rclone on Ubuntu 24.04 on Azure User Guide

Overview

rclone is the open source command line program often called the "swiss army knife of cloud storage". It manages files on more than seventy storage backends - Amazon S3, Azure Blob Storage, Google Drive and Cloud Storage, Backblaze B2, Dropbox, SFTP, WebDAV and many more - copying, syncing, moving and deleting files between any two of them with checksum-verified transfers, server-side copy, encryption and bandwidth control. It can also mount a remote as a local filesystem and serve one over HTTP, WebDAV, FTP or S3.

The cloudimg image installs the pinned rclone 1.74.4 single Go binary (both the rclone CLI and the remote-control daemon rclone rcd) and locks it down for a marketplace appliance. rclone rcd serves the built-in rclone Web GUI and the remote-control REST API bound to loopback 127.0.0.1:5572, so it is never exposed directly, and an nginx reverse proxy on port 80 sits in front of it. Because rclone rcd has no user accounts of its own, the gate is nginx HTTP Basic Auth (user admin, a unique password generated on the first boot of your VM). The static Web GUI is served openly on GET so you land straight on its sign-in screen, while the remote-control API (which moves data) requires the per-VM password. The Web GUI bundle is baked into the image, so your VM never fetches it from the internet at runtime. Backed by 24/7 cloudimg support.

What is included:

• rclone 1.74.4 installed as a single Go binary at /usr/local/bin/rclone (CLI + rclone rcd daemon)
• The rclone Web GUI and remote-control REST API on :80, fronted by nginx with the daemon bound to loopback only
• Per-VM HTTP Basic Auth (user admin) protecting the remote-control API, with a unique password generated on first boot
• rclone rcd bound to 127.0.0.1:5572 with --rc-no-auth - nothing is exposed to the network directly
• The rclone Web GUI bundle pre-staged in the image, so no runtime fetch from GitHub is ever needed
• No cloud provider account, remote or token baked into the image - you configure your own remotes
• rclone-rcd.service + nginx.service as systemd units, enabled and active
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• Fully patched at build time with unattended security updates left enabled
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point; rclone is light on resources, though large parallel transfers benefit from more vCPU and network bandwidth. NSG inbound: allow 22/tcp from your management network, 80/tcp for the Web GUI and API, and 443/tcp if you add TLS. rclone serves plain HTTP on port 80; for production use, terminate TLS in front of it with your own domain and restrict access to trusted IP ranges (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for rclone by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name rclone \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name rclone --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active rclone-rcd.service nginx.service

Both report active. rclone rcd serves the Web GUI and the remote-control API on the loopback address 127.0.0.1:5572; nginx fronts it on port 80 and adds the per-VM HTTP Basic Auth gate, with an unauthenticated /healthz for load-balancer probes.

Step 5 - Retrieve your Web GUI password

nginx protects the rclone remote-control API with HTTP Basic Auth. The username is admin and a unique password is generated on the first boot of your VM and written to a root-only file:

sudo cat /root/rclone-credentials.txt

You will see RCLONE_URL, RCLONE_USERNAME=admin and a RCLONE_PASSWORD value that is unique to this VM. The password is stored only as a bcrypt hash in nginx's .htpasswd, so no plaintext credential ships in the image and no two VMs share a secret.

Step 6 - Open the rclone Web GUI

Browse to http://<vm-public-ip>/. The rclone Web GUI loads and shows its sign-in screen with the endpoint URL already filled in - you only enter the credentials. Use username admin and the RCLONE_PASSWORD from Step 5, then select Login.

Once signed in, the Dashboard confirms the backend is connected and shows live transfer statistics (bytes transferred, average speed, checks, transfers and errors), a bandwidth control, and the rclone version.

