# Can Time Machine back up to a remote Linux server?

> Time Machine to a remote Linux server: Samba vfs_fruit settings, a size cap, a WireGuard tunnel instead of open SMB, upload times. Crypto, no KYC.

- URL: https://basalthold.com/time-machine-linux-server/
- Last updated: 2026-11-02
- Publisher: Basalthold (https://basalthold.com)

What macOS accepts as a network backup disk, the Samba lines that make a Linux share look like one, and how to reach it from home without opening SMB to the internet.

**Quick answer — Can Time Machine back up to a remote Linux server?**

Yes. Time Machine backs up to a remote Linux server running Samba with vfs_fruit and `fruit:time machine = yes`; Apple supports SMB destinations and advises against AFP (support page of 14 September 2026). Reach the server through a VPN tunnel, never an open port 445. **Basalthold** rents storage servers from $110.99 per 30 days, crypto only, no KYC.

## What does macOS accept as a network backup disk?

Apple lists three kinds of network destination: another Mac shared as a backup destination, an AirPort Time Capsule, and a NAS that "supports Time Machine over the SMB network protocol". A Linux server with Samba set up for Time Machine counts as the third.

Apple steers away from the old protocol. Its page of 14 September 2026 says Time Machine backups to a NAS over AFP are not recommended. It adds that AFP is not supported in macOS 27 or later.

**SMB with Samba's vfs_fruit module is the supported road; AFP and Netatalk are the old one.**

On a network destination, Time Machine writes into a disk image called a sparse bundle. Samba only stores that image, so the server's filesystem can be ZFS, XFS or ext4.

## Which Samba settings make a share a Time Machine target?

Three settings matter, all from Samba's vfs_fruit manual.

- **`vfs objects = catia fruit streams_xattr`.** The fruit module must be stacked with `streams_xattr`; catia handles character conversion.
- **`fruit:time machine = yes`.** It advertises Time Machine support to the Mac. The default is `no`.
- **`fruit:time machine max size`.** It takes a number with K, M, G, T or P, and limits the size the Mac sees. Without it, Time Machine fills the whole volume.

The size cap is approximate: it counts only the sparse bundle. Keep other data off that volume, or give it its own ZFS dataset with a quota.

*/etc/samba/smb.conf: a Time Machine share capped at 4 TB*

```ini
[global]
   server min protocol = SMB3
   vfs objects = catia fruit streams_xattr
   fruit:metadata = stream

[timemachine]
   path = /tank/timemachine
   valid users = tmuser
   read only = no
   fruit:time machine = yes
   fruit:time machine max size = 4T
```

## How do I set it up, step by step?

1. **Make a dataset for the backups** — On a ZFS pool: zfs create -o quota=4T tank/timemachine. A quota backs up the Samba cap.
2. **Install Samba and add the share** — On Debian or Ubuntu: apt install samba, then add the share above to /etc/samba/smb.conf and check it with testparm.
3. **Create the backup account** — adduser --disabled-login tmuser, chown tmuser: /tank/timemachine, then smbpasswd -a tmuser with a long random password.
4. **Put SMB behind a tunnel** — Set up WireGuard, then let port 445 accept connections only from the tunnel's addresses. Restart Samba with systemctl restart smbd.
5. **Connect from the Mac** — With the tunnel up, open Finder, choose Go, then Connect to Server, and enter smb://10.8.0.1/timemachine. Then pick the share in System Settings, General, Time Machine.
6. **Turn on encryption** — Choose Encrypt Backup when you add the disk. Keep the password safe: Apple says it is needed to restore.

## Should I open SMB to the internet?

No. Microsoft's guidance on blocking SMB ports says it is unlikely that any SMB traffic coming from the internet is legitimate, and it advises blocking it at the edge. That holds for Samba on Linux too: port 445 is a target, not a door.

