rsync Server 3.5.1

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Rsync Server 3.5.1 on Ubuntu 24.04 as the software version, pick your Region, then choose Launch through EC2.

Choose m5.large, your key pair and a security group as described above. rsync needs little CPU, so size the instance for your transfer volume.

The AMI carries two volumes: the 8 GiB root volume and a 20 GiB data volume for /srv/rsync. You can make the data volume larger at launch, and first boot grows the file system to fill it.

To launch with the AWS CLI instead, replace the values in angle brackets. The second block device mapping sets the data volume size:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sdf,Ebs={VolumeSize=200,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rsync-server}]'

Version SSH user

Rsync Server 3.5.1 on Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot creates the password, starts the daemon and proves a round trip before it finishes, usually in under a minute. Check the first boot unit:

systemctl is-active rsync rsync-prepare rsync-firstboot
sudo test -f /var/lib/sac/data/rsync-firstboot.done && echo FIRSTBOOT_DONE

All three units are active and the first boot marker is present:

active active active FIRSTBOOT_DONE

Only SSH and the rsync daemon listen on public addresses, and the daemon is the upstream 3.5.1 build:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | grep -v '127.0.0' | sort command -v rsync; rsync --version | sed -n 1p

0.0.0.0:22 users:(("sshd",...)) 0.0.0.0:873 users:(("rsync",...)) [::]:22 users:(("sshd",...)) [::]:873 users:(("rsync",...)) /usr/local/bin/rsync rsync version 3.5.1 protocol version 33

sudo grep -vE '^(#|$)' /root/rsync-credentials.txt

The file is readable by root only:

RSYNC_HOST=ec2-<public-ip-dashed>.compute-1.amazonaws.com RSYNC_PORT=873 RSYNC_USER=sac RSYNC_PASSWORD=<RSYNC_PASSWORD> RSYNC_MODULE=sac RSYNC_URL=rsync://sac@ec2-<public-ip-dashed>.compute-1.amazonaws.com/sac/ RSYNC_MODULE_PATH=/srv/rsync/sac

RSYNC_HOST is the instance's public DNS name from EC2 instance metadata (the public or private IP address when the subnet has no public DNS names). It is the name to use from your clients.

Store the password in a file only you can read, because rsync refuses a password file that others can read. Then push a directory to the server and pull it back. rsync reads the password from the file, so it never appears on a command line or in your shell history:

read -rs PW && printf '%s\n' "$PW" > ~/.rsync-sac.pw && chmod 600 ~/.rsync-sac.pw; unset PW rsync -av --password-file=$HOME/.rsync-sac.pw ./projects/ rsync://sac@<RSYNC_HOST>/sac/projects/ rsync -av --password-file=$HOME/.rsync-sac.pw rsync://sac@<RSYNC_HOST>/sac/projects/ ./restore/

Add --delete to make the copy on the server an exact mirror, so files you deleted locally are deleted on the server too. To schedule a nightly backup, put the push command in a cron job or systemd timer on the client.

This test pushes a file, lists the module, pulls the file back and mirrors a deletion. It goes through the daemon on the instance's own private address. The password is read from a temporary file that only root can read:

sudo bash -c ' F=/root/rsync-credentials.txt U=$(sed -n "s/^RSYNC_USER=//p" $F); M=$(sed -n "s/^RSYNC_MODULE=//p" $F) PWF=$(mktemp /run/rsync-pw.XXXXXX); sed -n "s/^RSYNC_PASSWORD=//p" $F > $PWF IP=$(hostname -I | cut -d" " -f1) mkdir -p /run/demo && echo "hello from sac" > /run/demo/report.txt rsync -a --password-file=$PWF /run/demo/ "rsync://$U@$IP/$M/demo/" && echo "push -> ok" echo "list -> $(rsync --password-file=$PWF "rsync://$U@$IP/$M/demo/" | awk "{print \$NF}" | tr "\n" " ")" rm -f /run/demo/report.txt; rsync -a --password-file=$PWF "rsync://$U@$IP/$M/demo/report.txt" /run/demo/ && echo "pull -> $(cat /run/demo/report.txt)" rm -f /run/demo/report.txt; rsync -a --delete --password-file=$PWF /run/demo/ "rsync://$U@$IP/$M/demo/" && echo "delete -> $(rsync --password-file=$PWF "rsync://$U@$IP/$M/demo/" | awk "{print \$NF}" | tr "\n" " ")" rm -rf /run/demo $PWF /srv/rsync/sac/demo '

push -> ok list -> . report.txt pull -> hello from sac delete -> .

