How to Install Rclone on Ubuntu 24.04 VPS: Swiss Army Knife for Cloud Storage
Moving data between cloud storage providers, mounting remote buckets as local folders, and orchestrating off-site backups usually means wrangling half a dozen different CLIs -- aws, gsutil, rsync, restic, and whatever proprietary client your SaaS of choice ships. Rclone replaces the lot with one battle-tested Go binary that speaks over 40 cloud storage protocols natively. This guide walks you through installing Rclone on an Ubuntu 24.04 VPS, configuring remotes for S3, Backblaze B2, Google Drive, and OneDrive, setting up encrypted vaults, mounting remotes as local filesystems, and wiring up scheduled backup jobs that run reliably for years.
Running a production backup workflow? Deploy Rclone on a dedicated VPS with predictable bandwidth and no per-GB egress fees. Launch a CloudCore Starter VPS and start syncing in minutes.
Table of Contents
--transfers, --checkers, --bwlimit)cryptWhat is Rclone?
Rclone is an open-source command-line program (MIT licensed, written in Go) that manages files on cloud storage. Think of it as rsync for the cloud: one consistent interface for copying, syncing, mounting, and serving data across dozens of backends. Rclone ships as a single static binary with zero runtime dependencies, which makes it trivial to install on any Linux VPS, container, or embedded device.
Rclone supports an enormous range of storage backends. On the object storage side, it talks to Amazon S3 and every S3-compatible service (Backblaze B2, Cloudflare R2, Wasabi, MinIO, Hetzner Object Storage, DigitalOcean Spaces, Linode Object Storage, Scaleway, Storj, IBM COS, Alibaba OSS). On the consumer cloud side, it covers Google Drive, Google Photos, Microsoft OneDrive, Dropbox, Box, pCloud, Mega, Yandex Disk, Mail.ru Cloud, Koofr, and Jottacloud. For enterprise and self-hosted use cases, it speaks SFTP, FTP, WebDAV (including Nextcloud, ownCloud, and Sharepoint), HTTP, HDFS, Azure Blob Storage, Azure Files, Google Cloud Storage, SMB/CIFS, and the Hadoop-compatible Ceph and Swift protocols. It can also wrap any of these with crypt (client-side encryption), union (merge multiple remotes), cache (local caching layer), alias, chunker, compress, and combine overlays.
The practical use cases are equally broad. Sysadmins use Rclone to offload nightly VPS backups to cheap cold storage like Backblaze B2 or Wasabi. Media teams mount Google Drive or OneDrive as a local folder and stream files directly without downloading them first. DevOps pipelines use it to push build artifacts and container images to S3-compatible buckets. Researchers sync multi-terabyte datasets between HPC clusters and cloud storage. Homelab enthusiasts replicate Plex and Jellyfin libraries across providers to dodge rate limits. And migration projects use Rclone to copy data between clouds at full line-rate without staging through a local disk.
Why Use Rclone on Your VPS?
Running Rclone on a VPS rather than a laptop or home server delivers a set of concrete advantages:
- Always-on, scheduled transfers -- A VPS runs 24/7 with a stable connection. Your nightly 3 AM backup actually runs at 3 AM, every night, without depending on whether your laptop is open.
- Gigabit+ symmetrical bandwidth -- Residential connections throttle uploads. A VPS typically has 1 Gbps symmetrical or better, so a 500 GB sync completes in hours instead of days.
- No consumer ISP interference -- Many ISPs deep-packet-inspect or rate-limit sustained uploads. Data-center networks do not.
- Close to the source or destination -- Running Rclone on a VPS geographically near your storage provider (for example, a Hetzner VPS for Hetzner Object Storage) minimises latency and maximises throughput.
- Dedicated, predictable resources -- Rclone can saturate CPU during encryption or checksum passes. Isolating it on a VPS keeps your workstation responsive.
- Works as a relay between clouds -- Need to move data from S3 to Google Drive without downloading it locally? A VPS with Rclone does server-side transfers where both endpoints support it, or streams through RAM otherwise -- no local disk required.
