Overview
Rsync is an open-source tool for fast, efficient file synchronization and backup — locally or over a network. It only transfers the portions of files that have changed, minimizing bandwidth and time. Rsync supports encryption via SSH and can be automated with cron for scheduled backups.
Target / Context
Linux systems requiring file backup, synchronization between servers, or incremental backup workflows.
Installation
Installation Commands:
sudo apt install rsync -yBasic Usage
Basic Usage:
Backup local directory to remote server:
rsync -av /path/to/source user@backup_server:/path/to/destinationRestore from remote backup:
rsync -av user@remote_host:/path/to/backup /path/to/localFlags & Options
Flags & Options:
| Flag | Description | Example |
|---|---|---|
-a | Archive mode — preserves permissions, timestamps, symlinks, owner, group | rsync -a src/ dst/ |
-v | Verbose — show detailed transfer progress | rsync -av src/ dst/ |
-z | Compress data during transfer | rsync -avz src/ dst/ |
-e ssh | Use SSH as the transport for encryption | rsync -avz -e ssh src/ user@host:/dst/ |
—backup | Create incremental backups of changed files | rsync —backup src/ dst/ |
—backup-dir | Specify directory to store incremental backups | rsync —backup —backup-dir=/backups src/ dst/ |
—delete | Remove files from destination not present in source | rsync —delete src/ dst/ |
Common Use Cases
Backup Local Directory to Remote Server
Commands:
rsync -av /path/to/mydirectory user@backup_server:/path/to/backup/directoryEncrypted Backup Over SSH with Incremental History
Commands:
rsync -avz -e ssh --backup --backup-dir=/path/to/backup/folder --delete /path/to/mydirectory user@backup_server:/path/to/backup/directoryRestore Backup from Remote
Commands:
rsync -av user@remote_host:/path/to/backup/directory /path/to/mydirectoryAutomated Backup with Cron and SSH Keys
SSH key-based authentication is required for unattended backups.
Setup Commands:
ssh-keygen -t rsa -b 2048ssh-copy-id user@backup_serverCreate script RSYNC_Backup.sh:
#!/bin/bash
rsync -avz -e ssh /path/to/mydirectory user@backup_server:/path/to/backup/directorychmod +x RSYNC_Backup.shAdd to crontab (crontab -e):
0 * * * * /path/to/RSYNC_Backup.shPentesting — Footprint and Abuse Rsync
Rsync servers can expose file shares without requiring authentication. When credentials are found during a pentest, always try them against Rsync.
Commands:
Detect Rsync service:
sudo nmap -sV -p 873 <target>Probe for accessible shares (anonymous):
nc -nv 127.0.0.1 873List contents of an open share:
rsync -av --list-only rsync://127.0.0.1/devSync all files from an open share to attack host:
rsync -av rsync://127.0.0.1/devSync via SSH (if server requires it):
rsync -av -e ssh rsync://127.0.0.1/devSync via non-standard SSH port:
rsync -av -e "ssh -p2222" rsync://127.0.0.1/devRelated Concepts
Related Techniques
- Service Enumeration