Pushed files land in /srv/rsync/sac, owned by the unprivileged rsyncd account. To place files there over SSH, copy them in and give them to that account (sudo chown -R rsyncd:rsyncd /srv/rsync/sac/<path>).

The image ships an end-to-end check that you can run at any time. First boot runs it too. It reads the credentials file itself and drives the daemon through the instance's private address:

sudo rsyncd-verify.sh

ok anonymous module listing shows no module (rc 0) ok anonymous access refused (auth failed, rc 5) ok user 'anonymous' refused (auth failed, rc 5) ok wrong password refused (auth failed, rc 5) ok push sac-verify-<pid>/data.bin (256 KiB) ok module listing (authenticated) shows the upload ok pull byte-identical ok file stored in /srv/rsync/sac owned by rsyncd ok pull ../../etc/passwd refused (rc 23) ok pull /etc/shadow (absolute) refused (rc 23) ok push to ../../ stays inside the module ok symlink to /etc/shadow cannot be followed out of the module (rc 23) ok device file not created ok --write-devices refused (rc 4) ok live transfer runs as rsyncd (<process counts>) ok the only root process in rsync.service is the listener (pid <pid>) ok delete over rsync (--delete) ok test directory gone from /srv/rsync/sac RSYNCD_ROUNDTRIP_OK target <private-ip>

The check takes about half a minute and leaves the module as it found it.

An anonymous client sees no modules and cannot log in:

IP=$(hostname -I | cut -d" " -f1); echo "listing: [$(rsync rsync://$IP/)]" (setsid -w rsync "rsync://$IP/sac/" </dev/null 2>&1 || true) | grep -o '@ERROR.*'

listing: [] @ERROR: auth failed on module sac

The configuration jails every transfer, maps it to the rsyncd account, hides the module and refuses device files:

grep -vE '^[[:space:]]*(#|$)' /etc/rsyncd.conf

pid file = /run/rsyncd/rsyncd.pid lock file = /run/rsyncd/rsyncd.lock port = 873 use chroot = yes numeric ids = yes uid = rsyncd gid = rsyncd max connections = 10 timeout = 600 reverse lookup = no forward lookup = no proxy protocol = no syslog facility = daemon syslog tag = rsyncd transfer logging = yes refuse options = devices specials copy-devices write-devices [sac] comment = sac rsync module (per-instance password, chrooted) path = /srv/rsync/sac read only = no write only = no list = no auth users = sac secrets file = /etc/rsyncd.secrets strict modes = yes

The rsync daemon's challenge-response needs the password on the server, so it is kept in /etc/rsyncd.secrets, readable by root only, beside the credentials file:

sudo stat -c '%a %U:%G %n' /etc/rsyncd.conf /etc/rsyncd.secrets /root/rsync-credentials.txt /srv/rsync /srv/rsync/sac

644 root:root /etc/rsyncd.conf 600 root:root /etc/rsyncd.secrets 600 root:root /root/rsync-credentials.txt 755 root:root /srv/rsync 750 rsyncd:rsyncd /srv/rsync/sac

The daemon runs the upstream build in a sandbox that can write only to the data volume, with five capabilities, and cannot reach the instance metadata service:

systemctl show rsync -p ExecStart -p ProtectSystem -p ReadWritePaths -p NoNewPrivileges -p IPAddressDeny -p CapabilityBoundingSet | cut -c1-120

ExecStart={ path=/usr/local/bin/rsync ; argv[]=/usr/local/bin/rsync --daemon --no-detach --config=/etc/rsyncd.conf ; ign IPAddressDeny=168.63.129.16/32 fd00:ec2::254/128 169.254.169.254/32 CapabilityBoundingSet=cap_dac_read_search cap_setgid cap_setuid cap_net_bind_service cap_sys_chroot ReadWritePaths=/srv/rsync ProtectSystem=strict NoNewPrivileges=yes

