rsyncd.conf(5) User Commands rsyncd.conf(5) (NAME) rsyncd.conf - rsync (SYNOPSIS) rsyncd.conf ( ) : . (DESCRIPTION) rsyncd.conf rsync rsync . rsyncd.conf . (FILE FORMAT) . . name = value . -- . . . . . . (#) . ( .) \ <<>> . ( ) yes/no 0/1 true/false . . RSYNC (LAUNCHING THE RSYNC DAEMON) rsync --daemon rsync . chroot ( ) (root) . . inetd rsync . <> . systemd packaging/systemd . rsync.service rsync --daemon --no-detach rsync.socket rsync@.service . rsync . inetd /etc/services : rsync 873/tcp /etc/inetd.conf: rsync stream tcp nowait root /usr/bin/rsync rsyncd --daemon <> rsync . HUP inetd . rsync HUP rsyncd.conf . . (GLOBAL PARAMETERS) ( [module]) : motd file << >> (MOTD) . . MOTD . --dparam=motdfile=FILE . pid file rsync (PID) . rsync . --dparam=pidfile=FILE . port ( ) . inetd --port . address IP . inetd --address . socket options . ( !) . setsockopt() . . --sockopts . listen backlog (backlog) . . . . %VAR% ( ) rsync RSYNC_USER_NAME . ( true/false) . ( ) . ( %VAR% ). % %% . (MODULE PARAMETERS) . [module] . . . <<[global]>> . <<[global]>> . . . comment . . path . rsyncd.conf . <> chroot -chroot . use chroot false . : path = /var/rsync/./module1 ( chroot ) <> -chroot <> . . rsync . : path = /home/%RSYNC_USER_NAME% -- ( ). ( ) . use chroot <> true rsync <> . ( ). use chroot chroot ( ) . path chroot <> -- true . rsync 3.2.7 <> . <<>> rsync chroot . <> rsyncd.conf chroot . dot-dir <> chdir ( ). chroot ( uid gid) lib ( exclude ). rsync <> lib . daemon chroot rsync chroot chroot chroot . <> ( chroot ) rsync () . ( chroot -chroot ) rsync ( ) (munge) . <> ( ). rsync <<..>> . --backup-dir --compare-dest ( <> ) . chroot <> <> ( ). chroot ( ) numeric ids = false rsync . chroot / ACL ( rsync ) <> ( ). . daemon chroot chroot . ( <>) . chroot ( ) chroot ( <>) . <> // . chroot . proxy protocol V1 V2 . . true IP rsync IP/ IP . false IP . rsync . : rsync . rsync IP . iptables -uid-owner root ( localhost) . . rsync . proxy protocol hosts IP proxy protocol . hosts allow . proxy protocol = true rsync . name converter rsync . chroot ( ) . $PATH . chroot . nameconvert pre-xfer exec . / . support <> . . numeric ids . / . --numeric-ids . chroot -chroot . uid/gid root ( <> ) <> . chroot false <> . munge symlinks rsync --munge-links ( ) : <> . . . rsync <> . chroot . chroot -- <> <> <> chroot chroot -- chroot . : -chroot chroot <> <> chroot . ( <> -chroot <> ) : <<..>> ( ). . <> . <> chroot -chroot <> <> exclude . <> ( ) support <> . insecure links ( <>) (symlink-race) . false () -- (--backup-dir --temp-dir --partial-dir alt- dest ) uid 0 uid . : --insecure-links . <> : . : <> / TOCTOU ( CVE-2026-53797 CVE-2026-53801) : -- -- . . --insecure-links << >> . charset . --iconv <> . chroot chroot . <> --iconv <> <> . --iconv <> <> . rsync . max connections . . 0 . . <> . log file <> rsync syslog . ( AIX) syslog() chroot . chroot() . . syslog . ( .) --log-file=FILE --dparam=logfile=FILE . . . syslog facility facility syslog rsync . syslog facility . auth authpriv cron daemon ftp kern lpr mail news security syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7. daemon . <> ( ) . syslog tag syslog rsync . <> . <> . syslog : syslog tag = rsyncd.%RSYNC_USER_NAME% max verbosity ( ). . --info --debug . info / debug -vv . info/debug rsync --info=help rsync --debug=help . TIME2 FLIST3 max- verbosity 4 . lock file <> . rsync . /var/run/rsyncd.lock . read only . <> true . <> false . . <> . write only . <> true . <> false . . : <> . open noatime True rsync O_NOATIME ( ) (atime) . O_NOATIME rsync . O_NOATIME atime . False O_NOATIME . Unset () --open-noatime . list . false <> <> . <> DNS . . uid (UID) . <> . <> . . <> . RSYNC_USER_NAME rsync . rsync rsync : uid = %RSYNC_USER_NAME% gid = * gid / . . <<*>> gid ( <> ). <> ( <>) . ( ). . . / . daemon uid