Quick Cost Comparison: Off-Site Backup Targets
| Provider | Storage Price | Egress Price | Good For |
|---|---|---|---|
| Backblaze B2 | $6 / TB / mo | $10 / TB (free up to 3x storage) | Long-term cold backups |
| Wasabi | $6.99 / TB / mo | Free (with policies) | Hot-ish backups, no egress fees |
| Cloudflare R2 | $15 / TB / mo | Free | Media distribution, public assets |
| AWS S3 Standard | $23 / TB / mo | $90 / TB | Enterprise, compliance |
| Hetzner Object Storage | EUR 5.95 / TB / mo | Free (inbound), metered outbound | EU workloads |
| Google Drive (Workspace) | $12 / user / mo (2 TB pooled) | Free | Existing Workspace tenants |
Prerequisites
Before you begin, make sure you have:
- A VPS running Ubuntu 24.04 LTS with root or sudo access
- SSH access to your server
- At least 1 GB of RAM (Rclone itself is lightweight; more RAM helps with large directory listings and VFS caching)
- Sufficient disk space if you plan to mount with VFS caching or stage backup archives
- An account with the cloud provider(s) you want to connect -- API credentials ready for S3/B2, or the ability to complete a browser OAuth flow for Google Drive/OneDrive/Dropbox
Recommended Plan: CloudCore Starter>
For most Rclone backup and sync workloads, a modest VPS is more than enough. We recommend the CloudCore Starter plan:>
- 4 vCPU cores
- 8 GB RAM
- 100 GB NVMe SSD
- Unmetered bandwidth at 1 Gbps
- Starting at EUR 7.99/month>
Rclone is I/O and network bound, not CPU bound (except during crypt operations), so even the starter tier saturates a gigabit link for typical workloads.Connect to your server:
ssh root@your-server-ipStep 1: Update System Packages
Refresh the package index and apply security updates before installing anything new.
sudo apt update && sudo apt upgrade -yInstall two small dependencies that simplify mounting and OAuth flows:
sudo apt install -y fuse3 ca-certificates curl unzipfuse3 is required if you intend to use rclone mount. ca-certificates ensures TLS connections to cloud providers work out of the box.
Step 2: Install Rclone via the Official Script
Ubuntu 24.04's package repository ships Rclone, but the version is usually several releases behind. Rclone iterates quickly -- new backends, bug fixes, and performance improvements land monthly -- so the official install script is the recommended route on a server.
Run the installer:
curl https://rclone.org/install.sh | sudo bashExpected output:
rclone v1.67.0 has successfully installed.
Now run "rclone config" for setup. Check https://rclone.org/docs/ for more details.The script performs these actions:
downloads.rclone.org/usr/bin/rclone/usr/local/share/man/If you prefer a manual install (for example, on an air-gapped server), download the latest release directly:
cd /tmp
curl -O https://downloads.rclone.org/rclone-current-linux-amd64.zip
unzip rclone-current-linux-amd64.zip
sudo cp rclone-*-linux-amd64/rclone /usr/bin/
sudo chmod +x /usr/bin/rcloneStep 3: Verify the Installation
Confirm the binary is on your PATH and reports the expected version.
rclone versionExpected output:
rclone v1.67.0
- os/version: ubuntu 24.04 (64 bit)
- os/kernel: 6.8.0-31-generic (x86_64)
- os/type: linux
- os/arch: amd64
- go/version: go1.22.4
- go/linking: static
go/tags: none
rclone help backends | head -30You should see dozens of backend names including s3, b2, drive, onedrive, dropbox, sftp, webdav, crypt, and many more.
Step 4: Configure Your First Remote
Rclone stores configuration in ~/.config/rclone/rclone.conf. The easiest way to create remotes is the interactive wizard:
rclone configYou will see:
No remotes found, make a new one?
n) New remote
s) Set configuration password
q) Quit config
n/s/q>Below are worked examples for the four most common backends.
Example A: Amazon S3 (or S3-Compatible Backblaze B2, Wasabi, R2, MinIO)
n) New remote
name> s3backup
Storage> s3
provider> AWS # or "Wasabi", "CloudflareR2", "BackblazeB2", "Minio", etc.
env_auth> false
access_key_id> AKIAXXXXXXXXXXXXXXXX
secret_access_key>
region> eu-central-1
endpoint> # leave blank for AWS; set to provider endpoint for others
location_constraint> eu-central-1
acl> private
storage_class> STANDARDFor non-AWS S3, set provider accordingly and fill endpoint (for example, https://s3.eu-central-003.backblazeb2.com or https://<accountid>.r2.cloudflarestorage.com). Rclone tweaks request signing and path style automatically based on the provider choice.
