Bottom line: Write the local task identity, remote account and both paths before selecting a saved SSH connection. Prove the intended transfer with harmless files before scheduling valuable data or accepting a connection check as the complete result.
\nThe TrueNAS rsync guide defines Push as copying from TrueNAS to the remote system and Pull as copying from the remote system into the local Path dataset. SSH mode offers a private key stored in the user’s home directory or an SSH connection from the keychain, with different configuration fields for the choice. The local task user must have read/write permissions for the local dataset. Validate Remote Path checks remote reachability and path existence, and the guide limits the remote path to 255 characters.
\nThis article covers the documented task identity, connection and path choices, not every rsync option or an application-consistent backup design. A successful connection or existing path does not establish the owner’s required file population and recovery result.
\nThe following steps are DSE recommendations based on the cited source.
\nDSE recommends a transfer map with named systems at both ends and an arrow showing the approved direction. Put the local task user beside the local path and the remote account beside the remote path. Reference the credential by its controlled identifier without copying private key material into the request.
\nSelect the SSH connection mode only after confirming where the authorized key is maintained. Review the user-home and keychain branches against the current installed release. Avoid substituting an administrator account solely because the intended task identity has a permissions problem.
\nDefine a proposed fixture with one source-only file, one file present on both sides and one destination-only file. Record the intended treatment of each under the separately reviewed task options. Do not infer deletion or preservation behavior from the direction field; resolve those options before using the fixture.
\nKeep remote path validation enabled for the initial approved setup unless there is a reviewed reason otherwise. Treat a validation failure as an investigation of the named endpoint or path rather than a reason to broaden account rights. Hold the schedule until the full fixture has been checked.
\nProposed verification: run the task against the disposable approved paths and inspect the resulting files on both systems. Record the effective identities, direction and selected credential reference. Compare names and contents with the fixture expectation, including the destination-only file, without inventing an expected result for options that have not been reviewed.
\nTest the normal scheduled execution path separately from an administrator’s manual SSH session. Preserve the task configuration, connection result and actual file observations together. Where the purpose is recovery, require a separately planned recovery exercise before calling the transfer an accepted backup.
\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.
\n", "content_text": "Bottom line: Write the local task identity, remote account and both paths before selecting a saved SSH connection. Prove the intended transfer with harmless files before scheduling valuable data or accepting a connection check as the complete result.\nSource fact: what the authority says\nThe TrueNAS rsync guide defines Push as copying from TrueNAS to the remote system and Pull as copying from the remote system into the local Path dataset. SSH mode offers a private key stored in the user’s home directory or an SSH connection from the keychain, with different configuration fields for the choice. The local task user must have read/write permissions for the local dataset. Validate Remote Path checks remote reachability and path existence, and the guide limits the remote path to 255 characters.\nWhat the source does not establish\nThis article covers the documented task identity, connection and path choices, not every rsync option or an application-consistent backup design. A successful connection or existing path does not establish the owner’s required file population and recovery result.\nApplicability questions\n\nWhich system should receive the data, and is the task Push or Pull?\nWhich account runs the local task, and which account authenticates remotely?\nIs the chosen credential a home-directory key or a saved keychain connection?\nWhat exact local and remote paths are approved, and what data is excluded?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends a transfer map with named systems at both ends and an arrow showing the approved direction. Put the local task user beside the local path and the remote account beside the remote path. Reference the credential by its controlled identifier without copying private key material into the request.\nSelect the SSH connection mode only after confirming where the authorized key is maintained. Review the user-home and keychain branches against the current installed release. Avoid substituting an administrator account solely because the intended task identity has a permissions problem.\nDefine a proposed fixture with one source-only file, one file present on both sides and one destination-only file. Record the intended treatment of each under the separately reviewed task options. Do not infer deletion or preservation behavior from the direction field; resolve those options before using the fixture.