Offsite backup with rclone to S3 or Backblaze B2 on Linux

Download and run the official installer:

curl https://rclone.org/install.sh | sudo bash

The script detects the architecture (amd64, arm64), downloads the binary from GitHub, installs it in /usr/bin/rclone and generates the man page. The final output prints the installed version — confirm it is above 1.65.

Verify the installation:

rclone version

Expected output starts with rclone v1.6x.x followed by the OS, arch and Go version lines. If “command not found” appears, /usr/bin is not in the current shell’s PATH — open a new session or run hash -r.

Create the Application Key in the B2 panel with access to the bucket that will receive the backups. Save the keyID and applicationKey — B2 only shows the applicationKey once. Also create the destination bucket (private, no server-side encryption — we will encrypt on the client side).

Start the rclone interactive configurator:

rclone config

Select n (new remote), name it b2-raw, choose type 5 (Backblaze B2). Paste the keyID in “account” and the applicationKey in “key”. Confirm with y when asked if you want to accept the remaining defaults.

Test the connection by listing the buckets:

rclone lsd b2-raw:

Output should show the account’s buckets, one per line, with the creation date. A 401 unauthorized error means incorrect keyID/applicationKey or the Application Key was revoked in the panel.

Run rclone config, choose n, name it s3-raw, type 4 (Amazon S3). In “provider” select AWS. In “env_auth” leave false to paste credentials manually. Paste access_key_id and secret_access_key. In “region” choose the bucket region (e.g., us-east-1, sa-east-1). In “storage_class” leave empty for Standard or choose STANDARD_IA for infrequent access (cheaper for rarely read backup).

In rclone config, create another remote with n, name it b2-crypt (or s3-crypt), type 13 (crypt). In “remote” enter b2-raw:bucket-name/backups (replace with your bucket and path). In “filename_encryption” choose 1 (standard — hides names). In “directory_name_encryption” choose true.

When asked for the password, choose g (generate random) — generates a strong 1024-bit password. Copy and store the generated password in a password manager before continuing. Without this password, the backup is unrecoverable even with access to the bucket.

For “password2” (salt), also use g to generate randomly. Save it together with the main password. Confirm with y in the summary, then q to exit the configurator.

Run the initial backup of /var/www and /etc:

rclone copy /var/www b2-crypt:var-www \
  --progress \
  --transfers 4 \
  --checkers 8 \
  --bwlimit 50M

The --progress flag shows ETA and throughput in real time. --transfers 4 defines how many files are uploaded in parallel. --bwlimit 50M limits to 50 MB/s to avoid saturating the server’s network (adjust to your bandwidth).

Create a wrapper script at /usr/local/bin/backup-offsite.sh:

sudo tee /usr/local/bin/backup-offsite.sh > /dev/null <<'EOF'
#!/bin/bash
set -euo pipefail

LOG=/var/log/rclone-backup.log
exec >> "$LOG" 2>&1

echo "=== Backup started at $(date -Iseconds) ==="

rclone copy /var/www b2-crypt:var-www \
  --transfers 4 \
  --checkers 8 \
  --bwlimit 50M \
  --log-level INFO

rclone copy /etc b2-crypt:etc \
  --transfers 2 \
  --log-level INFO

echo "=== Backup completed at $(date -Iseconds) ==="
EOF

sudo chmod +x /usr/local/bin/backup-offsite.sh

The set -euo pipefail makes the script abort on any error. The exec >> redirects stdout and stderr to the log at once.

Add an entry to root’s crontab to run every day at 3 AM:

sudo crontab -e

Add the line:

0 3 * * * /usr/local/bin/backup-offsite.sh

Save and exit. Cron reads the crontab automatically — no need to restart the service.

Run the verification:

rclone check /var/www b2-crypt:var-www --one-way

The --one-way flag only verifies that every local file exists on the remote — useful because crypt may add metadata that confuses bidirectional checks. Output 0 differences found means every file matches.

Restore a test directory:

mkdir -p /tmp/restore-test
rclone copy b2-crypt:var-www/example-site /tmp/restore-test --progress

After downloading, compare some files with diff or md5sum against the source at /var/www/example-site. If they match, the chain is intact. Delete /tmp/restore-test afterwards.