Example B: Backblaze B2 (Native Backend)
B2 has a dedicated backend that is slightly faster than the S3-compatible endpoint because it uses B2's native APIs and application keys:
n) New remote
name> b2
Storage> b2
account> 003xxxxxxxxxxxxx0000000001
key> K003xxxxxxxxxxxxxxxxxxxxxxxx
hard_delete> falseCreate a scoped application key in the Backblaze UI restricted to a single bucket for better blast-radius control.
Example C: Google Drive (Headless OAuth)
Google Drive requires an OAuth flow. Since your VPS has no browser, Rclone supports a "remote authorization" pattern where you complete the login on your local machine and paste the token back.
On the VPS:
n) New remote
name> gdrive
Storage> drive
client_id> # (optional but recommended — create your own in Google Cloud Console to avoid shared-client rate limits)
client_secret>
scope> drive
root_folder_id>
service_account_file>
Edit advanced config? n
Use auto config? n # IMPORTANT: choose "No" for headlessRclone prints a URL. Copy it, then on your local workstation (which has Rclone installed and a browser):
rclone authorize "drive"Your browser opens, you log in to Google, grant access, and Rclone prints a long JSON token blob. Paste that back into the VPS prompt. Rclone stores it and refreshes it automatically from then on.
Pro tip: Create your own OAuth client in the Google Cloud Console. The default shared client is rate-limited across every Rclone user globally and regularly hits quota ceilings. A private client has its own 1 billion queries/day quota.
Example D: Microsoft OneDrive
n) New remote
name> onedrive
Storage> onedrive
client_id>
client_secret>
region> global # or "us", "de", "cn"
Edit advanced config? n
Use auto config? nSame headless flow as Google Drive: run rclone authorize "onedrive" locally, paste the token back to the server. Select "OneDrive Personal" or "OneDrive for Business" when prompted, then choose the drive ID.
Example E: Service Accounts for Google Drive (Unattended)
For fully headless, no-browser-ever setups -- ideal for server-to-server sync -- use a Google service account:
[email protected])./root/.config/rclone/sa.json.name> gdrive-sa
Storage> drive
service_account_file> /root/.config/rclone/sa.json
root_folder_id> 1AbCdEfGhIjKlMnOpNo OAuth flow, no token refresh, no browser required. The service account has its own independent quota, so you can run dozens of them in parallel for huge transfers by rotating keys.
Step 5: Basic Copy and Sync Operations
With at least one remote configured, verify it works by listing the top-level directory:
rclone lsd b2:Expected output (for example):
-1 2026-02-11 10:14:22 -1 backup-bucket
-1 2026-03-04 18:02:55 -1 media-bucketList all files recursively in a bucket:
rclone ls b2:backup-bucketcopy vs sync vs move
Three commands cover 95% of daily use:
| Command | What It Does | When to Use |
|---|---|---|
rclone copy | Copies new/changed files from source to dest. Never deletes. | Incremental backups where deleting remote data is dangerous |
rclone sync | Makes dest identical to source. Deletes remote files that no longer exist on source. | Mirroring a directory — when you want exact parity |
rclone move | Copies new/changed files, then deletes them from the source. | Off-loading to cold storage, freeing local disk |
rclone copy /var/www/html b2:backup-bucket/websites/mysite \
--progress \
--stats 10sMirror a local photos/ directory to Google Drive, deleting anything on Drive that has been removed locally:
rclone sync /home/user/photos gdrive:Photos \
--progress \
--stats 10sThe --progress flag prints a live transfer dashboard. --stats 10s prints a summary line every 10 seconds (useful when piping logs to a file).
Dry Run First
Before any sync or move, run it with --dry-run to see exactly what would change:
rclone sync /home/user/photos gdrive:Photos --dry-run --verboseThis is especially important for sync, which can delete remote data if your source is empty by accident.
Step 6: Performance Tuning
Rclone defaults are conservative. A few flags dramatically change throughput.
--transfers -- Parallel File Uploads
Controls how many files upload in parallel. Default is 4. For small files, raise it:
rclone copy /data b2:bucket --transfers 16For very large files, 4 is usually fine because bandwidth is the bottleneck, not concurrency.
