Bareos - Hardened Backup, Archiving and Recovery Server

What is Bareos

Bareos (Backup Archiving Recovery Open Sourced) is an open-source network backup solution written in C++, split into cooperating daemons: a director that schedules jobs and owns the catalog, a storage daemon that writes backup volumes, and file daemons that run on the machines being protected. It performs full, differential and incremental backups on a schedule, with retention driven by pools and volumes, browsable file-level restore, job verification, client-side compression and encryption, and protection of Linux, Windows and macOS clients from one director. Everything is driven from a text console or the bundled PHP web interface, and job history, file indexes and volume state are persisted in a PostgreSQL catalog on the instance.

Why self-host Bareos

Backups are the copy of your data that outlives an incident. Running your own server keeps the backup data, the file index and the retention policy inside your own subscription, under your own keys and access rules. There is no per-agent or per-terabyte licence as the estate grows, and restores never depend on a third party being reachable on the day you need them.

What this VM image adds

Security hardening:

• Every daemon secret regenerated per instance - the packages generate them at install time, so shipping them as-is would put identical secrets on every deployment
• Verified before start - first launch confirms no build-time secret survives before any daemon starts
• No catalog password to leak - the PostgreSQL catalog is reached over a local socket with peer authentication
• Addresses resolved on the instance - storage and client addresses are set at first launch, not baked into the image
• Web interface behind TLS - served by nginx on port 443; the director, storage and file daemons are not web-facing
• Backup ports scoped to private networks - control and data ports are recommended for private ranges, so clients reach the server over your own virtual network or VPN
• No third-party calls from the browser - vendor upsell links and the version beacon removed from the web interface; copyright and licence notices preserved
• CVE scan - operating system packages are scanned with Trivy before every release
• UFW firewall - only ports 22, 80, 443 and the two backup ports accepted
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - password authentication disabled, key-only
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR; /tmp as tmpfs with nosuid, nodev, noexec
• IMDS endpoints - egress rules pre-configured

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Scope of this build

This image installs the Bareos community packages published by the project. The VMware plugin family is not installed: it wraps a proprietary disk-access kit that cannot be redistributed in an image. The community build carries no vendor support entitlement; support for this image is provided by Lynxroute.

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 or larger). Attach a data disk for backup volumes before real use.
2. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
3. Read credentials: sudo cat /root/bareos-credentials.txt
4. Open https://<PUBLIC_IP>/, accept the self-signed certificate warning, and log in with Director localhost-dir, username admin, and the password from step 3
5. Run the self-test backup: sudo bconsole, then run job=backup-bareos-fd level=Full yes and list jobs

Browse and restore with restore in the same console. Backup volumes are written to /var/lib/bareos/storage - mount a data disk there before real backups. Replace the self-signed certificate before production use: sudo certbot --nginx -d yourdomain.com