Synology HyperBackup to Oracle Cloud

Oracle Cloud’s Always Free tier gives you 4 OCPUs, 24GB RAM, and 200GB block storage — enough for a solid off-site backup target at zero cost. Getting Synology HyperBackup to work with rsync over SSH has one non-obvious blocker: Oracle Cloud uses SSH config includes that override your main sshd_config, and HyperBackup needs password auth for initial setup.

Ubuntu Server Setup

Install Packages and Create Backup User

sudo apt update
sudo apt install rsync openssh-server -y
sudo systemctl enable ssh
sudo systemctl start ssh

sudo useradd -m -s /bin/bash synology-backup
sudo passwd synology-backup

sudo mkdir -p /backup/synology
sudo chown synology-backup:synology-backup /backup/synology
sudo chmod 750 /backup/synology

df -h /

Fix Oracle Cloud SSH Configuration

This is the part most guides miss. Oracle Cloud places an override file in /etc/ssh/sshd_config.d/ that disables password auth regardless of what you set in the main config. Without fixing this, you’ll get:

synology-backup@100.72.22.38: Permission denied (publickey).

Check for override files:

ls -la /etc/ssh/sshd_config.d/
sudo nano /etc/ssh/sshd_config.d/50-cloud-init.conf

Change:

PasswordAuthentication no

to:

PasswordAuthentication yes

Also verify /etc/ssh/sshd_config has:

PasswordAuthentication yes
PubkeyAuthentication yes
KbdInteractiveAuthentication yes
UsePAM yes
PermitRootLogin no

sudo systemctl restart ssh

Verify the active config (not just the file):

sudo sshd -T | grep passwordauthentication
# Must show: passwordauthentication yes

If it still shows no, grep for any other overrides:

sudo grep -r "PasswordAuthentication" /etc/ssh/

Configure rsync Daemon

HyperBackup’s UI integrates better with rsync daemon mode than SSH-based rsync.

rsyncd.conf

1
uid = synology-backup
2
gid = synology-backup
3
use chroot = no
4
max connections = 10
5
pid file = /var/run/rsyncd.pid
6
log file = /var/log/rsyncd.log
7
timeout = 300
8

9
[synology_backup]
10
path = /backup/synology
11
comment = Synology HyperBackup Storage
12
read only = no
13
list = yes
14
auth users = synology-backup
15
secrets file = /etc/rsyncd.secrets
16
hosts allow = 100.0.0.0/8

hosts allow = 100.0.0.0/8 restricts access to Tailscale IPs only.

rsyncd.secrets

1
synology-backup:YOUR_STRONG_PASSWORD_HERE

sudo chmod 600 /etc/rsyncd.secrets
sudo chown root:root /etc/rsyncd.secrets

sudo systemctl enable rsync
sudo systemctl start rsync
sudo ss -tlnp | grep 873

Test from Synology

# List available modules
rsync synology-backup@100.72.22.38::
# Should show: synology_backup    Synology HyperBackup Storage

export RSYNC_PASSWORD='YOUR_PASSWORD'
rsync -avz --dry-run /volume1/homes/merox/ synology-backup@100.72.22.38::synology_backup/test/

Configure HyperBackup

Open HyperBackup → + → Folders and packages → rsync → rsync-compatible server.

Connection settings:

• Server IP: your Tailscale IP (e.g. 100.72.22.38)
• Port: 873
• Transfer encryption: Disabled (Tailscale already encrypts at network level)
• Username: synology-backup
• Password: from /etc/rsyncd.secrets
• Backup module: select synology_backup

Backup settings:

• Compress backup data: enabled
• Schedule: daily at 2–3 AM
• Integrity check: weekly
• Client-side encryption: enabled — if someone gets access to your Oracle Cloud instance, they can’t read the backups without your encryption password

Rotation: Smart Recycle with 3–5 versions. With ~136GB free and smart rotation, 50–100GB of source data with multiple versions is comfortable.

Monitoring

# Backup size
du -sh /backup/synology/*

# Live during backup
watch -n 10 du -sh /backup/synology

# rsync logs
sudo tail -f /var/log/rsyncd.log

# Auth logs
sudo tail -f /var/log/auth.log | grep synology-backup

Netdata on the Oracle instance gives real-time disk I/O, Tailscale traffic, and storage trends at http://100.72.22.38:19999.

Troubleshooting

“Failed to connect to backup destination” — transfer encryption is enabled with rsync daemon. Disable it.

“Permission denied (publickey)” — Oracle’s SSH override is still blocking password auth. Run sudo sshd -T | grep passwordauthentication and check all files under /etc/ssh/sshd_config.d/.

Slow backup — the first run transfers everything and can take 8–24 hours for 100GB. Check whether Tailscale is using a relay instead of a direct connection with tailscale status. Enable compression in HyperBackup to reduce transfer size.

Running out of space:

du -h /backup/synology/ | sort -rh | head -20
df -h /

Reduce version retention or exclude large cache/temp folders from the backup task.

Security Hardening

After confirming everything works, migrate to SSH key auth:

On Synology:

ssh-keygen -t ed25519 -C "synology-hyperbackup"
cat ~/.ssh/id_ed25519.pub

On Ubuntu:

sudo su - synology-backup
mkdir -p ~/.ssh
nano ~/.ssh/authorized_keys
# Paste Synology's public key
chmod 600 ~/.ssh/authorized_keys
exit

Then re-disable password auth:

sudo nano /etc/ssh/sshd_config.d/50-cloud-init.conf
# PasswordAuthentication no
sudo systemctl restart ssh

Firewall (if ufw enabled):

sudo ufw allow from 100.0.0.0/8 to any port 22
sudo ufw allow from 100.0.0.0/8 to any port 873

Keep the instance updated:

sudo apt update && sudo apt upgrade -y
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

Resources

• Oracle Cloud Always Free Tier
• Tailscale Documentation
• Synology HyperBackup Guide
• rsync Documentation