--checkers -- Parallel Hash/List Checks
Controls how many files are checked for existence/changes in parallel before transfer. Default is 8. Bump for backends with lots of small files:
rclone sync /data b2:bucket --checkers 32 --transfers 8--multi-thread-streams -- Parallel Chunks per File
Splits a single large file into chunks and uploads them in parallel. Default is 4:
rclone copy big-archive.tar.gz s3backup:bucket --multi-thread-streams 8 --multi-thread-cutoff 250M--multi-thread-cutoff sets the minimum file size that triggers multi-thread. Below this, files transfer as a single stream.
--bwlimit -- Bandwidth Caps and Schedules
Cap Rclone's bandwidth to keep it from starving other services:
rclone copy /data b2:bucket --bwlimit 50M # 50 MiB/s capSchedule-aware caps let you throttle during business hours and run flat-out overnight:
rclone copy /data b2:bucket --bwlimit "Mon-Fri 08:00,10M Mon-Fri 20:00,off"This caps to 10 MiB/s from 08:00 to 20:00 on weekdays and disables the cap otherwise.
--fast-list -- Reduce API Calls
On backends that support bulk listing (S3, B2, GCS, Drive), --fast-list uses fewer, larger list requests in exchange for a bit more memory:
rclone sync /data s3backup:bucket --fast-listUseful for buckets with hundreds of thousands of objects where the per-request quota or latency becomes the bottleneck.
Step 7: Encrypted Remotes with crypt
Server-side encryption (SSE-S3, SSE-KMS) encrypts data at rest on the provider's disks -- but the provider holds the keys. If you want client-side zero-knowledge encryption, Rclone's crypt backend wraps any other remote. Data is encrypted on your VPS before it leaves; even the filenames are scrambled. The cloud provider sees random-looking blobs.
Create a crypt remote layered on top of your B2 remote:
rclone confign) New remote
name> b2-crypt
Storage> crypt
remote> b2:backup-bucket/encrypted
filename_encryption> standard # encrypts filenames
directory_name_encryption> true
password> <generate or enter a strong password>
password2> <optional salt — improves security>CRITICAL: Back up ~/.config/rclone/rclone.conf (which stores obscured passwords) AND your plaintext passwords in a password manager. If you lose the passwords, your data is unrecoverable. There is no "forgot password" flow.
Once configured, use b2-crypt: exactly like any other remote:
rclone sync /etc b2-crypt:server-backups/etc --progressRclone transparently encrypts on upload and decrypts on download. Listing b2:backup-bucket/encrypted directly on B2 shows random filenames; listing via b2-crypt: shows the real ones.
Step 8: Mount a Remote as a Local Filesystem
rclone mount uses FUSE to expose a remote as a directory on your VPS. Applications read and write files as if they were local; Rclone handles the cloud calls in the background.
One-off mount (foreground, for testing)
sudo mkdir -p /mnt/gdrive
rclone mount gdrive: /mnt/gdrive \
--vfs-cache-mode writes \
--dir-cache-time 1h \
--vfs-cache-max-size 10GIn another terminal, you can now ls /mnt/gdrive, read files, and write new ones. Press Ctrl+C to unmount.
Key flags:
--vfs-cache-mode writes-- Writes are buffered to local disk first, then uploaded. Required for almost all real-world use. Alternatives:off(direct, no buffering),minimal,full(caches both reads and writes).--dir-cache-time 1h-- How long to cache directory listings. Longer = fewer API calls, but slower to reflect changes made outside the mount.--vfs-cache-max-size 10G-- Cap on local cache disk usage.--vfs-cache-max-age 24h-- Evict cached entries older than this.--buffer-size 32M-- Per-file read-ahead buffer.
