If i have vps hosting on some company, virtualized KVM, persons from this company can go into rclone mount folder?
How can i protect it without having to enter password for every time i want to mount it after server reboot?
I’m pretty sure that if the --allow-other flag is not set, VPS owners can’t access the files, even if they have access to your disk. Citation needed though.
You should also encrypt your config file.
Could you please explain how to encrypt the config file?
Thanks, unfortunately I could not find this with google
Unfortunately, I think there are some limitation to these suggestions.
- Encrypting the config-file would not secure the mount itself actually.
- Not using the --allow-other flag would lead to Emby/Plex not being able to read the mount as well.
If I am wrong the please correct me!
You can’t protect it easily at all.
VPS owners have access to the raw disk files and can easily mount the disk file on another VM and go through the config files, your ssh private keys, etc. So even if you encrypt your rclone config as some have suggested, it would be trivial to find where on the disk you are storing the config password.
This isn’t to say it can’t be done but it isn’t easy and requires you to wear a tin foil hat 
But they can’t access the files since they are not actually there right? I mean when you mount a remote, the files are only accessible to you, through the rclone process which is running on your RAM. There are not actual physical files that would show up if you attached the disk on another VM. Am I missing something?
@amaklp, I am no expert in this matter but imo you are seeing this correctly. Whenever the disk would be detached the folder of rclone mount would disappear or at least the files wouldn’t be visible anymore.
But: I might be seeing this wrong!
€dit: @Stokkes the config file is on the server, right but it is encrypted and without the key nobody can see what’s actually inside the config file.
You’re correct, if the config is encrypted, nobody can see. But… for those that have scripts or a systemd service or something else that mounts the remote, or executes automatic rclone move (or copy) commands, then you have to read the password from a flat file on the system. And that file (or script) can be read by VPS owners.
If you’re manually executing all your rclone commands, then you don’t have to worry about this, but if you’re doing anything automated, how else are you loading the password so rclone can read the config?
As per the rclone docs:
If you are in an environment where that isn’t possible, you can add a password to your configuration. This means that you will have to enter the password every time you start rclone.
Just something to keep in mind.
Not sure what you’re pointing to. If you set an environment variable with the pass, that can easily be read by anyone with physical access to the VPS
Sorry I’m from the phone but you don’t set the password in the file. You type source set pass and you type the password once and it’s ok.
could you give an example how that exactly works? I didn’t understand the documentation tbh.
For now my config is encrypted and I have to enter my password manually every time I want to run a rclone command.
Merry Christmas, guys!
I create a file called set-rclone-password
#!/bin/echo
read -s RCLONE_CONFIG_PASS
export RCLONE_CONFIG_PASS
I then type
source set-rclone-password
I type my password and press enter.
Then every rclone command won’t ask for password.
If I log out I must do the source command again, unless I do it on a screen
The password isn’t stored anywhere.
1 Like