How to Use rclone with a Storage Box: SFTP, Encryption and Automated Backups

rclone is a practical bridge between a Linux server and remote storage. It understands SFTP directly, can encrypt file contents and names before they leave your machine, and works cleanly in scripts or systemd timers. That makes it useful for website backups, application exports, media archives and off-site copies of important server data.

This guide uses a HYEHOST Storage Box as the remote destination. Every Storage Box receives its own dedicated service subdomain, so separate customer services do not share the same hostname or DNS record. The rclone steps also apply to another correctly configured SFTP endpoint.

Start With a Recoverable Backup Design

A transfer is not automatically a backup. Decide what is being protected, how long copies are kept and what happens when the source is deleted or compromised. A sensible small-server design includes the live data, an encrypted off-site copy and snapshots or versioned copies that stop one bad sync becoming permanent.

Keep the rclone configuration and encryption password in a separate secrets backup. If a Crypt password and its salt are lost, the encrypted remote data cannot be recovered. Do not store the only copy beside the files it protects.

Install rclone on Linux

Distribution packages are convenient but may lag behind current rclone releases. The official installation script installs the current stable build:

curl https://rclone.org/install.sh | sudo bash
rclone version

Review installation scripts before running them as root. If your change policy requires repository packages, use the rclone package supplied by your distribution and confirm that it supports the options below.

Collect the Storage Box Details

From the HYEHOST panel, note the unique service hostname, username, SFTP port and authentication method. Prefer a dedicated SSH key for unattended jobs:

ssh-keygen -t ed25519 -a 64 -f ~/.ssh/hyestore_rclone

Verify the server's SSH host-key fingerprint through a trusted channel. Only after verification should you record it in a dedicated known-hosts file:

install -m 700 -d ~/.ssh
ssh-keyscan -H storage.example.hyestore.host >> ~/.ssh/hyestore_known_hosts
chmod 600 ~/.ssh/hyestore_known_hosts

ssh-keyscan retrieves a key but does not prove who owns it. Compare its fingerprint before trusting the entry.

Configure the rclone SFTP Remote

Use the interactive configurator so passwords and sensitive values are stored in rclone's expected format:

rclone config

Create a remote named hyestore, select sftp, and provide the unique hostname, account, port and key path. Enable host-key validation. The result will resemble:

[hyestore]
type = sftp
host = storage.example.hyestore.host
user = backup-user
port = 22
key_file = /root/.ssh/hyestore_rclone
known_hosts_file = /root/.ssh/hyestore_known_hosts

Never paste a real private key or password into documentation, shell history or a service unit. Test the remote without changing data:

rclone lsd hyestore:
rclone about hyestore:

Make a Safe First Copy

copy transfers new and changed files without deleting destination-only files, making it the safer starting point:

rclone copy /srv/data hyestore:backups/server-01 \
  --create-empty-src-dirs \
  --transfers 4 \
  --checkers 8 \
  --log-level INFO \
  --log-file /var/log/rclone-server-01.log

Start conservatively. More parallel transfers can help with many small files, but excessive concurrency adds load without guaranteeing a faster result.

Add Client-Side Encryption With rclone Crypt

SFTP encrypts data in transit. rclone Crypt adds another layer by encrypting file contents and, if selected, names before upload. The Storage Box receives encrypted objects.

Run rclone config again, create a remote named secure, choose crypt, and set the underlying remote to hyestore:encrypted/server-01. Standard filename encryption is a sensible default.

rclone mkdir secure:
rclone copy /srv/data secure: --transfers 4 --checkers 8 --progress

Back up the configuration and unobscured Crypt password and salt in a secure password manager. Configuration obfuscation prevents casual disclosure; it is not a substitute for secret storage.

Understand copy Before Using sync

Before any sync, inspect a dry run. A mistyped path can target the wrong directory:

rclone sync /srv/data secure: --dry-run

Automate the Backup With systemd

Create /etc/systemd/system/rclone-storage-box.service:

[Unit]
Description=Encrypted rclone backup to HYEHOST Storage Box
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
User=root
Environment=HOME=/root
ExecStart=/usr/bin/rclone copy /srv/data secure: --transfers 4 --checkers 8 --log-level INFO
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=6

Create /etc/systemd/system/rclone-storage-box.timer:

[Unit]
Description=Run the encrypted Storage Box backup nightly

[Timer]
OnCalendar=*-*-* 02:30:00
Persistent=true
RandomizedDelaySec=20m

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload
sudo systemctl enable --now rclone-storage-box.timer
sudo systemctl start rclone-storage-box.service
sudo systemctl status rclone-storage-box.service --no-pager

The random delay avoids every server starting at the same minute. Monitor failures instead of assuming that an enabled timer is succeeding.

Verify the Backup and Test a Restore

Use rclone check for an ordinary remote or cryptcheck for a Crypt remote:

rclone cryptcheck /srv/data secure: --one-way
sudo journalctl -u rclone-storage-box.service --since yesterday

Then recover a representative set into a new directory, never over the live source:

sudo mkdir -p /srv/restore-test
rclone copy secure: /srv/restore-test --progress
sha256sum /srv/data/important-file /srv/restore-test/important-file

Open databases, archives, images and exports after restoration. A matching file count alone does not prove that recovered data is usable.

Mounting Is Useful, but It Is Not a Backup

rclone can mount the Storage Box for convenient browsing. Network latency and application access patterns may require VFS caching. Start read-only and test:

rclone mount secure: /mnt/hyestore \
  --read-only \
  --vfs-cache-mode minimal \
  --dir-cache-time 5m

A mount provides access, not history. Use copy jobs, independent snapshots, verification and restore drills for actual protection.

Production Checklist

• Use the unique Storage Box hostname and a dedicated backup account.
• Verify and pin the SSH host key.
• Use a dedicated SSH key with narrow access.
• Wrap SFTP in Crypt when client-side encryption is required.
• Store the Crypt password, salt and configuration separately.
• Prefer copy; use sync only after a dry run.
• Alert when the systemd job fails.
• Run check or cryptcheck regularly.
• Restore into an isolated path and test the result.

Frequently Asked Questions

Can rclone back up to an SFTP storage box?

Yes. rclone has a native SFTP backend and addresses files as remote:path. Configure the hostname, account, key and verified host-key file first.

How do I encrypt files before uploading them?

Create an rclone Crypt remote around the SFTP destination. Encryption happens locally before transfer.

Should a backup use copy or sync?

copy is safer because destination-only files remain. sync can delete remote files and needs a dry run, snapshots and a recovery plan.

How often should I test restores?

Test after initial setup and on a regular schedule, then repeat after major application, configuration or encryption changes.