Persistent mount with a systemd unit
For a mount that survives reboots, create a systemd service:
sudo tee /etc/systemd/system/rclone-gdrive.service > /dev/null <<'EOF' [Unit] Description=Rclone mount for Google Drive AssertPathIsDirectory=/mnt/gdrive After=network-online.target Wants=network-online.target[Service] Type=notify ExecStart=/usr/bin/rclone mount gdrive: /mnt/gdrive \ --config=/root/.config/rclone/rclone.conf \ --allow-other \ --vfs-cache-mode writes \ --vfs-cache-max-size 10G \ --vfs-cache-max-age 24h \ --dir-cache-time 1h \ --log-level INFO \ --log-file /var/log/rclone-gdrive.log \ --umask 022 ExecStop=/bin/fusermount3 -u /mnt/gdrive Restart=on-failure RestartSec=10
[Install] WantedBy=multi-user.target EOF
--allow-other lets non-root users access the mount. For that flag to work, edit /etc/fuse.conf and uncomment user_allow_other:
sudo sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.confEnable and start:
sudo systemctl daemon-reload
sudo systemctl enable --now rclone-gdrive
sudo systemctl status rclone-gdriveThe mount will now come up automatically on every boot. See our systemd services and timers guide for a deeper dive into unit file syntax and dependency ordering.
Step 9: Build a Reliable Backup Script
A production backup script should sync, log, rotate logs, and fail loudly when something breaks.
Create /usr/local/bin/rclone-backup.sh:
#!/usr/bin/env bash
set -euo pipefailConfig
SOURCE="/srv"
DEST="b2-crypt:server-backups/$(hostname)"
LOG_DIR="/var/log/rclone"
LOG_FILE="$LOG_DIR/backup-$(date +%Y%m%d-%H%M%S).log"
LOCK_FILE="/var/lock/rclone-backup.lock"
RETAIN_DAYS=30mkdir -p "$LOG_DIR"
Prevent overlapping runs
exec 9>"$LOCK_FILE"
if ! flock -n 9; then
echo "Another backup is already running. Exiting." >&2
exit 1
fiecho "Backup started: $(date -Iseconds)" | tee -a "$LOG_FILE"
rclone sync "$SOURCE" "$DEST" \
--transfers 8 \
--checkers 16 \
--fast-list \
--bwlimit "08:00,20M 20:00,off" \
--log-file "$LOG_FILE" \
--log-level INFO \
--stats 1m \
--stats-log-level NOTICE
echo "Backup completed: $(date -Iseconds)" | tee -a "$LOG_FILE"
Rotate old logs
find "$LOG_DIR" -name "backup-*.log" -mtime +$RETAIN_DAYS -deleteMake it executable:
sudo chmod +x /usr/local/bin/rclone-backup.shTest it once by hand:
sudo /usr/local/bin/rclone-backup.shInspect the log:
tail -f /var/log/rclone/backup-*.logStep 10: Schedule Backups with systemd Timers or Cron
Two options. systemd timers are more modern, log to the journal, and handle missed runs gracefully. Cron is simpler and universally understood.
Option A: systemd Timer (Recommended)
Create a service unit:
sudo tee /etc/systemd/system/rclone-backup.service > /dev/null <<'EOF' [Unit] Description=Rclone backup to B2 After=network-online.target Wants=network-online.target
[Service] Type=oneshot ExecStart=/usr/local/bin/rclone-backup.sh Nice=19 IOSchedulingClass=idle EOF
Create a timer unit:
sudo tee /etc/systemd/system/rclone-backup.timer > /dev/null <<'EOF' [Unit] Description=Nightly Rclone backup[Timer] OnCalendar=--* 03:00:00 RandomizedDelaySec=15m Persistent=true Unit=rclone-backup.service
[Install] WantedBy=timers.target EOF
Persistent=true means if the VPS was off at 03:00, the job runs at next boot. RandomizedDelaySec=15m staggers runs across fleet if you use the same config on many servers.
Enable:
sudo systemctl daemon-reload
sudo systemctl enable --now rclone-backup.timer
sudo systemctl list-timers rclone-backup.timerOption B: Cron
sudo crontab -eAdd:
0 3 * /usr/local/bin/rclone-backup.sh >> /var/log/rclone/cron.log 2>&1Step 11: Rclone Web UI
Rclone ships a built-in web UI that wraps the same functionality in a browser. Useful for spot-checking remotes or kicking off manual transfers without SSH.
Start the remote control daemon with the web UI enabled:
rclone rcd --rc-web-gui \
--rc-addr 127.0.0.1:5572 \
--rc-user admin \
--rc-pass "$(openssl rand -hex 16)"The first run downloads the web UI assets. Access via an SSH tunnel from your workstation:
ssh -L 5572:127.0.0.1:5572 root@your-server-ipThen open http://127.0.0.1:5572 in your local browser and log in with the generated credentials.
