For SFTP, SSH, rsync and Borg you sign in to your Managed Backup Storage with an SSH key, not with a password. The rule is: one key = one purpose. The storage recognizes from the key what you are allowed to do with it.
Creating a key
Create a separate key for each access, for example for Borg (Linux and macOS):
ssh-keygen -t ed25519 -f ~/.ssh/mbs-borg -C "backup-storage borg"This creates two files: the private key ~/.ssh/mbs-borg — it stays secret on your machine — and the public key ~/.ssh/mbs-borg.pub. You add the contents of the .pub file in the Client Area. On Windows, use ssh-keygen in PowerShell or PuTTYgen.
Adding a key
- Open your Managed Backup Storage and go to the SSH-Schlüssel (SSH keys) section.
- In the drop-down, choose the purpose (see table).
- Under Label, enter a name that lets you recognize the key, such as
server01 borg. - Paste the contents of the
.pubfile into the large text field. It starts withssh-ed25519orssh-rsa. - Click Schlüssel hinzufügen (add key).
| Purpose | What the key may do |
|---|---|
sftp | transfer files only, no command line |
ssh | restricted command line |
borg | read and write a Borg repository |
borg-append | Borg append only — no deleting, no overwriting |
rsync | rsync read and write |
rsync-ro | rsync read only |
rsync-wo | rsync write only |
You remove a key that you no longer need with löschen (delete) at the end of the row.
Why a key has only one purpose
You cannot add the same key for two purposes, such as rsync and Borg. So always connect with the matching key by passing it with -i ~/.ssh/mbs-<purpose>. If you use the wrong one, the connection fails — Borg then reports an rsync error, for example.
Recommendation against ransomware: give automatic backups a key with the purpose borg-append. Even if an attacker takes over the machine, they cannot delete or overwrite existing backups with it.