Step 7 - Check the remote-control API

The Web GUI drives the same remote-control API you can call directly. The static Web GUI is served openly, but every remote-control call requires the per-VM password. Read the password from the credentials file and call core/version:

PW=$(sudo grep '^RCLONE_PASSWORD=' /root/rclone-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" -X POST http://127.0.0.1/core/version

The API returns a JSON document with the rclone version, OS and architecture. An unauthenticated call to the API is rejected with 401, while the open /healthz endpoint and the Web GUI itself return 200:

curl -s -o /dev/null -w 'healthz:%{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'webgui:%{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'api-unauth:%{http_code}\n' -X POST http://127.0.0.1/core/version

Step 8 - Add a cloud storage remote

A "remote" is a configured connection to a storage backend. Open the Configs tab in the Web GUI and select Create a New Config to add one interactively - choose the backend (for example Amazon S3, Azure Blob, Google Drive or Backblaze B2) and enter your own credentials for it. Nothing is preconfigured, so the image never carries anyone else's cloud credentials.

You can also manage remotes from the command line. Remotes are stored in /var/lib/rclone/rclone.conf, owned by the rclone service account:

# Interactive wizard (walks you through backend + credentials):
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf config

# Or create one non-interactively, e.g. an Azure Blob remote using a SAS URL:
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf config create myazure azureblob \
  sas_url "<your-container-sas-url>"

# List configured remotes:
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf listremotes

Step 9 - Browse and transfer files

Once a remote exists, open the Explorer tab and enter its name to browse its contents in the Web GUI. From the CLI, the same remote drives copy, sync, move and mount operations.

# List the top-level directories of a remote:
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf lsd myazure:

# Copy a local directory up to the remote (checksum-verified, resumable):
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf copy /data myazure:backups/data

# Sync (make destination match source - deletes extras on the destination):
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf sync /data myazure:backups/data

# Server-side copy directly between two remotes (no data flows through this VM):
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf copy mys3:bucket/path myazure:container/path

# Mount a remote as a local filesystem:
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf mount myazure:backups /mnt/backups --daemon

Maintenance

Security. The Web GUI and API are served over plain HTTP on port 80 behind the per-VM Basic Auth password. For production, put a TLS-terminating reverse proxy (your own domain + certificate) in front of the VM and restrict the NSG so only trusted IP ranges reach port 80. Keep port 22 limited to your management network. Rotate the Web GUI password by writing a new bcrypt entry to /etc/nginx/.rclone.htpasswd with sudo htpasswd -B /etc/nginx/.rclone.htpasswd admin and reloading nginx.

Configuration and secrets. Your remotes and their credentials live in /var/lib/rclone/rclone.conf (owned by the rclone service account). Consider encrypting the config with a password (rclone config offers this) so backend credentials are not stored in the clear. Nothing in this file ships in the image - it starts empty.

Service management. rclone rcd runs under rclone-rcd.service and nginx under nginx.service; both are enabled and start on boot. Logs are at /var/log/rclone-rcd.log and journalctl -u rclone-rcd.

Updates. The image ships fully patched with unattended security updates enabled, so OS security fixes continue to apply automatically. To move to a newer rclone release, download the pinned binary from the rclone releases page, verify its checksum, and replace /usr/local/bin/rclone.

Troubleshooting

• The Web GUI sign-in is rejected. Confirm you are using username admin and the exact RCLONE_PASSWORD from /root/rclone-credentials.txt. The remote-control API returns 401 for a wrong password by design.
• /healthz returns 200 but the Web GUI will not load. Check systemctl status rclone-rcd nginx and journalctl -u rclone-rcd; the daemon must be listening on 127.0.0.1:5572 for nginx to proxy to it.
• A transfer fails with an authentication error against your backend. That is the remote's own cloud credentials, not the rclone Web GUI password. Re-check the remote in the Configs tab or with rclone config.
• First boot has not finished. If /root/rclone-credentials.txt still shows the placeholder text, the first-boot service has not completed yet; wait a minute and re-check, or inspect journalctl -u rclone-firstboot.

For further help, contact cloudimg support - included 24/7 with your subscription.