\nKeep remote path validation enabled for the initial approved setup unless there is a reviewed reason otherwise. Treat a validation failure as an investigation of the named endpoint or path rather than a reason to broaden account rights. Hold the schedule until the full fixture has been checked.\nVerification and evidence\nProposed verification: run the task against the disposable approved paths and inspect the resulting files on both systems. Record the effective identities, direction and selected credential reference. Compare names and contents with the fixture expectation, including the destination-only file, without inventing an expected result for options that have not been reviewed.\nTest the normal scheduled execution path separately from an administrator’s manual SSH session. Preserve the task configuration, connection result and actual file observations together. Where the purpose is recovery, require a separately planned recovery exercise before calling the transfer an accepted backup.\nOfficial references\n\nTrueNAS — Configuring Rsync Tasks — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "content_markdown": "Bottom line: Write the local task identity, remote account and both paths before selecting a saved SSH connection. Prove the intended transfer with harmless files before scheduling valuable data or accepting a connection check as the complete result.\n\n## Source fact: what the authority says\n\nThe [TrueNAS rsync guide](https://www.truenas.com/docs/scale/25.10/scaletutorials/dataprotection/rsynctasksscale/) defines Push as copying from TrueNAS to the remote system and Pull as copying from the remote system into the local Path dataset. SSH mode offers a private key stored in the user’s home directory or an SSH connection from the keychain, with different configuration fields for the choice. The local task user must have read/write permissions for the local dataset. Validate Remote Path checks remote reachability and path existence, and the guide limits the remote path to 255 characters.\n\n## What the source does not establish\n\nThis article covers the documented task identity, connection and path choices, not every rsync option or an application-consistent backup design. A successful connection or existing path does not establish the owner’s required file population and recovery result.\n\n## Applicability questions\n\n- Which system should receive the data, and is the task Push or Pull?\n\n- Which account runs the local task, and which account authenticates remotely?\n\n- Is the chosen credential a home-directory key or a saved keychain connection?\n\n- What exact local and remote paths are approved, and what data is excluded?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends a transfer map with named systems at both ends and an arrow showing the approved direction. Put the local task user beside the local path and the remote account beside the remote path. Reference the credential by its controlled identifier without copying private key material into the request.\n\nSelect the SSH connection mode only after confirming where the authorized key is maintained. Review the user-home and keychain branches against the current installed release. Avoid substituting an administrator account solely because the intended task identity has a permissions problem.\n\nDefine a proposed fixture with one source-only file, one file present on both sides and one destination-only file. Record the intended treatment of each under the separately reviewed task options. Do not infer deletion or preservation behavior from the direction field; resolve those options before using the fixture.\n\nKeep remote path validation enabled for the initial approved setup unless there is a reviewed reason otherwise. Treat a validation failure as an investigation of the named endpoint or path rather than a reason to broaden account rights. Hold the schedule until the full fixture has been checked.\n\n## Verification and evidence\n\nProposed verification: run the task against the disposable approved paths and inspect the resulting files on both systems. Record the effective identities, direction and selected credential reference. Compare names and contents with the fixture expectation, including the destination-only file, without inventing an expected result for options that have not been reviewed.\n\nTest the normal scheduled execution path separately from an administrator’s manual SSH session. Preserve the task configuration, connection result and actual file observations together. Where the purpose is recovery, require a separately planned recovery exercise before calling the transfer an accepted backup.