with a known port and an explicit backend, then read the first error carefully:
openssl, stunnel4 or stunnel executable is a local dependency problem.Use rsync's dry-run mode when you are unsure what a successful command would change on a destination:
$ rsync-ssl -aniv --type=openssl backup.example.net::archives/reports/ "$HOME/rsync-ssl-check/"-n asks rsync not to alter the destination, while -aiv keeps the comparison visible. This does not prove a later write will succeed, but it is a useful checkpoint before replacing an existing tree.