Rsync Server on AWS User Guide

Overview

This image runs rsync in daemon mode (rsyncd), the de facto standard tool for fast, efficient file synchronisation, mirroring and backup. rsync's delta transfer algorithm sends only the parts of files that have changed, so repeated syncs of large trees complete in a fraction of the time and bandwidth of a full copy. The daemon is installed from the official Ubuntu 24.04 package archive and wired up as a hardened systemd service, so a working rsync server is answering on the network within minutes of launch.

This is a headless image. There is no web interface; you operate it over SSH and connect to it from any rsync client. The daemon listens on TCP port 873 and its behaviour is defined entirely by a single configuration file, /etc/rsyncd.conf, which exposes one or more named modules, each mapped to a directory on the server. This image ships one module named cloudimg.

Secure by default. A naive rsync daemon exposes modules with no authentication and no isolation. This image does the opposite: the cloudimg module requires a module user and password on every transfer, there is no anonymous access, and every transfer is chrooted inside the module directory so a client can never escape the module path. There is no baked or shared credential. On the first boot of your instance a one-shot service generates a unique module user and a long random password for that specific instance and writes them to a root-owned credentials file, so no two instances share a credential and nothing secret is published in the image.

The module's file store lives on a dedicated EBS data volume mounted at /srv/rsync, so your synchronised data sits on its own independently resizable and snapshottable disk, separate from the operating system disk.

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 (SSH) from your management network and inbound port 873 (rsync) from your own rsync client hosts
• An rsync client on the machines you want to synchronise (rsync ships with virtually every Linux and macOS system; on Windows use WSL or cwRsync)

Step 1: Launch the Instance from the AWS Marketplace

1. Open the product page in the AWS Marketplace and choose Continue to Subscribe, then Continue to Configuration.
2. Select the software version and the Region you want to launch in, then choose Continue to Launch.
3. Under Choose Action select Launch through EC2, review the instance type (the listing recommends m5.large), your key pair, and a security group that allows inbound TCP 22 and TCP 873 from your client hosts, then launch.

Step 2: Launch the Instance from the AWS CLI

Replace the AMI ID, key name, subnet and security group with your own values.

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rsync-server}]'

Your security group should allow inbound TCP 22 from your management network and inbound TCP 873 only from the rsync client hosts that will connect to the daemon.

Step 3: Connect to Your Instance

SSH in as the default login user for your operating system variant:

ssh -i your-key.pem ubuntu@<public-ip>

Step 4: Confirm the Daemon Is Running

The rsync daemon starts automatically after the first-boot service has rendered this instance's credential. Confirm the version, that the service is active, and that it is listening on TCP 873:

rsync --version | head -1
sudo systemctl is-active rsync
sudo ss -ltn | grep ':873 '

Step 5: Retrieve This Instance's Module Credentials

On first boot a unique module user and a long random password were generated for this instance and written to a root-owned file. Read them with:

sudo cat /root/rsync-credentials.txt

The file records RSYNC_USER, RSYNC_PASSWORD, RSYNC_MODULE and a ready-to-use RSYNC_ENDPOINT, all unique to your instance. Keep this credential safe: every transfer to the cloudimg module must present it.

Step 6: Push and Pull Files Over the rsync Protocol

Supply the password through the RSYNC_PASSWORD environment variable (so it never appears in your shell history or the process list), then push a file to the server and pull it back from the server. Run on the instance itself against 127.0.0.1 to verify the round-trip end to end:

RSYNC_USER=$(sudo grep '^RSYNC_USER=' /root/rsync-credentials.txt | cut -d= -f2-)
export RSYNC_PASSWORD=$(sudo grep '^RSYNC_PASSWORD=' /root/rsync-credentials.txt | cut -d= -f2-)
echo "hello from cloudimg rsync $(date -u)" > /tmp/demo.txt
rsync -av /tmp/demo.txt "rsync://${RSYNC_USER}@127.0.0.1/cloudimg/"
rsync -av "rsync://${RSYNC_USER}@127.0.0.1/cloudimg/demo.txt" /tmp/demo-pulled.txt
cmp -s /tmp/demo.txt /tmp/demo-pulled.txt && echo "ROUND-TRIP OK: contents match"

From a remote rsync client, use your instance's public IP and the module user and password from the credentials file (this example is illustrative; run it from your own workstation):

export RSYNC_PASSWORD='the-password-from-the-credentials-file'
rsync -av ./my-local-folder/ rsync://your-user@<public-ip>/cloudimg/

The cloudimg module's files live on the dedicated data volume at /srv/rsync/cloudimg.

Step 7: Authentication Is Enforced

The module has no anonymous access and rejects a wrong password. Both an unauthenticated transfer and one with the wrong password fail with a non-zero exit code (@ERROR: auth failed on module cloudimg):

RSYNC_USER=$(sudo grep '^RSYNC_USER=' /root/rsync-credentials.txt | cut -d= -f2-)
rsync rsync://127.0.0.1/cloudimg/demo.txt /tmp/anon.txt </dev/null >/dev/null 2>&1; echo "anonymous transfer rejected (non-zero exit code ${?})"
RSYNC_PASSWORD='not-the-password' rsync "rsync://${RSYNC_USER}@127.0.0.1/cloudimg/demo.txt" /tmp/bad.txt >/dev/null 2>&1; echo "wrong-password transfer rejected (non-zero exit code ${?})"

Step 8: Add Your Own Modules

The whole server configuration is a single text file, /etc/rsyncd.conf. The shipped cloudimg module looks like this:

[cloudimg]
    comment = cloudimg shared rsync module (per-VM authenticated, chrooted)
    path = /srv/rsync/cloudimg
    use chroot = yes
    read only = no
    list = yes
    uid = rsyncd
    gid = rsyncd
    auth users = rsync-XXXXXX
    secrets file = /etc/rsyncd.secrets
    strict modes = yes
    hosts allow = *

To add a module, create its directory, append a new [name] block pointing at it, add any extra users to /etc/rsyncd.secrets (format user:password, file mode 0600 owned by root), then reload the daemon with sudo systemctl restart rsync. Keep use chroot = yes and an auth users + secrets file pair on every module so it stays authenticated and jailed. To restrict which client hosts a module accepts, set hosts allow to your client IPs or CIDRs (in addition to scoping the security group).

Step 9: The Dedicated Data Volume

The module file store is on a dedicated EBS volume mounted at /srv/rsync:

df -h /srv/rsync

Because it is a separate volume you can grow it, snapshot it, and back it up independently of the operating system disk. It is referenced in /etc/fstab by filesystem UUID with the nofail option, so the instance stays bootable even if the volume is ever detached.

Step 10: Run rsync over SSH (Encrypted Transport)

The rsync protocol on TCP 873 authenticates every transfer but does not encrypt the data in flight. For an end-to-end encrypted transport, run rsync over SSH instead, which needs no daemon credential and only port 22 (run this from your own workstation):

rsync -av -e ssh ./my-local-folder/ ubuntu@<public-ip>:/srv/rsync/cloudimg/backup/

Choose the daemon protocol (port 873) when you want module-based access control and multiple named shares; choose rsync over SSH when you want encryption in transit and already trust SSH key access.

Support

cloudimg provides 24/7 technical support for this Rsync Server product by email (support@cloudimg.co.uk) and live chat. We help with deployment and first-boot configuration, retrieving the per-instance module user and password, adding and designing rsync modules, scheduling backups and mirrors, running rsync over SSH for encrypted transport, tuning bandwidth and connection limits, restricting access with hosts allow rules and the security group, managing the dedicated data volume, and rsync version upgrades. Critical issues receive a one-hour average response time.

rsync is distributed under the GNU GPL v3. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.