uid . root . <> . daemon gid gid . root . <> . fake super <> --fake-super . . filter . . ( daemon-excluded) (pull) (push) ( ) . uid/gid . <> <> <> <> <> . . <> <> . . : ( -- <> -- -- <>). <> ( -chroot ) exclude/filter . <> ( <<- /foo - /bar>> ). . <> . --delete . exclude . --exclude <<- >> <<+ >> / . <> . <> . include <> <> . <> . <> . exclude from . <> exclude-from <> . <> . include from <> . <> . <> . incoming chmod chmod ( ) . --perms / . --chmod rsync chmod(1) . outgoing chmod chmod ( ) . . . --chmod rsync chmod(1) . auth users / . . . . <> (challenge). - . <> . ( <>> ). <<@>> . . <<@rsync>> rsync . (:) . (<>) <> () <> (/) . ro/rw <> . . : auth users = joe:deny @guest:deny admin:rw @rsync:ro susan joe sam joe . <> . <> / admin <> ( admin <> ). <> . susan joe sam ro/rw . ( ). : auth users = , joe:deny, @Some Group:deny, admin:rw, @RO Group:ro secrets file . ( ) . <> rsync(1) rsyncd.conf rsync . secrets file username:password / @groupname:password . <> . name:password . (#) . . <<@groupname>> . <> <<@groupname:password>> . : . <> . <> ( /etc/rsyncd.secrets). <> <<>> ( ) root <> . <> . auth digest (digest) - <> . sha512 sha256 sha1 md5 md4. ( md5 md4 ) . . : auth digest = sha256 sha256 sha512 md5 md4 . (auth-digest downgrade) . ( rsync 3.2.0 openrsync macOS) md5 ( md4) . - (offline brute-force) . SECURITY.md rsync . -- . rsync 3.2.0 ( SHA ) openrsync macOS md4/md5 . SHA rsync openssl (fail-closed). . strict modes secrets . <> true () <<>> ( ) secrets . 600 640 644 ( / ) . <> false . rsync . hosts allow / IP . . : o IPv4 a.b.c.d IPv6 a:b:c::d:e:f. IP . o / ipaddr/n ipaddr IP n . IP IP . o / ipaddr/maskaddr ipaddr IP maskaddr IPv4 IPv6 ffff:ffff:ffff:ffff:: /64. IP IP . o . IP ( ) ( ) . <> (). o . DNS IP ( <> ) / IP IP ( <> ) . . o <<@>> netgroup DNS IP netgroup . IPv6 (scope) : fe80::1%link1 fe80::%link1/64 fe80::%link1/ffff:ffff:ffff:ffff:: <> <> . <> . <> . . <> . hosts deny / IP . . <> . <> . reverse lookup IP <> <> <<%h>> . <> . ( ) rsync . . forward lookup hosts allow/deny . DNS IP . ignore errors rsyncd / (I/O) . rsync I/O --delete I/O . . ignore nonreadable rsync . . transfer logging ftp . . <> . log format . (%) . ( <<%-50n %8l %07p>>). . --human-readable . ( <<%''l %'b %f>>). <<%o %h [%a] %m (%u) %f %l>> <> <<%t [%p] >> . ( perl rsync <> rsyncstats .) : o %a IP ( ) o %b o %B ( rwxrwxrwt) o %c ( ) o %C . / rsync (salted) ( ). --checksum . --checksum-choice . o %f ( ) o %G (gid) () <> o %h ( ) o %i o %l o %L << -> SYMLINK>> << => HARDLINK>> <<>> ( SYMLINK HARDLINK ) o %m o %M o %n ( ) o %o <> <> <> ( ) o %p (PID) rsync o %P o %t o %u o %U (uid) () <<%i>> --itemize-changes rsync . rsync . rsync 2.6.4 . timeout / (I/O timeout) . rsync . . . rsync ( ). refuse options rsync rsync . . 3.2.0 <> . . --checksum (-c) : refuse options = c delete --delete . : refuse options = delete-* !delete-during . <<*>> ( ) . : refuse options = * !a !v !compress* <<*>> --dry-run --server --no-iconv --seclude-args . . iconv : refuse options = * no-iconv !a !v ( 3.2.0 ) ( <>) <> <> --archive (-rdlptgoD) ( ). <> rsync archive . <> remove-source-files <> --remove-source-files . ( --delete --delete-during .) delete <> ( delete ) <> : refuse options = * !a !delete !delete-during ... delete --delete-after : refuse options = * !a !delete* delete-after <>: <> <<*>> RSYNC_COMPRESS_LIST=zlib -z . compress --compress-level <> . <> <> <> / <> . <> <> . : o --server: rsync . o --rsh -e: . o --out-format: . rsync --log-format --log-file-format . o --sender: <> . o --dry-run -n: o --seclude-args -s: . o --from0 -0: / --files-from . o --iconv: <> . o --no-iconv: . o --checksum-seed: . o --write-devices: . dont compress : : <<*>> ( --compress ). ( ). CPU . <> . . <> . CPU . --skip-compress rsync(1) . early exec, pre-xfer exec, post-xfer exec / . early exec pre- xfer exec . pre-xfer exec stdout ( ) . . stdout pre-xfer exec stdout/stderr . --no-detach . early exec . lock file max connections . rsync --early-input=FILE stdin . stdin . post-xfer exec . early exec pre-xfer exec . (pre-xfer) (post-xfer) : o RSYNC_MODULE_NAME: . o RSYNC_MODULE_PATH: . o RSYNC_HOST_ADDR: IP . o RSYNC_HOST_NAME: . o RSYNC_USER_NAME: ( ). o RSYNC_PID: . o RSYNC_REQUEST: ( pre-xfer) / . <> . o RSYNC_ARG#: ( pre-xfer) . RSYNC_ARG0 <> RSYNC_ARG1 . <<.