Borg backup
Topics: Backup
Borg can serve a backup repository over SSH with a key restricted to that repository.
Subtopics
Restricted Borg repositories over SSH
Use a dedicated SSH key per backup client and restrict it in the storage account’s authorized_keys file:
restrict,command="cd /path/to/repository-root; borg serve --restrict-to-path /path/to/repository-root" ssh-ed25519 AAAA... backup-client
The forced command prevents a shell and starts only borg serve. --restrict-to-path confines that key to the repository root. Changing directory also lets the client use a relative repository location:
ssh://backup@backup-host/./client.borg
This resolves below the directory selected by the forced command, rather than the storage account’s home directory. A separate key and restricted root for each client limits the blast radius of a leaked key.