Setting up SSH keys (one key = one purpose)

SFTP, SSH, rsync and Borg authenticate with SSH keys. For security reasons the server ties the permitted action firmly to the key: one key = one purpose.

Creating a key (Linux/macOS)

Create a separate key for each type of access, e.g. for Borg:

ssh-keygen -t ed25519 -f ~/.ssh/mbs-borg -C "backup-storage borg"

This creates two files: the private key (~/.ssh/mbs-borg, stays secret) and the public key (~/.ssh/mbs-borg.pub). You store the contents of the .pub file in the client area.

On Windows you can use PuTTYgen or ssh-keygen in PowerShell.

Storing the key

In the client area under Services → your Backup Storage → “SSH-Schlüssel” (SSH keys) you add the public key and select the “Verwendungszweck” (intended purpose):

• sftp — file transfer only (no shell)
• ssh — interactive shell
• borg — read/write the Borg repository
• borg-append — append only (ransomware-proof: no deleting or overwriting)
• rsync — rsync read and write
• rsync-ro — rsync read only
• rsync-wo — rsync write only

Why a key has only one purpose

The same key cannot be stored for two purposes (e.g. rsync and Borg). So always connect with the key that matches the purpose, using -i ~/.ssh/mbs-<purpose>. If you use the wrong key by mistake, the connection fails (e.g. Borg then reports an rsync error).

Recommendation: ransomware protection with borg-append

For automated backups we recommend a key with the purpose borg-append. Even a compromised client can then neither delete nor overwrite existing backups.