rsync-ssl(1) on Solnix vs Linux and the BSDs
rsync-ssl is a helper script from the rsync package that runs rsync against a daemon requiring SSL, on port 874 by default. It is not in the base Solnix system: install pkgs.solnix.rsync. Its Solnix page lacks the certificate-validation variables the Linux page (rsync-3.5.0) documents.
The manual pages
- Solnix: rsync-ssl(1) from
pkgs.solnix.rsync - Linux: rsync-ssl(1) rsync-3.5.0
What Solnix runs
Not installed by default: add pkgs.solnix.rsync. The bundle lists no other illumos variants. The Solnix page is the rsync project's rsync-ssl page. The bundle does not say which rsync version it describes.
Differences
| Compared with | Topic | What differs |
|---|---|---|
| Linux | RSYNC_SSL_CA_CERT effect | The Linux page says that when RSYNC_SSL_CA_CERT is set, the server certificate chain and host name are checked for the openssl, gnutls and stunnel backends. An empty string disables validation. The Solnix page only calls it a CA file used to validate the connection. Source: Linux rsync-ssl(1) ENVIRONMENT VARIABLES RSYNC_SSL_CA_CERT; Solnix rsync-ssl(1) ENVIRONMENT VARIABLES RSYNC_SSL_CA_CERT |
| Linux | RSYNC_SSL_ALLOW_INSECURE_STUNNEL | The Linux page documents RSYNC_SSL_ALLOW_INSECURE_STUNNEL=1. Without it, stunnel mode refuses to start unless RSYNC_SSL_CA_CERT is set. The Solnix page does not list this variable, and its CAVEATS say stunnel only encrypts without validating unless certificate variables are set. Source: Linux rsync-ssl(1) ENVIRONMENT VARIABLES RSYNC_SSL_ALLOW_INSECURE_STUNNEL; Solnix rsync-ssl(1) CAVEATS |
| Linux | RSYNC_SSL_SKIP_HOSTNAME_CHECK | The Linux page documents RSYNC_SSL_SKIP_HOSTNAME_CHECK=1. It keeps chain validation but skips the host name check, for the openssl and stunnel backends. The Solnix page does not list it. Source: Linux rsync-ssl(1) ENVIRONMENT VARIABLES RSYNC_SSL_SKIP_HOSTNAME_CHECK |
| Linux | stunnel CAVEATS text | Both pages still carry the CAVEATS text saying stunnel does not verify against the CA collection. On the Linux page this sits beside the newer variables above and reads as partly out of date. Check the installed script before relying on either. Source: Linux rsync-ssl(1) CAVEATS vs ENVIRONMENT VARIABLES; Solnix rsync-ssl(1) CAVEATS |
| FreeBSD, OpenBSD, NetBSD | no counterpart page | The bundle has no rsync-ssl page for FreeBSD, OpenBSD or NetBSD, so no comparison is possible. The manual does not say whether these systems ship it. Source: Bundle header (only a linux counterpart listed) |
| Linux | same options and default port | Both pages have the same synopsis, --type=SSL_TYPE (equals sign required, openssl or stunnel), and the same default port 874. Both read RSYNC_SSL_TYPE, RSYNC_SSL_PORT, RSYNC_SSL_CERT, RSYNC_SSL_KEY, RSYNC_SSL_OPENSSL, RSYNC_SSL_GNUTLS and RSYNC_SSL_STUNNEL.Source: Solnix and Linux rsync-ssl(1) SYNOPSIS, OPTIONS, ENVIRONMENT VARIABLES |
Standards
- POSIX: rsync-ssl is not a POSIX.1-2024 utility.
Writing portable scripts
- Do not rely on RSYNC_SSL_ALLOW_INSECURE_STUNNEL or RSYNC_SSL_SKIP_HOSTNAME_CHECK in scripts that must also run with the Solnix page's version. Only the Linux page documents them.
- Set RSYNC_SSL_CA_CERT explicitly to get certificate validation, and test that a bad certificate is rejected on each system.
Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.