Consider that backups have been made to a remote repository, located on /mnt/backup on server.

For non-Borg users, a repository consists of multiple archives. A single archive is created every time a backup is made. Now, suppose I want to extract a specific archive - for simplicity, the most recent one.

The way I'm currently doing this is to get a list of archives from the remote repository, and then store their names in a mailarchives array. That looks like:

mapfile -t mailarchives < <(borg list --short 'faheem@server:/mnt/backup')  

Then I extract all the files from mailarchive[-1] (the most recent archive), to verify that the archive is valid and that I can restore from it. That looks like:

borg extract -n 'faheem@server:/mnt/backup'::"${mailarchives[-1]}"

However, this uses colossal amounts of data to copy everything locally. So, my question is whether it's possible to do all this remotely, and only transmit the result (whether success or failure) locally via ssh. I think it should be possible, but I don't know exactly how.

An even simpler example is

borg check faheem@server:/mnt/backup

which for some reason also consumes lots of data.

Also, despite appearances, this question isn't really Borgbackup specific. It could be phrased more generally as: if I have want to run a check on a remote machine, but which normally requires a lot of data to be downloaded locally if I want to run the check locally, can I run this check remotely, and just pass the result of success or failure to local?

And finally, a note from Borg's main/lead developer:

ThomasWaldmann> faheem: borg returns 0 on success, 1 on warning, 2 on error.


The actual answer will depend on how you are going to "check" your backup and on the ability of your backup tool to perform checks.

I will assume that you are using borg and that borg check is enough to you. Please, edit your question if you have different, specific backup validation requirements.

Running borg remotely:

Being able to perform a borg check remotely requires 1) that you can run commands on the remote server and 2) that borg is installed on the remote server. It is probably the most common setup, but alternatives are available (the repository could be on a remote volume mounted locally, e.g. with sshfs).

If your repository is not encrypted you can check it with a command as:

$ ssh user@host 'borg --show-rc check /path/to/repo'

borg will run on the remote server - not on the local machine. The --show-rc option will make borg output its exit code; it will be shown on your local console (standard output is redirected). You can add the --verbose and --progress options to get more information.
You can also add the --verify-data option to have all data extracted from the repository, decompressed and checked (remotely) too.

When you run borg check user@server:/path/to/repo/ locally, even without the --verify-data option, all the compressed data in the repository is transferred from remote to local.

The reason why borg documentation defaults to running borg locally is probably that the recommended configuration includes encryption, and for security reasons encryption/decryption should be only done locally.

If your repository is encrypted:

  • If you chose keyfile encryption, you will need to provide the key file to the remote process. This usually means copying it from ~/.config/borg/keys/key_name to the same path on the remote server (refer to the official documentation for alternatives).
  • If you chose repokey encryption, the remote process will need to ask you for your passphrase.

To let the remote process ask you for your passphrase you will have to invoke ssh with the -t option, that will allocate a pseudo-terminal on the remote server:

$ ssh -t user@host 'borg --show-rc check /path/to/repo'

Important security considerations:

An encrypted repository makes it possible to use a partially trusted server - a server you trust enough to be sure that your data won't be deleted or lost, but that you don't want to actually see your data.

If you don't completely trust the remote server you might not want to give it your encryption key and/or passphrase. This will prevent you from remotely checking archives and data.
Only repository checking is possible without decrypting it: it is what happens if you invoke borg check --repository-only; data chunks are not checked - see the online documentations for details.


If borg check is what you want, can you not just run it on server to avoid the huge data transfer? Maybe I am confused about what you are trying to accomplish. It would look something like this:

ssh faheem@server
screen # so you can resume after disconnect (optional)
borg check /mnt/backup

On the other hand, if you want to actually verify the files yourself rather than trusting Borg's assertion that the files are okay, you could:

  • ssh to the server
  • extract the archive to a temporary directory on the server (so it would use server storage but not upload/download data)
  • use a tool such as hashdeep to compute hashes for each file
  • delete the temporary directory on the server
  • download the file of hashes
  • compare the hashes with your actual files

If my suggestions are way off, perhaps you can better clarify for me what it is you are trying to do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.