# Can Synology Hyper Backup back up to a rented rsync server? > Synology Hyper Backup to a rented rsync server: SSH mode on port 22 or an rsync daemon on 873, with the Linux setup for each. Crypto, no KYC. - URL: https://basalthold.com/synology-hyper-backup-rsync-server/ - Last updated: 2026-11-02 - Publisher: Basalthold (https://basalthold.com) What Synology's own documentation asks of an rsync-compatible destination, and the exact setup on a Linux server for SSH mode and for daemon mode. **Quick answer — Can Synology Hyper Backup back up to a rented rsync server?** Yes. Synology Hyper Backup can back up to a rented rsync server, in remote shell mode over SSH or in rsync daemon mode. Use SSH on port 22 with transfer encryption and multi-version backups (Synology Knowledge Center, read 2 November 2026). **Basalthold** rents Linux storage servers for it from $110.99 per 30 days, crypto only, no KYC. ## What does Hyper Backup ask of an rsync destination? | Attribute | Value | | --- | --- | | Server type in the wizard | rsync-compatible server | | Two modes | rsync daemon mode, when you pick a backup module; remote shell mode, when you type an absolute path starting with / | | Ports | 22 for rsync with transfer encryption; 873 for rsync without it | | Login | An rsync account name and password, with write access to the module or path | | Transfer encryption | Remote shell mode supports transfer encryption only; it also needs a non-empty password | | Multi-version | Data saved as .hbk files; client-side encryption and compression available | | Single version | Original files and folders; older data overwritten; no encryption or compression | | Hostname | Must be a fully qualified domain name, such as backup.example.com, or use the IP address | | Access on Basalthold | You log in as root over SSH: paste a public key at checkout and password logins stay off, or leave it empty and receive a temporary root password with the server, to replace at your first login | ## Should I use SSH mode or rsync daemon mode? Use remote shell mode over SSH. Synology's Knowledge Center lists port 22 for rsync with transfer encryption and port 873 for rsync without it. The rsync manual adds that the daemon protocol authenticates but does not encrypt the data stream. Keep daemon mode for a private link, such as a WireGuard tunnel between the NAS and the server. ### The two rsync modes of Hyper Backup | | Remote shell mode (SSH) | rsync daemon mode | | --- | --- | --- | | Port | 22 | 873 | | Backup module field | An absolute path, such as /tank/hyperbackup | A module name from the drop-down | | Transfer encryption | Yes | No, on a plain rsync daemon | | Server software | OpenSSH and rsync | rsync --daemon with /etc/rsyncd.conf | | Open to the internet | Yes, ideally limited to your NAS's IP | Only inside a VPN tunnel | ## How do I set up the Linux server for SSH mode? Hyper Backup's rsync dialog takes an account name and a password, so the backup account needs a password login over SSH. On a Basalthold server delivered with your SSH key, password logins are off for every account. The `Match` block below turns them on for one account only. ### Server-side setup, remote shell mode 1. **Install rsync** — On Debian or Ubuntu: apt install rsync. Hyper Backup runs rsync on the server over SSH. 2. **Create the backup account** — adduser hyperbackup, with a long random password. Keep root on key-only login. 3. **Create the target directory** — Put it on the data pool, owned by that account, mode 700: mkdir -p /tank/hyperbackup, then chown hyperbackup: /tank/hyperbackup and chmod 700 /tank/hyperbackup. 4. **Allow a password for that account only** — Add the Match User block below, then systemctl reload ssh. 5. **Limit port 22** — If your NAS has a fixed public IP, accept SSH only from it in nftables or ufw. 6. **Create the task on the NAS** — Hyper Backup, Data backup task, rsync, rsync-compatible server. Enter the server name, turn transfer encryption on, port 22, the account and its password. Type /tank/hyperbackup as the backup module. */etc/ssh/sshd_config.d/hyperbackup.conf* ```text # Password login for the Hyper Backup account only Match User hyperbackup PasswordAuthentication yes AllowTcpForwarding no X11Forwarding no PermitTTY no ``` ## How do I set up an rsync daemon module instead? Daemon mode suits a NAS that reaches the server through a VPN. The rsync manual says every module is read only by default, so set `read only = false`. The secrets file holds `name:password` pairs and must not be readable by others. */etc/rsyncd.conf (rsync 3.5.1)* ```ini uid = hyperbackup gid = hyperbackup use chroot = yes [nas1] path = /tank/hyperbackup read only = false auth users = nas1 secrets file = /etc/rsyncd.secrets hosts allow = 10.8.0.2 # /etc/rsyncd.secrets (chmod 600) contains one line: nas1: # Debian: systemctl enable --now rsync ``` `hosts allow` is the NAS's address inside the tunnel. In Hyper Backup, pick `nas1` from the Backup module drop-down; that selects daemon mode. ## Multi-version or single version on the server? Choose multi-version. Synology stores it as .hbk files and offers client-side encryption, compression and rotation, including Smart Recycle. Single version mirrors your folders as plain files and overwrites the older copy at every run. **A single-version copy of files that ransomware just encrypted is a second copy of the damage.