# Map TrueNAS rsync identities and paths before choosing SSH mode > Keep the local task user, remote SSH identity, credential location and transfer direction explicit when preparing a TrueNAS rsync task. - Canonical URL: https://update.dsesecurity.com/updates/map-truenas-rsync-identities-and-paths-before-choosing-ssh-mode/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-29T17:41:08+00:00 - Modified: 2026-10-29T17:41:38+00:00 - Last reviewed by DSE: 2026-10-29 - Resource type: Guide - DSE priority: Advisory - Topics: Business Continuity, Networks & Infrastructure - Reading time: 3 minutes ## What you need to know Keep the local task user, remote SSH identity, credential location and transfer direction explicit when preparing a TrueNAS rsync task. ## Potentially affected TrueNAS 25.10 rsync tasks using the documented SSH connection choices. ## DSE recommendation Review the identity and path map, then transfer harmless fixtures in the intended direction before scheduling real data. ## Article Bottom line: Write the local task identity, remote account and both paths before selecting a saved SSH connection. Prove the intended transfer with harmless files before scheduling valuable data or accepting a connection check as the complete result. ## Source fact: what the authority says The [TrueNAS rsync guide](https://www.truenas.com/docs/scale/25.10/scaletutorials/dataprotection/rsynctasksscale/) defines Push as copying from TrueNAS to the remote system and Pull as copying from the remote system into the local Path dataset. SSH mode offers a private key stored in the user’s home directory or an SSH connection from the keychain, with different configuration fields for the choice. The local task user must have read/write permissions for the local dataset. Validate Remote Path checks remote reachability and path existence, and the guide limits the remote path to 255 characters. ## What the source does not establish This article covers the documented task identity, connection and path choices, not every rsync option or an application-consistent backup design. A successful connection or existing path does not establish the owner’s required file population and recovery result. ## Applicability questions - Which system should receive the data, and is the task Push or Pull? - Which account runs the local task, and which account authenticates remotely? - Is the chosen credential a home-directory key or a saved keychain connection? - What exact local and remote paths are approved, and what data is excluded? ## DSE recommendation: controlled next steps The following steps are DSE recommendations based on the cited source. DSE recommends a transfer map with named systems at both ends and an arrow showing the approved direction. Put the local task user beside the local path and the remote account beside the remote path. Reference the credential by its controlled identifier without copying private key material into the request. Select the SSH connection mode only after confirming where the authorized key is maintained. Review the user-home and keychain branches against the current installed release. Avoid substituting an administrator account solely because the intended task identity has a permissions problem. Define a proposed fixture with one source-only file, one file present on both sides and one destination-only file. Record the intended treatment of each under the separately reviewed task options. Do not infer deletion or preservation behavior from the direction field; resolve those options before using the fixture. Keep remote path validation enabled for the initial approved setup unless there is a reviewed reason otherwise. Treat a validation failure as an investigation of the named endpoint or path rather than a reason to broaden account rights. Hold the schedule until the full fixture has been checked. ## Verification and evidence Proposed verification: run the task against the disposable approved paths and inspect the resulting files on both systems. Record the effective identities, direction and selected credential reference. Compare names and contents with the fixture expectation, including the destination-only file, without inventing an expected result for options that have not been reviewed. Test the normal scheduled execution path separately from an administrator’s manual SSH session. Preserve the task configuration, connection result and actual file observations together. Where the purpose is recovery, require a separately planned recovery exercise before calling the transfer an accepted backup. ## Official references - [TrueNAS — Configuring Rsync Tasks](https://www.truenas.com/docs/scale/25.10/scaletutorials/dataprotection/rsynctasksscale/) — official product documentation; confirm the installed release and configuration. Source review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change. ## Primary reference - Name: TrueNAS — Configuring Rsync Tasks - Authority: www.truenas.com - URL: https://www.truenas.com/docs/scale/25.10/scaletutorials/dataprotection/rsynctasksscale/ - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Map TrueNAS rsync identities and paths before choosing SSH mode,” DSE Security, https://update.dsesecurity.com/updates/map-truenas-rsync-identities-and-paths-before-choosing-ssh-mode/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.