Blog

Agentless backup over SFTP/SSH, zero deployment on the remote host, support for network equipment (Cisco/Juniper/MikroTik/…), NAS (Synology/QNAP/TrueNAS), cloud SFTP (AWS Transfer, Hetzner Storage Box), and cloud VMs. Replaces fragile SSHFS/NFS/CIFS mountpoints with stateless per-job SFTP connections.

Companion document to the PodHeitor SFTP plugin page.

1. The problem: SSHFS/NFS/CIFS mountpoints are fragile

The traditional “remote backup without a Bacula agent” pattern is to mount the remote filesystem via SSHFS/NFS/CIFS on the FD host. That sounds simple but fails in the field in many ways:

2. Architectural model

┌──────────────┐     PTCOMM protocol      ┌──────────────────────────┐
│  Bacula FD   │◄═══════════════════════►  │ podheitor-sftp-backend   │
│              │     (stdin/stdout)         │ (Rust + libssh2)         │
│ loads .so:   │                           │                          │
│ podheitor-   │   Handshake → Job Info    │ connect() → walk() →    │
│ sftp-fd.so   │   → Params → Start →     │ FNAME/STAT/DATA →       │
│ (Rust cdylib,│   ← file data ←          │ include/exclude filter   │
│ metaplugin-  │                           │                          │
│ rs)          │                           │                          │
└──────────────┘                           └──────────────────────────┘

Same PodHeitor cdylib + backend architecture. The backend hosts the SFTP client (libssh2 via Rust ssh2), recursively walks the remote path, and streams metadata + data over PTCOMM. No intermediate disk; the FD receives bytes directly.

3. Features

• Agentless — SFTP/SSH only, no software on remote hosts
• Full / Incremental / Differential — native Bacula levels via mtime comparison
• Include/exclude filters — glob-based (*.pdf, *.tmp) for files and directories
• Metadata preserved — permissions, UID/GID, timestamps, symlinks
• Authentication — SSH key (ed25519, RSA, ECDSA), agent forwarding, password
• Host key verification — MITM protection via known_hosts
• File listing — estimate (pre-backup), catalog queries, restore tree browsing
• Multiple sources — N SFTP servers in a single FileSet
• Compression & Encryption — Bacula’s native LZ4/GZIP + AES

4. Documented use cases

4.1 Network equipment

4.2 NAS and Storage

4.3 Cloud SFTP services

4.4 Cloud VMs and hosting

AWS EC2, GCP Compute, Azure VMs, DigitalOcean, Linode, Vultr, Hetzner Cloud, OVH; cPanel/WHM, Plesk, DirectAdmin — any hosting with SFTP/SSH.

4.5 Embedded and IoT

Raspberry Pi, IoT gateways — lightweight backup without mount overhead. Devices with limited storage — no FUSE/mount layer required.

5. Plugin parameters

6. Quick start

# 1. Prepare key for SFTP access
sudo mkdir -p /etc/bacula/.ssh
sudo ssh-keygen -t ed25519 -f /etc/bacula/.ssh/id_ed25519 -N ""
sudo ssh-copy-id -i /etc/bacula/.ssh/id_ed25519.pub [email protected]

# 2. Configure FileSet
FileSet {
  Name = "SFTP-Backup"
  Include {
    Options { Signature = SHA256; Compression = LZ4 }
    Plugin = "podheitor-sftp: host=server.local user=backup keyfile=/etc/bacula/.ssh/id_ed25519 path=/data"
  }
}

Job {
  Name     = "SFTP-Daily"
  Type     = Backup
  Level    = Incremental
  FileSet  = "SFTP-Backup"
  Client   = myserver-fd
  Storage  = File1
  Pool     = Default
  Schedule = "WeeklyCycle"
}

7. Include/exclude examples and multi-source

# PDFs and Office docs only
Plugin = "podheitor-sftp: host=server user=backup path=/data include=*.pdf,*.docx,*.xlsx"

# Skip temp and cache
Plugin = "podheitor-sftp: host=server user=backup path=/data exclude=*.tmp,*.cache,*.log"

# Network switch — configs only
Plugin = "podheitor-sftp: host=10.0.0.1 user=admin path=/ include=*.conf,*.cfg verify_host=no"

# MikroTik — backup and export files
Plugin = "podheitor-sftp: host=10.0.0.3 user=admin path=/ include=*.backup,*.rsc verify_host=no"

Multi-source in a single FileSet:

FileSet {
  Name = "AllServers"
  Include {
    Options { Signature = SHA256; Compression = LZ4 }
    Plugin = "podheitor-sftp: host=web1.prod user=deploy keyfile=/etc/bacula/.ssh/key path=/var/www exclude=*.log"
    Plugin = "podheitor-sftp: host=web2.prod user=deploy keyfile=/etc/bacula/.ssh/key path=/var/www exclude=*.log"
    Plugin = "podheitor-sftp: host=nas.local user=admin keyfile=/etc/bacula/.ssh/key path=/volume1/shared"
    Plugin = "podheitor-sftp: host=switch-core user=admin keyfile=/etc/bacula/.ssh/key path=/ include=*.conf verify_host=no"
  }
}

8. Restore

Restore operates in the @sftp/host:port/path namespace:

bconsole
* restore where=/tmp/sftp-restore select all done yes

9. Requirements

10. License posture

Proprietary — LicenseRef-PodHeitor-Proprietary (both the FD-side .so and the backend binary). No statically-linked third-party code in this product is AGPL or any other copyleft. Transitive Rust dependencies (ssh2, libssh2-sys, libc, parking_lot, openssl-sys) are all MIT / Apache-2.0.

Ready to evaluate?

30-day free trial for qualified SFTP deployments (network equipment, NAS, cloud, embedded). We guarantee at least 50% off vs Bacula Enterprise, Veeam, or Commvault, with more features — including pure agentless without the fragile mountpoint the competitor forces.

Heitor Faria — Founder, PodHeitor International
✉ [email protected]
☎ +1 (789) 726-1749 · +55 (61) 98268-4220 (WhatsApp)
🔗 PodHeitor SFTP plugin page

Disponível em: Português (Portuguese (Brazil))EnglishEspañol (Spanish)