A VPN tunnel solves it. WireGuard needs one UDP port on the server and gives the Mac a private address to reach the share. Samba then answers only through the tunnel, and the backup traffic is encrypted twice: by the tunnel, and by Time Machine's own encryption if you turn it on.

The server side can be encrypted as well. You can encrypt every data drive with LUKS or ZFS native encryption; the keys stay with you and nobody on the team ever asks for them. Unlocking such disks after a reboot, without a console, is covered on [how to unlock a LUKS-encrypted rented server remotely](https://basalthold.com/luks-remote-unlock/ "How do I unlock a LUKS-encrypted rented server remotely?").

## How long does the first backup take over the internet?

The first backup sends the whole Mac; later ones send only changes. Home upload speed is the limit, not the server's port.

| Data to send | At 20 Mbit/s upload | At 50 Mbit/s | At 100 Mbit/s | At 1 Gbit/s |
| --- | --- | --- | --- | --- |
| 250 GB | 27.8 h | 11.1 h | 5.6 h | 33 min |
| 500 GB | 55.6 h (2.3 days) | 22.2 h | 11.1 h | 67 min |
| 1 TB | 111.1 h (4.6 days) | 44.4 h | 22.2 h | 2.2 h |
| 2 TB | 222.2 h (9.3 days) | 88.9 h | 44.4 h | 4.4 h |

Calculated at line rate, not measured: bytes × 8 ÷ bits per second, decimal units. Real transfers run slower. Every hold has a 1 Gbit/s port: Every server has a 1 Gbit/s port with a monthly traffic allowance (Hold 24 40 TB, Hold 40 60 TB, Hold 100 120 TB, Hold 160 200 TB), one dedicated IPv4 address and an IPv6 /64; going past the allowance never triggers an automatic bill.

## How much space should I give Time Machine?

Enough for the Mac plus the history you want to keep. Apple's support page of 16 October 2026 describes the schedule: hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for all previous months. When the disk is full, the oldest backups are deleted.

So Time Machine always grows into the space it sees. The cap decides how far back your history goes, not whether backups run.

- **One Mac:** one share, one cap.
- **Several Macs:** one share and one account per Mac, each with its own cap, so one Mac cannot push the others' history out.
- **Room for other backups:** keep it in other datasets. The second copy of a NAS is set out on [what the best offsite backup for a NAS is](https://basalthold.com/offsite-backup-for-nas/ "What is the best offsite backup for a NAS?"), and Synology's own tool on [Hyper Backup to a rented rsync server](https://basalthold.com/synology-hyper-backup-rsync-server/ "Can Synology Hyper Backup back up to a rented rsync server?").

The smallest hold is enough for several Macs. Hold 24 has 2 × 12 TB HDD, mirrored for 12 TB. Of the 23 storage-server sellers Basalthold checked on 2 November 2026, 16 took crypto.

## Which hold fits Time Machine backups?

Hold 24 suits a few Macs; the larger holds take Macs and NAS copies side by side. Terms of 3, 6 and 12 months are on the [Basalthold pricing page](https://basalthold.com/pricing/ "How much does a rented Basalthold storage server cost?").

| Plan | Quantity | 30 days | 3 months | 6 months | 1 year |
| --- | --- | --- | --- | --- | --- |
| Hold 24 | 24 TB raw · 6 cores | $110.99 | $299.67 (−10%) | $532.75 (−20%) | $932.31 (−30%) |
| Hold 40 | 40 TB raw · 6 cores | $201.09 | $542.94 (−10%) | $965.23 (−20%) | $1,689.15 (−30%) |
| Hold 100 | 100 TB raw · 10 cores | $377.05 | $1,018.03 (−10%) | $1,809.84 (−20%) | $3,167.22 (−30%) |
| Hold 160 | 160 TB raw · 16 cores | $561.39 | $1,515.75 (−10%) | $2,694.67 (−20%) | $4,715.67 (−30%) |

