How secure is my local backup drive with sshfs?

2026-07-02 18:23 UTC

Hello everyone. I have been interested in starting to self-host, and I have just been able to set up the first useful thing for myself (apart from a PiHole that I have running). Since I am very afraid of making security mistakes, I would like to get feedback from you if my setup is secure or not. **The simple use case:** I want to be able to back up files from my main computer to a hard disk, without having the hard disk attached to my main computer. **The setup:** - A Raspberry Pi 4 running Raspberry Pi OS Lite (64-bit). - The Raspberry Pi can only be accessed via `ed25519` key. - I configured a firewall on the Raspberry Pi with `ufw` to allow only traffic from the local subnet. - I then use `sshfs` to mount the hard disk connected with the Raspberry Pi to my main computer. - I plan to use `rsync` to back up my files. Now I need your help: how secure is this setup? Did I make any major mistake? Is there something I could do better? I'd be happy to get some feedback... 🙂

Replies (3)

@Pika@sh.itjust.works 2026-07-02 18:58

is there any reason in particular that you are using both SSHFS and rsync? Rsync supports sftp which runs over an ssh connection via rsync -e ssh source dstUser@dstHost:/path if you are only using the sshfs system to allow a local ssh directory on your system to use with rsync, you could likely skip that entire part and just use rsync. LinuxConfig.org has a pretty decent page on it

Open ##3713839
@passenger@sopuli.xyz 2026-07-03 05:46

I can recommend duplicati on windows or pika backup on linux. Then just make a user on raspberry pi and enter the ssh login in your backup client and you’re set. Rsync won’t deduplicate or make archives so you cannot restore a backup from any chosen date. Rsync is sync not backup.

Open ##3721950
@kevincox@lemmy.ml 2026-07-02 18:35

It sounds pretty reasonable. As long as you keep SSH patched and keep the key safe it should be quite locked down. Do double-check that password login isn’t allowed (or that all users have a very strong password). One non-security note is be careful with rsync backup. Generally rsync isn’t considered a backup as any mistakes made in the source will be propagated to the “backup” on next sync. Although there are ways to use rsync to take good backups (like copying to a new directory for each backup).

Open ##3723747