How to preserve numeric user and group IDs with rsync

User and group names are local labels for numeric ownership stored by a Unix filesystem. During a restore or host migration, the same account names can point to different numbers on the destination, which can attach a copied tree to identities that did not own it on the source.

The rsync --numeric-ids option sends raw UID and GID values instead of mapping owner and group names between account databases. Archive mode enables owner and group preservation, but the receiving process still needs permission to assign arbitrary IDs.

Run the pull from the destination host so elevated access stays on the receiving side while the SSH source account needs only read access to the selected tree. Use an empty or reviewed destination path, and create the matching destination accounts before service cutover if stat reports the preserved numbers as UNKNOWN.

1. Inspect numeric and named ownership on the source host.

   $ ssh -o BatchMode=yes backup@source.example.net "stat -c '%n %u:%g %U:%G' /srv/source/app.db /srv/source/releases"
   /srv/source/app.db 8123:8456 appuser:appgroup
   /srv/source/releases 8123:8456 appuser:appgroup

   The source SSH account needs read and traversal access to every selected path. The %u:%g fields are the ownership values that must survive the migration.

2. Confirm that the destination maps the same name to different IDs.

   $ id appuser
   uid=9001(appuser) gid=9002(appgroup) groups=9002(appgroup)

3. Preview the destination-side pull with numeric ID preservation.

   $ sudo rsync --archive --numeric-ids --dry-run --itemize-changes backup@source.example.net:/srv/source/ /srv/destination/
   .d..t.og... ./
   >f+++++++++ app.db
   cd+++++++++ releases/
   >f+++++++++ releases/manifest.txt

   The live command can replace matching destination paths and assign sender-supplied ownership numbers. Check every listed path, use a dedicated destination tree, and back up existing destination data before continuing.

4. Pull the source tree into the destination.

   $ sudo rsync --archive --numeric-ids --itemize-changes backup@source.example.net:/srv/source/ /srv/destination/
   .d..t.og... ./
   >f+++++++++ app.db
   cd+++++++++ releases/
   >f+++++++++ releases/manifest.txt

5. Verify numeric ownership on a transferred file and directory.

   $ stat -c '%n %u:%g %U:%G' /srv/destination/app.db /srv/destination/releases
   /srv/destination/app.db 8123:8456 UNKNOWN:UNKNOWN
   /srv/destination/releases 8123:8456 UNKNOWN:UNKNOWN

   The destination has no account names for 8123:8456, but both objects retain the source UID and GID. Add or reconcile destination account records before starting software that requires a named owner.