\n\n## Official references\n\n- [TrueNAS — Configuring Rsync Tasks](https://www.truenas.com/docs/scale/25.10/scaletutorials/dataprotection/rsynctasksscale/) — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/map-truenas-rsync-identities-and-paths-before-choosing-ssh-mode/", "url": "https://update.dsesecurity.com/updates/map-truenas-rsync-identities-and-paths-before-choosing-ssh-mode/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-29" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/map-truenas-rsync-identities-and-paths-before-choosing-ssh-mode/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Business Continuity", "item": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "ListItem", "position": 3, "name": "Map TrueNAS rsync identities and paths before choosing SSH mode", "item": "https://update.dsesecurity.com/updates/map-truenas-rsync-identities-and-paths-before-choosing-ssh-mode/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/map-truenas-rsync-identities-and-paths-before-choosing-ssh-mode/#article", "identifier": "https://update.dsesecurity.com/updates/map-truenas-rsync-identities-and-paths-before-choosing-ssh-mode/", "url": "https://update.dsesecurity.com/updates/map-truenas-rsync-identities-and-paths-before-choosing-ssh-mode/", "headline": "Map TrueNAS rsync identities and paths before choosing SSH mode", "description": "Keep the local task user, remote SSH identity, credential location and transfer direction explicit when preparing a TrueNAS rsync task.", "abstract": "Keep the local task user, remote SSH identity, credential location and transfer direction explicit when preparing a TrueNAS rsync task.", "articleBody": "Bottom line: Write the local task identity, remote account and both paths before selecting a saved SSH connection. Prove the intended transfer with harmless files before scheduling valuable data or accepting a connection check as the complete result.\nSource fact: what the authority says\nThe TrueNAS rsync guide defines Push as copying from TrueNAS to the remote system and Pull as copying from the remote system into the local Path dataset. SSH mode offers a private key stored in the user’s home directory or an SSH connection from the keychain, with different configuration fields for the choice. The local task user must have read/write permissions for the local dataset. Validate Remote Path checks remote reachability and path existence, and the guide limits the remote path to 255 characters.\nWhat the source does not establish\nThis article covers the documented task identity, connection and path choices, not every rsync option or an application-consistent backup design. A successful connection or existing path does not establish the owner’s required file population and recovery result.\nApplicability questions\n\nWhich system should receive the data, and is the task Push or Pull?\nWhich account runs the local task, and which account authenticates remotely?\nIs the chosen credential a home-directory key or a saved keychain connection?\nWhat exact local and remote paths are approved, and what data is excluded?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends a transfer map with named systems at both ends and an arrow showing the approved direction. Put the local task user beside the local path and the remote account beside the remote path. Reference the credential by its controlled identifier without copying private key material into the request.\nSelect the SSH connection mode only after confirming where the authorized key is maintained. Review the user-home and keychain branches against the current installed release. Avoid substituting an administrator account solely because the intended task identity has a permissions problem.\nDefine a proposed fixture with one source-only file, one file present on both sides and one destination-only file. Record the intended treatment of each under the separately reviewed task options. Do not infer deletion or preservation behavior from the direction field; resolve those options before using the fixture.\nKeep remote path validation enabled for the initial approved setup unless there is a reviewed reason otherwise. Treat a validation failure as an investigation of the named endpoint or path rather than a reason to broaden account rights. Hold the schedule until the full fixture has been checked.\nVerification and evidence\nProposed verification: run the task against the disposable approved paths and inspect the resulting files on both systems. Record the effective identities, direction and selected credential reference. Compare names and contents with the fixture expectation, including the destination-only file, without inventing an expected result for options that have not been reviewed.\nTest the normal scheduled execution path separately from an administrator’s manual SSH session. Preserve the task configuration, connection result and actual file observations together. Where the purpose is recovery, require a separately planned recovery exercise before calling the transfer an accepted backup.\nOfficial references\n\nTrueNAS — Configuring Rsync Tasks — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "datePublished": "2026-10-29T17:41:08+00:00", "dateModified": "2026-10-29T17:41:38+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/map-truenas-rsync-identities-and-paths-before-choosing-ssh-mode/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/map-truenas-rsync-identities-and-paths-before-choosing-ssh-mode/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Map TrueNAS rsync identities and paths before choosing SSH mode" }, "articleSection": [ "Business Continuity", "Networks & Infrastructure" ], "keywords": [ "Business Continuity", "Networks & Infrastructure", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 553, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "TrueNAS — Configuring Rsync Tasks", "url": "https://www.truenas.com/docs/scale/25.10/scaletutorials/dataprotection/rsynctasksscale/" } } ] } }