I want to backup some files that can only be read as root to a remote repository that only my user has access to. If I run borg as myself using /etc as my source I'll get permission-denied errors when trying to read some files like /etc/crypttab. If I run borg as root with sudo, the files can be read but I can't write to the repository because my local root user doesn't have ssh access to the remote repository and it doesn't have the repo key for that repository (ie /root/.borg/ doesn't exist).

To recap:

$ borg create ssh://me@remote:/backup/my_repo.borg::demo /etc

will error because I can't read some files in /etc, which I do want backed up. And

$ sudo borg create ssh://me@remote:/backup/my_repo.borg::demo /etc

will fail because root doesn't have neither access to ssh://me@remote nor the repokey.

Now an obvious work around would be give root ssh access and the repo key but I'm wondering if there is a better solution.


If you are running borg as root via sudo, you are not using the generated key from the user but from root. root has not configured to use the private keys of the users (despite it would have access to).

You should fix this by creating a new ssh-key (with sudo ssh-keygen) and accept this one also on the remote side (with sudo ssh-copy-id me@remote and typing the password).

Another (but less good) solution would be to use the ssh-key of the user even when running the command as root: export BORG_RSH='ssh -i ~/.ssh/id_rsa' && sudo borg create ssh://me@remote:/backup/my_repo.bor::demo /etc—but … don't ;)

  • Adding local root's ssh key to me@remote's authorized_keys was something I said I wanted to avoid. It also won't be enough because my local root will also need the repo key since me@local made the repo. BORG_RSH is the sort of work around I'm looking for. Would BORG_CONFIG_DIR also work? Also why is this a "less good" solution?
    – cheezsteak
    Dec 6 '20 at 4:55
  • 1
    for automated scripts it is always best practise to create a very own keypair. Imagine the private key of me gets compromised because e.g. you lost your laptop on the train station. if you are revoking this key, your backups aren't working anymore. It doesn't matter how the repo made, it only matters, who has ssh-access which can be configured afterwards. You should think about creating a key e.g. to /etc/borg/id_rsa.
    – blaimi
    Dec 6 '20 at 5:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.