Automating Remote Off-Site Backups with Rsync and Cron

While creating backups is essential, storing those backups on the exact same server as your live application is a dangerous single point of failure. If your VPS suffers a catastrophic hardware failure, or if a ransomware attack encrypts your primary drives, your local backups will be destroyed right alongside your production data. True disaster recovery requires off-site backups.

Automating the secure transfer of your files to a completely separate remote server ensures your data survives local disasters. Using rsync combined with cron provides a lightweight, highly efficient, and encrypted method for keeping your off-site backups synchronized.

The 3-2-1 Backup Principle

Before configuring your scripts, it is important to understand the industry standard for data retention, known as the 3-2-1 rule:

• Keep three total copies of your data (one primary production copy and two backups).

• Store your backups on two different types of storage media.

• Keep at least one backup copy off-site (in a different physical data center or geographic region).

Why Use Rsync?

rsync (Remote Sync) is a powerful command-line utility built into almost all Linux distributions. It is the perfect tool for off-site backups because of its delta-transfer algorithm.

Instead of copying every single file over the network every night, rsync scans both the source and destination directories. It only transfers the specific parts of files that have actually changed since the last backup. This drastically reduces bandwidth usage and allows massive directories to sync in seconds rather than hours. Furthermore, rsync can tunnel its traffic through SSH, ensuring your data remains heavily encrypted while in transit across the public internet.

Step 1: Establishing Passwordless SSH Access

For a backup script to run completely unattended in the background, your primary server needs to be able to log into your remote backup server without prompting for a password.

• Log into your primary server and generate a new SSH key specifically for backups using ssh-keygen -t ed25519. Leave the passphrase completely blank.

• Copy this new public key to your remote backup server using the command ssh-copy-id -i ~/.ssh/id_ed25519.pub backupuser@remote_backup_ip.

• Test the connection by running ssh backupuser@remote_backup_ip. You should drop directly into the backup server's terminal without being asked for a password.

Step 2: Crafting the Rsync Command

With authentication established, you can construct the command that will securely synchronize your application data to the remote location.

A standard, highly effective backup command looks like this:

rsync -avz --delete -e ssh /var/www/mywebsite/ backupuser@remote_backup_ip:/backups/mywebsite/

• -a (archive): Preserves all file permissions, ownerships, and symlinks.

• -v (verbose): Outputs exactly what files are being transferred (useful for testing).

• -z (compress): Compresses the file data during the network transfer to save bandwidth.

• --delete: Tells the remote server to delete files in the destination folder if they have been deleted from the source folder, preventing your backup drive from filling up with old, deleted files.

Step 3: Automating the Sync with Cron

Once you have verified that your rsync command works flawlessly, you need to schedule it to run automatically at a specific time, such as during off-peak hours.

• Open your primary server's scheduled tasks by running crontab -e.

• Add a new line at the bottom of the file to define your schedule. To run the backup every single night at 2:00 AM, you would add:

  0 2 * * * rsync -avz --delete -e ssh /var/www/mywebsite/ backupuser@remote_backup_ip:/backups/mywebsite/ > /dev/null 2>&1

• Save and exit the file. The cron daemon will now automatically execute your off-site sync every night, silently handling the process in the background.