{"id":18844,"date":"2020-01-08T16:26:42","date_gmt":"2020-01-08T21:26:42","guid":{"rendered":"https:\/\/nuxx.net\/blog\/?p=18844"},"modified":"2023-01-26T08:57:26","modified_gmt":"2023-01-26T13:57:26","slug":"borgbackup-repository-on-synology-dsm-6-2-2","status":"publish","type":"post","link":"https:\/\/nuxx.net\/blog\/2020\/01\/08\/borgbackup-repository-on-synology-dsm-6-2-2\/","title":{"rendered":"BorgBackup Repository on Synology DSM 6.2.2"},"content":{"rendered":"\n

\"\"<\/a><\/p>\n

(UPDATE: With the release of Synology DSM 7.0 this setup will break. It’s easy to fix and I’ve updated added this post<\/a> describing how to make this system work under the new version.)<\/p>\n

Lately I’ve become enamored with BorgBackup (Borg)<\/a> for backups of remote *NIX servers, so after acquiring a Synology DS1019+<\/a> for home I wanted to make it the destination repository for Borg-based backups of nuxx.net<\/a>. While setting up Borg is usually quite straightforward<\/a> (a package or stand-alone binary), it’s not so cut and dry on the Synology DiskStation Manager (DSM)<\/a>; the OS which runs on the DS1019+ and most other Synology NAS’.<\/p>\n

What follows here are the steps I used to make and the reason for each step. In the end it was fairly simple, but a few of the steps are obtuse and only relevant to DSM.<\/p>\n

These steps were written for DSM 6.2.2<\/a>; I have not checked to see if it applies to other versions. Also, I leave out all details of setting up public key authentication for SSH as this is thoroughly documented elsewhere.<\/p>\n

    \n
  1. Enable “User Home Service” via Control Panel<\/em> \u2192 User<\/em> \u2192 Advanced<\/em> \u2192 User Home<\/em> \u2192 Enable user home service<\/em>:<\/strong> This creates a home directory for each user on the machine and thus a place to store .ssh\/authorized_keys<\/code> for the backup user account.<\/li>\n
  2. Create a backup user account and make it part of the administrators<\/em> group:<\/strong> Accounts must be part of administrators<\/em> in order to log in via SSH. Starting with DSM 6.2.2 non-admin users do not have SSH access.<\/li>\n
  3. Change the permissions on the backup user’s home directory to 755:<\/strong> By default users’ home directories have an ACL applied which has too broad of permissions and SSH will refuse to use the key, instead prompting for a password. Home directories are located under \/var\/services\/homes<\/code> and this can be set via chmod 755 \/var\/services\/homes\/backupuser<\/code>. (See this thread<\/a> for details.)<\/li>\n
  4. Put ~\/.ssh\/authorized_keys<\/code>, containing the remote user’s public key, in place under the backup user’s home directory and ensure that the file is set to 700:<\/strong> If permissions are too open, sshd will refuse to use the key.<\/li>\n
  5. Test that you can log in remotely with ssh and public key authentication.<\/strong><\/li>\n
  6. Place the borg-linux64 binary (named borg<\/code>) in the user’s home directory and confirm that it’s executable:<\/strong> Binaries available here<\/a>.<\/li>\n
  7. Create a directory on the NAS to be used the backup destination and give the backup user read and write permissions.<\/strong><\/li>\n
  8. Modify the backup user’s ~\/.ssh\/authorized_keys<\/code> to prevent remote interactive logins and restrict how borg is run:<\/strong> This is optional, but a good idea.

    In this example only the     borg serve<\/code><\/a> command (the borg repository server) can be run remotely, is restricted to 120GB of disk, in a repository on DSM under the backup directory of \/volume2\/Backups\/borg<\/code>, and from remote IP of 192.168.0.23:

    command=\"\/var\/services\/homes\/backupuser\/borg serve --storage-quota 120G --restrict-to-repository \/volume2\/Backups\/borg\",restrict,from=\"192.168.0.23\" ssh-rsa AAAA[...restofkeygoeshere...] remoteuser@remoteserver.example.com<\/code><\/li>\n<\/ol>\n

    Please note, there are a number of articles about enabling public key authentication for SSH on DSM which mention uncommenting and setting PubkeyAuthentication yes<\/code> and AuthorizedKeysFile .ssh\/authorized_keys<\/code> in \/etc\/ssh\/sshd_config<\/code> and restarting sshd. I did not<\/span> need to do this. The settings, as commented out, are the defaults and thus already set that way (see sshd_config(5)<\/a><\/code> for details).<\/p>\n

    At this point DSM should allow a remote user, authenticating with a public key and restricted to a particular source IP address, to use the Synology NAS as a BorgBackup<\/a> repository. For more information about automating backups check out this article about how I use borg for backing up nuxx.net<\/a>, including a wrapper script that can be run automatically via cron<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

    (UPDATE: With the release of Synology DSM 7.0 this setup will break. It’s easy to fix and I’ve updated added this post describing how to…<\/p>\n

    Continue readingBorgBackup Repository on Synology DSM 6.2.2<\/span><\/a><\/div>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-18844","post","type-post","status-publish","format-standard","hentry","category-computers","entry"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/18844","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/comments?post=18844"}],"version-history":[{"count":19,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/18844\/revisions"}],"predecessor-version":[{"id":19616,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/18844\/revisions\/19616"}],"wp:attachment":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/media?parent=18844"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/categories?post=18844"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/tags?post=18844"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}