For persistent access, put it behind an Nginx reverse proxy with TLS (same pattern as we use in our Nginx reverse proxy guide) and store the password in a systemd EnvironmentFile.
Rclone vs. Restic
Rclone and Restic are often mentioned in the same breath, but they solve different problems. Choose based on what you actually need.
| Feature | Rclone | Restic |
|---|---|---|
| Primary model | Raw file sync / copy / mount | Encrypted, deduplicated snapshots |
| File layout on destination | Mirrors your source tree 1:1 | Opaque content-addressed blobs |
| Deduplication | No (copies files as-is) | Yes, at block level across all snapshots |
| Incremental backups | Yes (changed files only) | Yes (changed blocks only) |
| Point-in-time restore | No (you have the current state) | Yes (any historical snapshot) |
| Encryption | Optional via crypt wrapper | Always on (mandatory) |
| Browse remote as files | Yes (rclone mount) | No (must restore or restic mount) |
| Best for | Media libraries, mirroring, cross-cloud migration, mount-as-disk use cases | Backups where you need history, versioning, and space-efficient retention |
See also our guides on installing MinIO for self-hosted S3-compatible storage (a great Rclone backend for private use) and installing Restic.
Troubleshooting
| Problem | Cause | Solution |
|---|---|---|
Error: failed to get token: oauth2: "invalid_grant" | OAuth refresh token expired or revoked | Re-run rclone config reconnect gdrive: and complete the browser flow again. Service accounts avoid this entirely. |
Error 429: Too Many Requests or userRateLimitExceeded | Hit provider rate limit (common on Google Drive) | Add --tpslimit 10 --tpslimit-burst 1. For Drive, use your own OAuth client ID instead of the shared default. |
directory cache: stale entry or missing files after remote change | --dir-cache-time too long | Send kill -SIGHUP $(pidof rclone) to flush the cache, or lower --dir-cache-time. Add --poll-interval 30s on backends that support change notifications. |
mount point is not responding or hangs on ls | Network hiccup, stuck connection, or stale mount | sudo fusermount3 -u /mnt/gdrive, then restart the systemd unit. Add --attr-timeout 1s and --vfs-read-chunk-size 32M to reduce hang windows. |
Error: input/output error during large uploads | Transient network error mid-upload | Rclone retries automatically. If persistent, lower --transfers and --multi-thread-streams. Check --retries 10 --low-level-retries 20. |
Failed to copy: checksum differ | File changed during upload, or buggy backend hashing | Add --ignore-checksum if you trust the source, or --size-only to compare by size only. |
NewFs: not S3 namespace on Cloudflare R2 | Missing provider = Cloudflare in config | Edit ~/.config/rclone/rclone.conf and set provider = Cloudflare under the R2 remote section. |
| High RAM usage during big syncs | Default buffers × many transfers adds up | Reduce --buffer-size (for example --buffer-size 16M), lower --transfers, and avoid --fast-list on huge buckets if RAM is tight. |
bind: address already in use on rclone rcd | Another Rclone daemon already running | pkill rclone or change --rc-addr to a different port. |
password is stored unencrypted warnings | Plain config file | Run rclone config → s) Set configuration password to encrypt the config at rest. Remember to supply the password via env var RCLONE_CONFIG_PASS for unattended runs. |
Useful Debugging Flags
--verboseor-v-- Log each file as it transfers.-vv-- Debug-level logging (very noisy, but shows every API call).--log-file /tmp/rclone.log-- Capture to disk for analysis.--dump headers-- Show HTTP headers for every API request (credentials auto-redacted).rclone about gdrive:-- Show total/used/free quota for a remote.rclone size b2:bucket-- Tally the size and object count of a path.rclone check src: dst:-- Verify two remotes match bit-for-bit.
FAQ
Is Rclone free for commercial use?
Yes. Rclone is licensed under MIT, which permits commercial use, modification, redistribution, and embedding in proprietary products with no royalties or reporting obligations. The project is maintained by Nick Craig-Wood and an active community of contributors. Many enterprises -- including backup vendors, media companies, and hosting providers -- bundle Rclone in their products. The only obligation is preserving the MIT copyright notice.
How does Rclone compare to aws s3 sync, gsutil, and native provider CLIs?
