Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wanting to run rsync over an SSL/TLS encrypted connection. It does not do this directly so I am exploring options. The stunnel program looks promising, although more complicated than designed due to the need to hop connections with the -r option. However, I do find there is a -l option to run a program. I am assuming this works by having two processes, one to carry out the SSL/TLS work, and one to be the worker which the client is communicating to. These would then communicate by a pipe pair or two way socket between them.

What struck me as odd when I surveyed a number of web pages to see how to properly set this up is that whether running as a standalone daemon, or under a super daemon like inetd, the arguments for rsync are the same. How does rsync --daemon know whether it should open a socket and listen on it for many connections, or just service one connection by communicating with the stdin/stdout descriptors is has when it starts up (which really would go through the extra process to handle the encryption, description, and SSL/TLS protocol layer)?

And then I need to find a way to wrap the client to have it do SSL/TLS in one simple command (as opposed to connection hopping that stunnel seems to favor).

share|improve this question
up vote 1 down vote accepted

From the section on --daemon in the rsync(1) man page:

If standard input is a socket then rsync will assume that it is being run via inetd, otherwise it will detach from the current terminal and become a background daemon.

You can see the command line arguments that apply to daemon mode by running:

rsync --daemon --help
share|improve this answer
So does this mean rsync won't work under stunnel -l since under that it would get a pipe, instead? – Skaperen Oct 15 '12 at 6:07
Maybe it will handle a pipe like a socket (they are similar). – Skaperen Oct 15 '12 at 14:16

And then I need to find a way to wrap the client to have it do SSL/TLS in one simple command (as opposed to connection hopping that stunnel seems to favor).

rsync has an --rsh option to spawn stunnel and use stdin/stdout on the client side and stunnel has an exec option to spawn rsync on the server side - combining these two will get you what you want. See dozzie's rsync over SSL for some further information and readily available scripts to run this config (needs git to download).

share|improve this answer
If rsync is not getting the network socket, how does it know NOT to do its own network listen accept loop? Or does it do this because stdin is a pipe? – Skaperen Oct 15 '12 at 14:40
@Skaperen Honestly, I don't know and never bothered to look it up in the source. I suppose you are right and the detection is based on something like isatty. – the-wabbit Oct 15 '12 at 20:27
I cannot find the author's email address. Some things are left out and/or not explained. How do run stunnel in inetd-mode as a client (e.g. as an ssh substitute) is missing how to make it connect (not seen in stunnel man pages). – Skaperen Oct 15 '12 at 20:34
I think I need to ask this question in an entirely different way. – Skaperen Oct 15 '12 at 20:35
@Skaperen take a look at the rsync-ssl-package's scripts (as I wrote you would need git to download the code set), a whole lot should become clear then. – the-wabbit Oct 15 '12 at 20:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.