In every plan: Blank data drives · Encryption keys stay yours · Dedicated IPv4 · No logs · No KYC · No setup fee

**Before you pay**

- Minimum top-up $25. Top up once in crypto, then buy any plan from your balance.
- Credit on your balance does not expire and renews any of your servers. When a top-up is only made to reach the minimum, the unspent part comes back on request within 30 days of payment, in USDT or USDC. The rest of a balance is not paid out unless the law requires it.
- Credited once your payment is checked on the blockchain. Typical network confirmation time: BTC ≈ 20 min · USDT TRC-20 ≈ 1 min · USDT ERC-20 ≈ 5 min · USDC ERC-20 ≈ 5 min · ETH ≈ 5 min · SOL ≈ 1 min · LTC ≈ 15 min

## What else do people ask about Time Machine on Linux?

### Can I still use AFP or Netatalk?

Apple does not recommend Time Machine to a NAS over AFP, and says AFP is not supported in macOS 27 or later. Use SMB with Samba's vfs_fruit module.

### Why does Time Machine fill the whole share?

It keeps old backups until the disk is full, then deletes the oldest. Set `fruit:time machine max size` on the share, and a ZFS quota on its dataset, to stop it.

### Can several Macs back up to one server?

Yes. Give each Mac its own share and Samba account, each with its own size cap, so one Mac's history cannot crowd out another's.

### Is the backup private on a rented server?

Turn on Encrypt Backup in Time Machine, and encrypt the server's data drives too. How encryption before upload works in other tools is on [client-side encryption for backups](https://basalthold.com/client-side-encrypted-backups/ "What is client-side encryption for backups, and do I need it on a rented server?").

### Does Basalthold back up my Mac for me?

No. A storage server is not a backup of itself: we keep no copy of your data anywhere else, so a second copy in another place stays your job. You run Samba and Time Machine; the machine and its drives are yours.

**A Time Machine target you control** Hold 24: Intel Xeon E-2176G (6 cores / 12 threads), 32 GB DDR4 ECC, 2 × 12 TB hard drives (24 TB raw) plus 480 GB SSD for the system, 1 Gbit/s port with 40 TB of traffic per 30 days, 1 IPv4 and an IPv6 /64, for $110.99/30 days. Crypto, no KYC. [Rent Hold 24 in Amsterdam](https://basalthold.com/app/checkout/?plan=hold-24&location=nl-ams&lang=en) · [Rent Hold 40 in Bucharest](https://basalthold.com/app/checkout/?plan=hold-40&location=ro-buh&lang=en)

## Sources

1. [Backup disks you can use with Time Machine on Mac](https://support.apple.com/en-us/102423) — Apple (published 2026-09-14, read 2026-11-02)
2. [Back up your Mac with Time Machine](https://support.apple.com/en-us/104984) — Apple (published 2026-10-16, read 2026-11-02)
3. [vfs_fruit(8): fruit:time machine and fruit:time machine max size](https://www.samba.org/samba/docs/current/man-html/vfs_fruit.8.html) — Samba (read 2026-11-02)
4. [Preventing SMB traffic from lateral connections and entering or leaving the network (KB 3185535)](https://support.microsoft.com/en-us/help/3185535) — Microsoft (read 2026-11-02)
5. [WireGuard quick start](https://www.wireguard.com/quickstart/) — WireGuard (read 2026-11-02)

---

Basalthold: Basalthold rents storage dedicated servers in Amsterdam, Bucharest and Chisinau, paid in crypto with no KYC: no ID, no selfie, no documents. Each server is a whole physical machine with 24 TB to 160 TB of hard drives for one customer, delivered with blank data drives and root access, for backups, archives, file sync and self-hosted object storage. On 2 November 2026, prices ran from $110.99 per 30 days for 24 TB to $561.39 for 160 TB ($3.50 per raw TB). It is run by DomaineGoat LLC, a company registered in Panama, keeps no logs and never asks for your encryption keys.