Native provider CLIs usually have slightly tighter integration with their specific clouds -- exotic features like S3 Object Lock policies or GCS VPC-SC settings may land there first. But Rclone covers 40+ backends with one consistent command surface, supports cross-cloud transfers natively (copy S3 → GCS in one command without staging), and includes unique features provider CLIs lack: client-side encryption (crypt), FUSE mounting, union remotes, and a built-in HTTP/WebDAV/S3 server (rclone serve). For multi-cloud or mount-as-disk workflows, Rclone wins. For deep integration with a single provider's bleeding-edge features, the native CLI may edge ahead.
Can Rclone copy files directly between two clouds without downloading them to the VPS first?
Partially. For backends where both source and destination support server-side copy (same provider, same region — for example, S3 bucket A to S3 bucket B), Rclone issues a copy instruction and the provider moves the data internally. For cross-provider transfers (S3 → Google Drive), data streams through your VPS's RAM but is never written to local disk -- so you do not need terabytes of free disk space to migrate terabytes of data. Bandwidth is still consumed on both legs (download from source + upload to dest), so transfer time depends on whichever link is slower.
Is it safe to use rclone sync for backups?
Use it with care. sync makes the destination an exact mirror of the source, which means if your source gets wiped (ransomware, rm -rf, hardware failure), the next sync run will happily delete your backup too. For safety, either (a) use rclone copy instead so files are never deleted on the destination, (b) add --backup-dir so sync moves overwritten/deleted files to a dated archive directory instead of deleting them, or (c) use a snapshot-based tool like Restic where history is preserved by design. A defensive sync command looks like:
rclone sync /data b2-crypt:backup \
--backup-dir "b2-crypt:backup-archive/$(date +%Y-%m-%d)" \
--progressAny file deleted or overwritten on the destination gets moved into today's archive folder, so you have a 30-day undo window if you prune backup-archive on a schedule.
How do I back up my Rclone config safely?
The config file lives at ~/.config/rclone/rclone.conf. It contains obscured (not encrypted) tokens, passwords, and crypt keys by default. Treat it like an SSH private key: keep it with mode 0600, never commit it to Git, and back it up to a secure location. For extra safety, encrypt the config itself with rclone config → s) Set configuration password, which wraps the whole file with AES. Unattended scripts then need to supply the password via the RCLONE_CONFIG_PASS environment variable. Losing your crypt passwords means your encrypted data is gone forever -- store them in a password manager with an offline backup.
Next Steps
Now that Rclone is running on your VPS, here are recommended follow-ups to harden and extend your setup:
- Install Restic for versioned, deduplicated backups -- Pair Rclone's raw sync with Restic for snapshot-based backups with point-in-time restore. Use Rclone as Restic's backend via the
rclone:URL scheme.
- Self-host S3 with MinIO -- Spin up your own S3-compatible storage on a second VPS with MinIO and use Rclone to replicate between it and an off-site provider like Backblaze B2.
- Master systemd units and timers -- Deepen your understanding of the service and timer patterns used here in our systemd services and timers guide.
- Monitor your backups -- Pipe Rclone logs into a monitoring stack (Uptime Kuma, Healthchecks.io, or a Prometheus + Loki pair). Alert on missed runs, non-zero exit codes, or transfer sizes outside expected ranges.
- Use
rclone serve-- Rclone can expose any remote via HTTP, WebDAV, SFTP, FTP, or an S3-compatible API. Runrclone serve webdav gdrive:to mount Google Drive on devices that speak WebDAV but not Drive natively (iOS Files app, Nextcloud external storage, etc.).
- Explore the full backend catalogue -- Check the Rclone documentation for backend-specific tuning. Each provider page lists supported operations, limitations, and recommended flags.
Need reliable infrastructure for your backup workflow?>
Rclone is only as dependable as the VPS it runs on. Our CloudCore VPS line gives you unmetered 1 Gbps bandwidth, NVMe storage for VFS cache, and 24/7 availability -- the three things that matter most for scheduled backups and always-on mounts.>
- 4 vCPU, 8 GB RAM, 100 GB NVMe
- Unmetered bandwidth at 1 Gbps
- Deploy in under 60 seconds
- Hourly and monthly billing available>
Deploy Your CloudCore VPS -- Plans start at EUR 7.99/month.