rsync-ssl(1)

💅 rsync-ssl(1) — bestie's guide to the ssl rsync helper

okay so real talk, this is a User Commands page for rsync-ssl(1), and honestly? it's a little glow-up script that makes your ssl rsync daemon connection work. buckle up, we're getting into it 🎀

---

✨ NAME ✨

rsync-ssl — a helper script for connecting to an ssl rsync daemon

🌸 SYNOPSIS 🌸

rsync-ssl [--type=SSL_TYPE] RSYNC_ARGS

also bestie, the online version of this manpage (that includes cross-linking of topics) is available at https://download.samba.org/pub/rsync/rsync-ssl.1 — iconic of them tbh 💖

🦋 DESCRIPTION 🦋

so the rsync-ssl script helps you run an rsync copy to/from an rsync daemon that requires ssl connections. that's the whole vibe. ✨

the script requires that you specify an rsync-daemon arg in the style of either hostname:: (with 2 colons) or rsync://hostname/. like, it needs that, no cap.

the default port used for connecting is 874 (one higher than the normal 873) unless overridden in the environment. you can specify an overriding port via --port or by including it in the normal spot in the URL format — though both of those require your rsync version to be at least 3.2.0. yes, that's a real constraint, don't @ me 💅

💜 OPTIONS 💜

• --type=SSL_TYPE — if an arg is a --type=SSL_TYPE option, the script will only use that particular program to open an ssl connection instead of trying to find an openssl or stunnel executable via a simple heuristic (assuming that the RSYNC_SSL_TYPE environment variable is not set as well — see below, iykyk 👀). this option must specify one of openssl or stunnel. the equal sign is required for this particular option — fr fr, no space, just =. the wrapper's option scan stops at a -- argument: the -- and everything after it are passed through to rsync unchanged, so a --type=... token after a -- is not consumed by the wrapper. periodt.

all the other options are passed through to the rsync command, so consult the rsync(1) manpage for more information on how it works. 🫶

🌈 ENVIRONMENT VARIABLES 🌈

the ssl helper scripts are affected by the following environment variables — a whole lil squad of them:

RSYNC_SSL_TYPE

specifies the program type that should be used to open the ssl connection. it must be one of openssl or stunnel. the --type=SSL_TYPE option overrides this, when specified. ✨

RSYNC_SSL_PORT

if specified, the value is the port number that is used as the default when the user does not specify a port in their rsync command. when not specified, the default port number is 874. (note that older rsync versions (prior to 3.2.0) did not communicate an overriding port number value to the helper script. 💀)

RSYNC_SSL_CERT

if specified, the value is a filename that contains a certificate to use for the connection.

RSYNC_SSL_KEY

if specified, the value is a filename that contains a key for the provided certificate to use for the connection. 🔑

RSYNC_SSL_CA_CERT

if specified, the value is a filename that contains a certificate authority certificate that is used to validate the connection. when set, the server certificate is verified against this CA and its name is checked against the host you are connecting to (the chain and the identity), for all of the openssl, gnutls, and stunnel backends. set it to an empty string to disable certificate validation entirely (an encrypt-only connection). 👑

RSYNC_SSL_ALLOW_INSECURE_STUNNEL

set to 1 to allow the stunnel backend to run without a CA certificate (and thus with no server-certificate validation at all). without this, stunnel mode refuses to start unless RSYNC_SSL_CA_CERT is set, since an unvalidated TLS connection can be silently man-in-the-middled. 😭 that's a real danger, not a vibe.

RSYNC_SSL_SKIP_HOSTNAME_CHECK

set to 1 to verify the certificate chain but skip the hostname (identity) check, for the openssl and stunnel backends. use this only when the server certificate legitimately cannot match the host you connect to — for example connecting by bare IP address, or to a server whose internal-CA certificate carries a different name. the CA chain is still validated, so this is much narrower than disabling validation with an empty RSYNC_SSL_CA_CERT. 💅

RSYNC_SSL_OPENSSL

specifies the openssl executable to run when the connection type is set to openssl. if unspecified, the $PATH is searched for "openssl". 🦋

RSYNC_SSL_GNUTLS

specifies the gnutls-cli executable to run when the connection type is set to gnutls. if unspecified, the $PATH is searched for "gnutls-cli". 🌸

RSYNC_SSL_STUNNEL

specifies the stunnel executable to run when the connection type is set to stunnel. if unspecified, the $PATH is searched first for "stunnel4" and then for "stunnel". (order matters bestie, first stunnel4 then stunnel 💖)

🎀 EXAMPLES 🎀

these are literally the moment, look:

rsync-ssl -aiv example.com::mod/ dest

rsync-ssl --type=openssl -aiv example.com::mod/ dest

rsync-ssl -aiv --port 9874 example.com::mod/ dest

rsync-ssl -aiv rsync://example.com:9874/mod/ dest

ate. no crumbs. 🔥

👑 THE SERVER SIDE 👑

for help setting up an SSL/TLS supporting rsync, see the instructions in rsyncd.conf. that's where the server-side lore lives 🧚

⭐ SEE ALSO ⭐

rsync(1), rsyncd.conf(5)

💀 CAVEATS 💀

the stunnel backend requires stunnel 4 or newer. it also requires RSYNC_SSL_CA_CERT unless RSYNC_SSL_ALLOW_INSECURE_STUNNEL=1 explicitly opts out of server-certificate validation. 🙈

this script also supports a --type=gnutls option, but at the time of this release the gnutls-cli command was dropping output, making it unusable. if that bug has been fixed in your version, feel free to put gnutls into an exported RSYNC_SSL_TYPE environment variable to make its use the default.

🍓 BUGS 🍓

please report bugs! see the web site at https://rsync.samba.org/. 💖

🦋 VERSION 🦋

this manpage is current for version 3.5.2 of rsync.

🌸 CREDITS 🌸

rsync is distributed under the GNU General Public License. see the file COPYING for details. 📜

a web site is available at https://rsync.samba.org/. the site includes an FAQ-O-Matic which may cover questions unanswered by this manual page. iconic resource tbh ✨

💜 AUTHOR 💜

this manpage was written by Wayne Davison. 👑

mailing lists for support and development are available at https://lists.samba.org/. 🫶

---

and that's the whole page bestie — rsync-ssl from rsync 3.5.2, dated 03 Nov 2026, and it's giving exactly what it needed to give 🌈💅✨