No per instance password reached a log, the journal, shell history, backups, the data volume or any file in /etc other than the secrets file:

sudo rsyncd-secret-leak-check.sh

LEAKCHECK_OK no per-instance password in the journal, auth.log, syslog, cloud-init, shell history, MOTD, /var/backups, /etc (outside the 0600 secrets file), /srv/rsync or /tmp

The daemon logs the address each client really connected from (never a DNS name or a header the client sends), including refused logins:

sudo journalctl -u rsync --no-pager -o cat | grep -E '^connect from|allowed access|auth failed' | tail -n 3

connect from UNDETERMINED (<client-ip>) rsync allowed access on module sac from UNDETERMINED (<client-ip>) auth failed on module sac from UNDETERMINED (<client-ip>) for <user>: <reason>

New password. rsyncd-passwd generates a new 32 character password (shown once) or reads one you choose from standard input, and updates /etc/rsyncd.secrets and /root/rsync-credentials.txt. The daemon reads the secrets file for every new connection, so no restart is needed:

sudo rsyncd-passwd read -rs PW && printf '%s\n' "$PW" | sudo rsyncd-passwd --password-stdin; unset PW

More users or modules. Add a user:password line to /etc/rsyncd.secrets and the user to the module's auth users (comma separated), or add another [name] block with its own path under /srv/rsync (create the directory owned by rsyncd:rsyncd, mode 0750). Every module must keep auth users and secrets file. To make a module append only (clients cannot delete), add delete to its refuse options. To filter clients inside the daemon as well as in the security group, add hosts allow = <your-cidr> under the module. Changes apply to the next connection.

The daemon protocol is cleartext, so the safest setup keeps TCP 873 closed in the security group and reaches the daemon through SSH. The per-instance password still protects the module, and everything travels inside the SSH connection. On your client, run:

ssh -i <your-key.pem> -N -L 8873:127.0.0.1:873 ubuntu@<RSYNC_HOST> & rsync -av --password-file=$HOME/.rsync-sac.pw ./projects/ rsync://sac@127.0.0.1:8873/sac/projects/

Alternatively, use rsync over SSH directly as the ubuntu user, with no daemon involved. To write into the module directory, run the remote side with sudo:

rsync -av -e "ssh -i <your-key.pem>" --rsync-path="sudo rsync" ./projects/ ubuntu@<RSYNC_HOST>:/srv/rsync/sac/projects/

If clients must connect to TCP 873 directly, allow it only from their addresses in the security group, and from inside your VPC wherever possible.

The daemon serves at most 10 connections at a time (max connections) and drops a connection that is idle for 10 minutes (timeout = 600). For many simultaneous clients, raise these limits in /etc/rsyncd.conf. The change applies to the next connection.

/srv/rsync is its own EBS volume, mounted by file system UUID with nodev,nosuid,noexec, so synced files can never be run as programs:

findmnt -no SOURCE,FSTYPE,OPTIONS /srv/rsync df -h --output=size,used,avail,target /srv/rsync

/dev/nvme1n1 ext4 rw,nosuid,nodev,noexec,relatime Size Used Avail Mounted on 20G 28K 19G /srv/rsync

To grow it, increase the volume's size in the EC2 console (Volumes > Modify volume), wait until the modification reaches the optimizing state, then grow the file system online (the next boot does it too):

sudo rsyncd-prepare

Back it up with EBS snapshots or AWS Backup; a snapshot of the data volume holds every synced file.

The operating system updates through apt, and unattended security upgrades are on. rsync itself is the source build described in the overview, so apt does not touch it, and Ubuntu's rsync package cannot be installed over it. The version and where it came from:

rsync --version | sed -n 1p cat /usr/local/share/doc/rsync/SOURCE.txt apt-cache policy rsync | sed -n 1,3p