>> -- RSYNC_REQUEST . o RSYNC_EXIT_STATUS: ( post-xfer) . 0 -1 rsync . . o RSYNC_RAW_STATUS: ( post-xfer) waitpid(). %VAR% . sh -c '... %RSYNC_USER_NAME% ...' : . touc? /usr/bin/ (glob) -- . rsync : refusing to run shell hook: %VAR% holds a shell metacharacter ' " ` $ \ ; & | < > * ? [ ] # ! ~ { } . -- ! ~ . %RSYNC_*% . path : path = /srv/My Backups %RSYNC_MODULE_PATH% . -- rsync path path = /home/%RSYNC_USER_NAME%. : "$RSYNC_MODULE_PATH" . -- rsync . ( uid/gid ) chroot . : RSYNC_SHELL ( system() ) RSYNC_NO_XFER_EXEC . temp dir rsync . unlinked . --temp-dir rsync . (CONFIG DIRECTIVES) : &include &merge. . . &include / . &merge . &include &merge *.conf *.inc ( ) ( ) . <> <> <> <> : &include /path/rsyncd.d : &include /path/rsyncd.d/bar.conf &include /path/rsyncd.d/baz.conf &include /path/rsyncd.d/foo.conf . &include . &merge ( motd file) include . /etc/rsyncd.conf : port = 873 log file = /var/log/rsync.log pid file = /var/lock/rsync.lock &merge /etc/rsyncd.d &include /etc/rsyncd.d /etc/rsyncd.d/*.inc ( ) /etc/rsyncd.d/*.conf ( ). (SECURITY) rsync . SECURITY.md . . <> ( chroot ) <> . chroot rsync chroot -- . path = /outer/./inner /outer /inner ." . <> <> ( chroot ). <> <> ( <>) ." . <> / <> <
> . <> ." . <> <> (rsync <> ) . MD4/MD5 <> ( auth digest = sha512) AUTHENTICATION STRENGTH ." . . : TLS ( SSL/TLS Daemon Setup ) ssh ." . <> ( ) . <> : ( TOCTOU/ CVE-2026-53797 CVE-2026-53801 ) ." . <> ." (AUTHENTICATION STRENGTH) - . rsync (3.2.7 openssl) -- sha512 -- md5 ( md4) . <> . rsync ssh TLS (rsync- ssl) ( ). rsync . . ssh . rsync SSL SSL/TLS . SSL/TLS (SSL/TLS Daemon Setup) rsync SSL/TLS TCP ( haproxy nginx) . o backend- rsyncd . localhost . o rsync-daemon proxy protocol . . haproxy : frontend fe_rsync-ssl bind :::874 ssl crt /etc/letsencrypt/example.com/combined.pem mode tcp use_backend be_rsync backend be_rsync mode tcp server local-rsync 127.0.0.1:873 check send-proxy nginx : stream { server { listen 874 ssl; listen [::]:874 ssl; ssl_certificate /etc/letsencrypt/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/example.com/privkey.pem; proxy_pass localhost:873; proxy_protocol on; # Requires rsyncd.conf "proxy protocol = true" proxy_timeout 1m; proxy_connect_timeout 5s; } } rsyncd . (DAEMON CONFIG EXAMPLES) rsyncd.conf rsync ftp /home/ftp : [ftp] path = /home/ftp comment = ftp export area : uid = nobody gid = nobody use chroot = yes max connections = 4 syslog facility = local5 pid file = /var/run/rsyncd.pid [ftp] path = /var/ftp/./pub comment = whole ftp area (approx 6.1 GB) [sambaftp] path = /var/ftp/./pub/samba comment = Samba ftp area (approx 300 MB) [rsyncftp] path = /var/ftp/./pub/rsync comment = rsync ftp area (approx 6 MB) [sambawww] path = /public_html/samba comment = Samba WWW pages (approx 240 MB) [cvs] path = /data/cvs comment = CVS repository (requires authentication) auth users = tridge, susan secrets file = /etc/rsyncd.secrets /etc/rsyncd.secrets : tridge:mypass susan:herpass (FILES) /etc/rsyncd.conf rsyncd.conf (SEE ALSO) rsync(1) rsync-ssl(1) (BUGS) ! rsync : . (VERSION) 3.5.0 rsync . (CREDITS) rsync (GNU GPL) . COPYING . rsync : : . (THANKS) Warren Stanley rsync. Karsten Thygesen ! (AUTHOR) rsync Andrew Tridgell Paul Mackerras . . Wayne Davison rsync . : . rsyncd.conf from rsync 3.5.0 13 Aug 2026 rsyncd.conf(5)