Can Time Machine back up to a remote Linux server?

What does macOS accept as a network backup disk?

Apple lists three kinds of network destination: another Mac shared as a backup destination, an AirPort Time Capsule, and a NAS that "supports Time Machine over the SMB network protocol". A Linux server with Samba set up for Time Machine counts as the third.

Apple steers away from the old protocol. Its page of 14 September 2026 says Time Machine backups to a NAS over AFP are not recommended. It adds that AFP is not supported in macOS 27 or later.

SMB with Samba's vfs_fruit module is the supported road; AFP and Netatalk are the old one.

On a network destination, Time Machine writes into a disk image called a sparse bundle. Samba only stores that image, so the server's filesystem can be ZFS, XFS or ext4.

Which Samba settings make a share a Time Machine target?

Three settings matter, all from Samba's vfs_fruit manual.

• vfs objects = catia fruit streams_xattr. The fruit module must be stacked with streams_xattr; catia handles character conversion.
• fruit:time machine = yes. It advertises Time Machine support to the Mac. The default is no.
• fruit:time machine max size. It takes a number with K, M, G, T or P, and limits the size the Mac sees. Without it, Time Machine fills the whole volume.

The size cap is approximate: it counts only the sparse bundle. Keep other data off that volume, or give it its own ZFS dataset with a quota.

[global]
   server min protocol = SMB3
   vfs objects = catia fruit streams_xattr
   fruit:metadata = stream

[timemachine]
   path = /tank/timemachine
   valid users = tmuser
   read only = no
   fruit:time machine = yes
   fruit:time machine max size = 4T

Should I open SMB to the internet?

No. Microsoft's guidance on blocking SMB ports says it is unlikely that any SMB traffic coming from the internet is legitimate, and it advises blocking it at the edge. That holds for Samba on Linux too: port 445 is a target, not a door.

A VPN tunnel solves it. WireGuard needs one UDP port on the server and gives the Mac a private address to reach the share. Samba then answers only through the tunnel, and the backup traffic is encrypted twice: by the tunnel, and by Time Machine's own encryption if you turn it on.

The server side can be encrypted as well. You can encrypt every data drive with LUKS or ZFS native encryption; the keys stay with you and nobody on the team ever asks for them. Unlocking such disks after a reboot, without a console, is covered on how to unlock a LUKS-encrypted rented server remotely.

How much space should I give Time Machine?

Enough for the Mac plus the history you want to keep. Apple's support page of 16 October 2026 describes the schedule: hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for all previous months. When the disk is full, the oldest backups are deleted.

So Time Machine always grows into the space it sees. The cap decides how far back your history goes, not whether backups run.

• One Mac: one share, one cap.
• Several Macs: one share and one account per Mac, each with its own cap, so one Mac cannot push the others' history out.
• Room for other backups: keep it in other datasets. The second copy of a NAS is set out on what the best offsite backup for a NAS is, and Synology's own tool on Hyper Backup to a rented rsync server.

The smallest hold is enough for several Macs. Hold 24 has 2 × 12 TB HDD, mirrored for 12 TB. Of the 23 storage-server sellers Basalthold checked on 2 November 2026, 16 took crypto.