rsync version 3.5.1 protocol version 33 This rsync 3.5.1 was built by sac from the upstream release tarball https://download.samba.org/pub/rsync/src/rsync-3.5.1.tar.gz, whose SHA-256 checksum c55f9c9dc10fb8bec397b399a0fdded53cc9a2d8e30891bb0d63724d25c37bef and OpenPGP signature by Andrew Tridgell's release key 9FEF112DCE19A0DC7E882CB81BB24997A8535F6F (signed 2026-09-21) were both verified before the build, configured with: --prefix=/usr/local --with-rsyncd-conf=/etc/rsyncd.conf --disable-md2man --disable-idn. It replaces Ubuntu's rsync package (3.2.7-1ubuntu1.5, which lacks the rsync 3.5.0 security fixes); that package is removed and pinned so apt can never reinstall it, which also means apt and unattended-upgrades do NOT update rsync. sac publishes a new image version for every upstream rsync security release (upstream releases and announcements: https://download.samba.org/pub/rsync/ and https://github.com/RsyncProject/rsync/releases); update by launching the new image version, or rebuild from the steps in the user guide. rsync is free software under the GNU General Public License version 3 or later with an OpenSSL/xxhash linking exception; the licence text is in /usr/local/share/doc/rsync/COPYING and the release notes in /usr/local/share/doc/rsync/NEWS.md. rsync: Installed: (none) Candidate: (none)

ubuntu-standard, the only package that depended on Ubuntu's rsync, was removed with it. Everything it had installed was kept as manually installed and is listed in /usr/local/share/doc/rsync/ubuntu-standard-deps.txt; apt refuses to reinstall the metapackage because of the rsync pin:

grep -vc '^#' /usr/local/share/doc/rsync/ubuntu-standard-deps.txt apt-get -s install ubuntu-standard >/dev/null 2>&1 || echo "apt refuses ubuntu-standard (it needs Ubuntu's rsync, which is pinned out)"

50 apt refuses ubuntu-standard (it needs Ubuntu's rsync, which is pinned out)

When an rsync release fixes a security issue, SecureAnyCloud adds a new image version to this listing. To move to it:

• Launch the new version next to the old instance.
• Stop the daemon on the old instance (sudo systemctl stop rsync), take a snapshot of its data volume, and create a volume from that snapshot in the new instance's Availability Zone.
• On the new instance stop the daemon, attach the volume, and copy the module directory into /srv/rsync (keeping the rsyncd:rsyncd owner), or mount the volume in place of the new one by its UUID in /etc/fstab. Copy any users you added to /etc/rsyncd.secrets (mode 0600) and start the daemon.

Rebuild rsync yourself. To apply a newer upstream release on a running instance, build it the same way the image did, on a temporary directory in /run: download rsync-<version>.tar.gz and its .asc from https://download.samba.org/pub/rsync/src/, verify the signature with gpg --verify against Andrew Tridgell's key (9FEF112DCE19A0DC7E882CB81BB24997A8535F6F), install the build tools (sudo apt-get install gcc make libssl-dev libxxhash-dev libzstd-dev liblz4-dev libpopt-dev libacl1-dev libattr1-dev), run ./configure --prefix=/usr/local --with-rsyncd-conf=/etc/rsyncd.conf --disable-md2man --disable-idn && make, copy the new rsync binary over /usr/local/bin/rsync, run sudo systemctl restart rsync, and remove the build tools again.

Component Version Path

rsync (daemon and client) 3.5.1 (upstream source build, protocol 33) /usr/local/bin/rsync (/usr/bin/rsync links to it)

OpenSSL, xxhash, zstd, lz4, popt, libacl Ubuntu 24.04, updated by apt system libraries

Ubuntu 24.04 LTS

Path Purpose

/etc/rsyncd.conf Daemon configuration (re-read for every connection)

/etc/rsyncd.secrets Module users and passwords (mode 0600)

/srv/rsync/sac The SecureAnyCloud module on the data volume

/root/rsync-credentials.txt Host, user, password and module (mode 0600)

/usr/local/share/doc/rsync/ Licence, release notes and SOURCE.txt

/etc/apt/preferences.d/sac-no-distro-rsync Keeps Ubuntu's rsync package (and so ubuntu-standard) from being installed

/usr/local/share/doc/rsync/ubuntu-standard-deps.txt The packages ubuntu-standard had pulled in, all kept installed

/usr/local/sbin/rsyncd-* Password, check, health check, leak check and volume tools

Logs go to the journal: journalctl -u rsync.