Can Synology Hyper Backup back up to a rented rsync server?

Should I use SSH mode or rsync daemon mode?

Use remote shell mode over SSH. Synology's Knowledge Center lists port 22 for rsync with transfer encryption and port 873 for rsync without it. The rsync manual adds that the daemon protocol authenticates but does not encrypt the data stream.

Keep daemon mode for a private link, such as a WireGuard tunnel between the NAS and the server.

How do I set up the Linux server for SSH mode?

Hyper Backup's rsync dialog takes an account name and a password, so the backup account needs a password login over SSH. On a Basalthold server delivered with your SSH key, password logins are off for every account. The Match block below turns them on for one account only.

# Password login for the Hyper Backup account only
Match User hyperbackup
    PasswordAuthentication yes
    AllowTcpForwarding no
    X11Forwarding no
    PermitTTY no

How do I set up an rsync daemon module instead?

Daemon mode suits a NAS that reaches the server through a VPN. The rsync manual says every module is read only by default, so set read only = false. The secrets file holds name:password pairs and must not be readable by others.

uid = hyperbackup
gid = hyperbackup
use chroot = yes

[nas1]
    path = /tank/hyperbackup
    read only = false
    auth users = nas1
    secrets file = /etc/rsyncd.secrets
    hosts allow = 10.8.0.2

# /etc/rsyncd.secrets (chmod 600) contains one line:  nas1:<long random password>
# Debian: systemctl enable --now rsync

Multi-version or single version on the server?

Choose multi-version. Synology stores it as .hbk files and offers client-side encryption, compression and rotation, including Smart Recycle. Single version mirrors your folders as plain files and overwrites the older copy at every run.

A single-version copy of files that ransomware just encrypted is a second copy of the damage.

Synology's DSM 7.4 specification says client-side and transfer encryption use AES-256 and ECC Curve25519. Hyper Backup Explorer, the desktop app, can open those encrypted files. Store the password and key away from the NAS; Synology warns that losing them means losing the data. More on keys: client-side encryption for backups.

How do I stop a hacked NAS from deleting the offsite versions?

Hyper Backup's rotation runs from the NAS, with the NAS's password. Whoever controls the NAS can therefore remove versions on the server too. Synology's own note: Hyper Backup does not support its WriteOnce feature.

Protect the copy on the server side instead. Put /tank/hyperbackup on its own ZFS dataset, and let root snapshot it every night. ZFS snapshots are read-only, and the hyperbackup account has no right to destroy them. The full method is on immutable backups on your own server.

# /etc/cron.d/hyperbackup-snap
30 4 * * * root /usr/sbin/zfs snapshot tank/hyperbackup@$(date +\%F)

Which server size fits, and how fast is it ready?

Size the server for your NAS's used space plus the versions you keep. Hold 24 mirrors 2 × 12 TB HDD for 12 TB usable. Hold 40 has 4 × 10 TB HDD: 20 TB in RAIDZ2. The first run sends everything; at 100 Mbit/s of home upload, that is 1.08 TB a day, by calculation.

Of 23 storage-server sellers Basalthold checked on 2 November 2026, the median stated setup time was 24 hours, within 10 minutes to 10 business days. Ours is slower than that median: 72 hours at the most after your payment is confirmed. Prices for every term are on the hold price list. The other NAS brands are covered in the best offsite backup for a NAS.