rclone

Videos

Overview: rclone on Ubuntu 24.04 LTS on Azure: overview (watch on YouTube)

Launch and log in: rclone on Ubuntu 24.04 LTS on Azure: launch and log in (watch on YouTube)

Deep Dive: rclone on Ubuntu 24.04 LTS on Azure: deep dive (watch on YouTube)

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size. rclone is light on resources, but large parallel transfers benefit from more vCPU and network bandwidth.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, 80/tcp for the Web GUI and API, and 443/tcp if you add TLS. rclone serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain and restrict access to trusted IP ranges (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for rclone by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:rclone-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name rclone \
  --image sac1647283583153:rclone-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name rclone --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH as the administrator user you chose at deployment:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Run the following command to check both services:

systemctl is-active rclone-rcd.service nginx.service

Both report active. rclone rcd serves the Web GUI and the remote-control API on the loopback address 127.0.0.1:5572. nginx fronts it on port 80, adds the per-VM HTTP Basic Auth gate, and exposes an unauthenticated /healthz for load-balancer probes.

Step 5 - Retrieve your Web GUI password

nginx protects the rclone remote-control API with HTTP Basic Auth. The username is admin. A unique password is generated on the first boot of your VM and written to a root-only file. Read it with:

sudo cat /root/rclone-credentials.txt

The file contains RCLONE_URL, RCLONE_USERNAME=admin and a RCLONE_PASSWORD value that is unique to this VM.

The password is stored only as a bcrypt hash in nginx's .htpasswd. No plaintext credential ships in the image, and no two VMs share a secret.

Step 6 - Open the rclone Web GUI

Browse to http://<vm-public-ip>/. The rclone Web GUI loads its sign-in screen with the endpoint URL already filled in.

Enter username admin and the RCLONE_PASSWORD from Step 5, then select Login.

Once you are signed in, the Dashboard confirms that the backend is connected. It shows live transfer statistics (bytes transferred, average speed, checks, transfers and errors), a bandwidth control, and the rclone version.

Step 7 - Check the remote-control API

The Web GUI drives the same remote-control API that you can call directly. The static Web GUI is served openly, but every remote-control call requires the per-VM password. Read the password from the credentials file and call core/version:

PW=$(sudo grep '^RCLONE_PASSWORD=' /root/rclone-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" -X POST http://127.0.0.1/core/version

The API returns a JSON document with the rclone version, OS and architecture. An unauthenticated API call is rejected with 401. The open /healthz endpoint and the Web GUI itself return 200:

curl -s -o /dev/null -w 'healthz:%{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'webgui:%{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'api-unauth:%{http_code}\n' -X POST http://127.0.0.1/core/version

Step 8 - Add a cloud storage remote

A "remote" is a configured connection to a storage backend. Open the Configs tab in the Web GUI and select Create a New Config. Choose the backend (for example Amazon S3, Azure Blob, Google Drive or Backblaze B2) and enter your own credentials for it.

Nothing is preconfigured, so the image never carries anyone else's cloud credentials.

You can also manage remotes from the command line. Remotes are stored in /var/lib/rclone/rclone.conf, owned by the rclone service account:

# Interactive wizard (walks you through backend + credentials):
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf config
# Or create one non-interactively, e.g. an Azure Blob remote using a SAS URL:
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf config create myazure azureblob \
  sas_url "<your-container-sas-url>"
# List configured remotes:
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf listremotes

Step 9 - Browse and transfer files

Once a remote exists, open the Explorer tab and enter its name to browse its contents in the Web GUI. From the CLI, the same remote supports copy, sync, move and mount operations.

# List the top-level directories of a remote:
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf lsd myazure:
# Copy a local directory up to the remote (checksum-verified, resumable):
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf copy /path/to/local/dir myazure:backups/data
# Sync (make destination match source - deletes extras on the destination):
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf sync /path/to/local/dir myazure:backups/data
# Server-side copy directly between two remotes (no data flows through this VM):
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf copy mys3:bucket/path myazure:container/path
# Mount a remote as a local filesystem (create a mountpoint the rclone account owns first):
sudo install -d -o rclone -g rclone /mnt/backups
sudo -u rclone rclone --config /var/lib/rclone/rclone.conf mount myazure:backups /mnt/backups --daemon
# The mount is readable by the rclone account only. To let other users read it, add
# user_allow_other to /etc/fuse.conf and pass --allow-other. Unmount with:
sudo -u rclone fusermount3 -u /mnt/backups

Maintenance

Security. The Web GUI and API are served over plain HTTP on port 80 behind the per-VM Basic Auth password. For production, put a TLS-terminating reverse proxy with your own domain and certificate in front of the VM. Restrict the NSG so that only trusted IP ranges reach port 80, and keep port 22 limited to your management network.

To rotate the Web GUI password, write a new bcrypt entry to /etc/nginx/.rclone.htpasswd with sudo htpasswd -B /etc/nginx/.rclone.htpasswd admin, then reload nginx.

Configuration and secrets. Your remotes and their credentials live in /var/lib/rclone/rclone.conf, owned by the rclone service account. The file ships empty in the image. Consider encrypting the config with a password (rclone config offers this) so that backend credentials are not stored in the clear.

Service management. rclone rcd runs under rclone-rcd.service and nginx under nginx.service. Both are enabled and start on boot. Logs are in /var/log/rclone-rcd.log and journalctl -u rclone-rcd.

Updates. The image is patched at build time and ships with unattended security updates enabled, so OS security fixes continue to apply automatically. To move to a newer rclone release, download the binary from the rclone releases page, verify its checksum, and replace /usr/local/bin/rclone.

Troubleshooting

• The Web GUI sign-in is rejected. Confirm that you are using username admin and the exact RCLONE_PASSWORD from /root/rclone-credentials.txt. The remote-control API returns 401 for a wrong password by design.
• /healthz returns 200 but the Web GUI will not load. Check systemctl status rclone-rcd nginx and journalctl -u rclone-rcd. The daemon must be listening on 127.0.0.1:5572 for nginx to proxy to it.
• A transfer fails with an authentication error against your backend. The error comes from the remote's own cloud credentials, not from the rclone Web GUI password. Re-check the remote in the Configs tab or with rclone config.
• First boot has not finished. If /root/rclone-credentials.txt still shows the initial text, the first-boot service has not completed yet. Wait a minute and check again, or inspect journalctl -u rclone-firstboot.

For further help, contact SecureAnyCloud support, which is included 24/7 with your subscription.

Deploy on Azure

Launch rclone on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com