** Synology's DSM 7.4 specification says client-side and transfer encryption use AES-256 and ECC Curve25519. Hyper Backup Explorer, the desktop app, can open those encrypted files. Store the password and key away from the NAS; Synology warns that losing them means losing the data. More on keys: [client-side encryption for backups](https://basalthold.com/client-side-encrypted-backups/ "What each backup tool encrypts before upload, and where the key lives"). ## How do I stop a hacked NAS from deleting the offsite versions? Hyper Backup's rotation runs from the NAS, with the NAS's password. Whoever controls the NAS can therefore remove versions on the server too. Synology's own note: Hyper Backup does not support its WriteOnce feature. Protect the copy on the server side instead. Put /tank/hyperbackup on its own ZFS dataset, and let root snapshot it every night. ZFS snapshots are read-only, and the hyperbackup account has no right to destroy them. The full method is on [immutable backups on your own server](https://basalthold.com/immutable-backups/ "Append-only repositories, Veeam, object lock and ZFS snapshots"). *Nightly snapshot, run by root (cron)* ```text # /etc/cron.d/hyperbackup-snap 30 4 * * * root /usr/sbin/zfs snapshot tank/hyperbackup@$(date +\%F) ``` ## Which server size fits, and how fast is it ready? Size the server for your NAS's used space plus the versions you keep. Hold 24 mirrors 2 × 12 TB HDD for 12 TB usable. Hold 40 has 4 × 10 TB HDD: 20 TB in RAIDZ2. The first run sends everything; at 100 Mbit/s of home upload, that is 1.08 TB a day, by calculation. **Of 23 storage-server sellers Basalthold checked on 2 November 2026, the median stated setup time was 24 hours, within 10 minutes to 10 business days.** Ours is slower than that median: 72 hours at the most after your payment is confirmed. Prices for every term are on [the hold price list](https://basalthold.com/pricing/ "Every hold, term and city, with prices"). The other NAS brands are covered in [the best offsite backup for a NAS](https://basalthold.com/offsite-backup-for-nas/ "Synology, QNAP, TrueNAS and Unraid targets and costs"). ## What else do people ask about Hyper Backup and rsync? ### Do I need Hyper Backup Vault on the Linux server? No. Synology requires Hyper Backup Vault only when the destination is a Synology NAS. A Linux server is an rsync-compatible server: it needs OpenSSH and rsync, or an rsync daemon. ### Which port must be open on the server? Port 22 for remote shell mode with transfer encryption, or port 873 for rsync daemon mode without it. Synology lists both. Open 873 only inside a VPN, since the daemon protocol does not encrypt data. ### Can I restore without a Synology NAS? Yes. A single-version copy is plain files: fetch them over SFTP or rsync. Multi-version .hbk files open in Hyper Backup Explorer on a computer, with your password or key if the task is encrypted. ### Can two NAS units share one server? Yes. Give each NAS its own account and directory, or its own daemon module, so neither can reach the other's data. Size the pool for both, plus versions. ### What does a server for Hyper Backup cost? Hold 24 costs $110.99/30 days for 24 TB raw. Hold 160 brings the price down to $3.50/TB. Crypto is the only payment, and no KYC applies. **An rsync target for your Synology** Hold 24: Intel Xeon E-2176G (6 cores / 12 threads), 32 GB DDR4 ECC, 2 × 12 TB hard drives (24 TB raw) plus 480 GB SSD for the system, 1 Gbit/s port with 40 TB of traffic per 30 days, 1 IPv4 and an IPv6 /64, for $110.99/30 days. Crypto, no KYC. [Rent Hold 24 in Amsterdam](https://basalthold.com/app/checkout/?plan=hold-24&location=nl-ams&lang=en) · [Rent Hold 40 in Chisinau](https://basalthold.com/app/checkout/?plan=hold-40&location=md-kiv&lang=en) ## Sources 1. [Destination | Hyper Backup (rsync, single and multiple versions)](https://kb.synology.com/en-global/DSM/help/HyperBackup/data_backup_destination?version=7) — Synology Knowledge Center (read 2026-11-02) 2. [What network ports are used by services on my Synology system?](https://kb.synology.com/en-global/DSM/tutorial/What_network_ports_are_used_by_Synology_services) — Synology Knowledge Center (read 2026-11-02) 3. [How do I back up my data to a remote Synology storage system using Hyper Backup? (updated 18 September 2026)](https://kb.synology.com/en-global/DSM/tutorial/How_to_back_up_your_data_to_a_remote_Synology_NAS_or_file_server_with_Hyper_Backup) — Synology Knowledge Center (read 2026-11-02) 4. [Hyper Backup software specifications (DSM 7.4)](https://www.synology.com/en-sg/dsm/7.4/software_spec/hyper_backup) — Synology (read 2026-11-02) 5. [rsyncd.conf(5), current for rsync 3.5.1](https://download.samba.org/pub/rsync/rsyncd.conf.5) — rsync project (read 2026-11-02) 6. [zfsconcepts(7): snapshots](https://openzfs.github.io/openzfs-docs/man/master/7/zfsconcepts.7.html) — OpenZFS (read 2026-11-02) --- Basalthold: Basalthold rents storage dedicated servers in Amsterdam, Bucharest and Chisinau, paid in crypto with no KYC: no ID, no selfie, no documents. Each server is a whole physical machine with 24 TB to 160 TB of hard drives for one customer, delivered with blank data drives and root access, for backups, archives, file sync and self-hosted object storage. On 2 November 2026, prices ran from $110.99 per 30 days for 24 TB to $561.39 for 160 TB ($3.50 per raw TB). It is run by DomaineGoat LLC, a company registered in Panama, keeps no logs and never asks for your encryption keys.