Production BorgBackup Workflows: Deduplication, Pruning, and Verification

BorgBackup (Borg) is a premier deduplicating backup tool designed for Linux systems administrators who demand speed, security, and low storage overhead. Borg splits files into variable-length chunks, computes cryptographic hashes, and stores only unique chunks in an authenticated repository. This means backing up a 50GB virtual disk or multi-gigabyte log directory daily often adds only a few dozen megabytes of new storage.

When deployed over SSH between Linux VPS instances, Borg provides an append-only mode that protects historical backups from ransomware even if the client server is fully compromised.

Ransomware Resistance via Append-Only SSH Repositories

In modern infrastructure security, a compromised web server or database instance can have its root credentials stolen. If the client root user possesses write-and-delete permissions on the backup server, an attacker or automated ransomware script can delete all historical backups before encrypting the live disk.

Borg prevents this attack vector through its append-only repository mode. By forcing SSH command execution on the storage host, the client is permitted to add new chunks, write transaction manifests, and read historical snapshots, but is cryptographically forbidden from overwriting, deleting, or truncating existing segments. If a server is compromised, all historical snapshots remain completely intact and recoverable on the storage host.

Setting up Borg and SSH Key Isolation

Install BorgBackup on both the source server and the storage host:

# Install Borg on Ubuntu 24.04
sudo apt-get update
sudo apt-get install -y borgbackup

# Generate dedicated non-interactive SSH key pair
sudo ssh-keygen -t ed25519 -N "" -f /root/.ssh/id_borg -C "borg-backup@vps"

On the backup destination server, restrict the SSH public key inside ~/.ssh/authorized_keys to enforce append-only Borg execution:

# Restricted authorized_keys configuration on backup host
command="borg serve --restrict-to-repository /var/backups/client-repo --append-only",no-port-forwarding,no-X11-forwarding,no-pty ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... borg-backup@vps

This configuration ensures that an attacker possessing the private key cannot delete or overwrite existing archive chunks.

Initializing an Encrypted Repository

Initialize the remote Borg repository using repokey-blake2 authenticated encryption:

# Export the repository environment variables
export BORG_REPO="ssh://backupuser@10.0.0.8:22/var/backups/client-repo"
export BORG_RSH="ssh -i /root/.ssh/id_borg -o StrictHostKeyChecking=accept-new"
export BORG_PASSPHRASE="SecureBorgEncryptionPassphrase2026"

# Initialize the repository
borg init --encryption=repokey-blake2 $BORG_REPO

Borg saves the encryption key inside the repository while encrypting it with your passphrase. Always save a detached copy of the key using borg key export.

Expand

Writing the Automated Production Backup Script

Create a resilient backup script at /usr/local/bin/borg-backup.sh with error handling, locking guards, and automated retention pruning:

#!/usr/bin/env bash
set -euo pipefail

export BORG_REPO="ssh://backupuser@10.0.0.8:22/var/backups/client-repo"
export BORG_RSH="ssh -i /root/.ssh/id_borg"
export BORG_PASSPHRASE="SecureBorgEncryptionPassphrase2026"

TIMESTAMP=$(date -u +"%Y-%m-%d_%H%M%S")
ARCHIVE_NAME="vps-backup-$TIMESTAMP"

echo "[$(date)] Starting Borg backup: $ARCHIVE_NAME"

# Create archive with LZ4 compression
borg create --verbose --stats --show-rc   --compression lz4   --exclude-caches   --exclude '/var/cache'   --exclude '/tmp'   "$BORG_REPO::$ARCHIVE_NAME"   /etc /var/www /srv /home

echo "[$(date)] Applying retention pruning policy"

# Retain 7 daily, 4 weekly, and 6 monthly archives
borg prune --list --show-rc --prefix 'vps-backup-'   --keep-daily 7   --keep-weekly 4   --keep-monthly 6   "$BORG_REPO"

echo "[$(date)] Backup completed successfully."

Make the script executable and schedule it via systemd timer or cron:

sudo chmod 700 /usr/local/bin/borg-backup.sh
sudo /usr/local/bin/borg-backup.sh

Repository Health Verification and Restore Testing

Periodically audit repository indexes and test archive extraction:

# Check repository consistency
borg check "$BORG_REPO"

# List contents of the latest archive
borg list "$BORG_REPO::$ARCHIVE_NAME"

# Perform an extraction test of /etc
mkdir -p /tmp/borg-test && cd /tmp/borg-test
borg extract "$BORG_REPO::$ARCHIVE_NAME" etc/nginx
ls -la etc/nginx

Borg delivers lightning-fast backups and bulletproof deduplication across production fleets.

Deploy your secondary storage nodes and Linux VPS on Netbay in under 60 seconds with High-Speed SSD and DDoS protection in Lucknow DC01 — netbayhosts.in.