Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I encrypt the rsync connection using TLS? I don't have SSH access on the server and can't set up any services so stunnel is not an option, right? My provider simply to me to "Use a TLS tunnel".

share|improve this question
I got back to the support and now I know it is possible to open a SSH tunnel (but not log in whit SSH so I have to use the rsync protocol thought the SSH tunnel). Complicated but it works. – Den Jul 27 '12 at 3:37

What kind of access do you have to the server?

Assuming that there is some way to execute commands, you don't need to set up a service for stunnel, but can simply start that from the command line. It makes me wonder how secure that command-executiong access is, though, if it is not ssh. Having TLS-secured rsync is of little use if anyone can hack into the mashine using rsh, telnet or similar.

share|improve this answer
The rsync protocol is often used over bare TCP, with rsyncd running on the server side. However, since it only supports plain-text authentication, it is usually limited to read-only mirroring. – grawity Jul 9 '12 at 18:44
@grawity: When using rsync over TCP, someone has to start that server. If the system is configured to run that as a daemon, and not provide command line access either, then the OP is out of luck. Otherwise even a service started in this way could be wrapped into an stunnel. Forcing the use of the tunnel, i.e. preventing users from directly connecting the rsync server, might be more difficult unless the server or firewall configuration is under the OP's control. – MvG Jul 9 '12 at 18:59
I can't execute any thing on the server. I just have access over bare TCP (as grawity mentioned), FTP, WebDAV and a Website. – Den Jul 11 '12 at 3:35
I take it that you upload the website via FTP, and that the server has some scripting capabilities? If they don't restrict your scripts to a set of safe commands then you could probably start stunnel from a CGI script: Check a password, and if it is correct, start stunnel, tell the user to go a head, and provide him with a link to another CGI where he can stop stunnel again. – MvG Jul 11 '12 at 5:24
Nice idea but it is only a online storage. I guess I have to go back to the support and hope to get more info this time (they like to answer emails whit one word: done ;-)) – Den Jul 12 '12 at 3:13

have a look at RsyncSSL ( see thread at ) - but if you don`t have access on the server side, you are completely out of luck. i would ask the provider how setting up tls should work without access to that box

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .