How to configure an SSH alias for rsync key authentication

Unattended rsync jobs fail when SSH must pause for a password, an unknown host key, or a choice between several private keys. A named client alias fixes the destination, account, identity file, and host-key policy in one place so scheduled transfers can use a short remote target.

The private key and its matching /home/backup/.ssh/authorized_keys entry are prerequisites. The client configuration does not create a key pair or install the public key on the server; it selects an existing dedicated key for the remote account.

Host identity must be pinned before BatchMode is enabled because unattended sessions cannot approve a new fingerprint. The remote account also needs filesystem permissions limited to the intended transfer tree; client-side key selection does not restrict which server paths that account can read or write.

Steps to configure an SSH alias for rsync key authentication:

Confirm that the dedicated private key already exists.
```
$ ls -l ~/.ssh/rsync_backup_ed25519
-rw------- 1 operator operator 411 Jul 11 07:02 /home/operator/.ssh/rsync_backup_ed25519
```
If the key pair or remote public-key entry is missing, create and install them before continuing.
Related: Create an SSH key pair
Related: Copy an SSH public key to a server
Restrict the private key to its owner.
```
$ chmod 600 ~/.ssh/rsync_backup_ed25519
```
Keep unattended private keys outside shared directories and readable only by the automation account. A passphrase-protected key also needs an approved agent or secret-unlocking mechanism before a noninteractive job can use it.
Collect the server's Ed25519 host key in a temporary file.
```
$ ssh-keyscan -t ed25519 source.example.net > ~/.ssh/source.example.net.hostkey
```
ssh-keyscan retrieves the key presented over the network but does not authenticate it. Do not trust the file until its fingerprint matches a value obtained from the server console, administrator, or another independent channel.
Print the collected host-key fingerprint and compare it with the trusted value.
```
$ ssh-keygen -lf ~/.ssh/source.example.net.hostkey
256 SHA256:YdrFkleTx+3XBO92BE2MGGwMrxrc293DFvlI1Sm+I4A source.example.net (ED25519)
```
Stop if the key type or SHA256 fingerprint differs.
Related: Verify SSH host key fingerprints

Move the verified key into a dedicated host-key database.

$ mv ~/.ssh/source.example.net.hostkey ~/.ssh/rsync_known_hosts

Restrict the host-key database to its owner.
```
$ chmod 600 ~/.ssh/rsync_known_hosts
```
Open the per-user OpenSSH client configuration.
```
$ nano ~/.ssh/config
```
Add the rsync-source alias before any broad matching Host * block.
```
Host rsync-source
  HostName source.example.net
  User backup
  IdentityFile ~/.ssh/rsync_backup_ed25519
  IdentitiesOnly yes
  PreferredAuthentications publickey
  BatchMode yes
  StrictHostKeyChecking yes
  UserKnownHostsFile ~/.ssh/rsync_known_hosts
```
IdentitiesOnly limits authentication to configured identities, BatchMode disables interaction, and StrictHostKeyChecking yes refuses unknown or changed server keys. More specific host blocks belong before broad defaults because OpenSSH normally uses the first value obtained for each directive.
Related: Set per-host SSH identity files
Tool: SSH Config Snippet Generator
Restrict the client configuration after saving it.
```
$ chmod 600 ~/.ssh/config
```

Inspect the effective settings without opening a connection.

$ ssh -G rsync-source
host rsync-source
user backup
hostname source.example.net
port 22
##### snipped #####
batchmode yes
identitiesonly yes
stricthostkeychecking true
##### snipped #####
preferredauthentications publickey
identityfile ~/.ssh/rsync_backup_ed25519
userknownhostsfile /home/operator/.ssh/rsync_known_hosts
##### snipped #####

Correct any unexpected hostname, user, key path, trust file, or interaction setting before connecting.

Confirm that the alias opens a noninteractive key-authenticated session as the intended account.
```
$ ssh rsync-source 'id -un'
backup
```
A dedicated account is least privilege only when server-side permissions confine it to the required paths. The authorized_keys restrict option disables forwarding, PTY allocation, and user RC files, but it does not by itself limit commands or filesystem access; use reviewed filesystem permissions or an rrsync receiver policy when path confinement is required.
Preview the transfer through the alias.
```
$ rsync --archive --itemize-changes --dry-run ~/release/ rsync-source:incoming/
.d...p..... ./
<f+++++++++ app.conf
cd+++++++++ public/
<f+++++++++ public/index.html
```
A single colon selects the remote-shell transport, so rsync passes rsync-source to SSH and inherits the alias settings. Review every itemized path before removing --dry-run.
Related: How to preview rsync changes before syncing
Run the verified transfer.
```
$ rsync --archive --itemize-changes ~/release/ rsync-source:incoming/
.d...p..... ./
<f+++++++++ app.conf
cd+++++++++ public/
<f+++++++++ public/index.html
```
This updates matching remote paths and creates missing ones. It does not remove remote-only files; use --delete only in a separately reviewed mirror workflow.

List the remote destination through the same alias.

$ ssh rsync-source 'ls -lR incoming'
incoming:
total 8
-rw-r--r-- 1 backup backup   23 Jul 11 07:02 app.conf
drwxr-xr-x 2 backup backup 4096 Jul 11 07:02 public
 
incoming/public:
total 4
-rw-r--r-- 1 backup backup 14 Jul 11 07:02 index.html

Calculate a checksum for a representative source file.

$ sha256sum ~/release/app.conf
5d14c2d385f515a3d3a995367453c7cb6a8a24aaa71e4f957fd1823583b5081e  /home/operator/release/app.conf

Calculate the corresponding remote checksum through the alias.
```
$ ssh rsync-source 'sha256sum incoming/app.conf'
5d14c2d385f515a3d3a995367453c7cb6a8a24aaa71e4f957fd1823583b5081e  incoming/app.conf
```
Matching digests prove that the alias remained usable for the transfer and that the representative file arrived unchanged.