Catalog / Business applications

Bareos

Backup, archiving and recovery server with a PostgreSQL catalog and web UI

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace25.1.2-pre64.8f8d5d63e↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
25.1.2-pre64.8f8d5d63e$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-24Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseAGPL-3.0
UpstreamBareos GmbH & Co. KG
Machine-readableproduct.json · catalog.json
What is Bareos

Bareos (Backup Archiving Recovery Open Sourced) is an open-source network backup solution written in C++ and split into cooperating daemons: a director that schedules jobs and owns the catalog, a storage daemon that writes backup volumes, and file daemons that run on the machines being protected. It performs full, differential and incremental backups on a schedule, with retention driven by pools and volumes, browsable file-level restore, job-level verification, client-side compression and encryption, and backup of Linux, Windows and macOS clients through the same director. Everything is driven from a text console or the bundled PHP web interface. Job history, file indexes and volume state are persisted in a PostgreSQL catalog on the instance. AGPL-3.0 license, no vendor lock-in. Running your own backup server keeps the catalog, the file index and the backup data itself inside your own AWS account.

SCOPE OF THIS BUILD

This image installs the Bareos community packages published by the project. The VMware plugin family is deliberately not installed, because it wraps a proprietary third-party disk-access kit that cannot be redistributed in an image. The community build carries no vendor support entitlement.

What the Lynxroute image adds

Security hardening:

  • Every daemon secret regenerated uniquely on each instance at first launch - the packages generate them at install time, so an image that shipped them as-is would put the same secrets on every instance
  • First launch verifies that no build-time secret survives before any daemon is started
  • The PostgreSQL catalog is reached over a local socket with peer authentication, so there is no catalog password stored anywhere
  • The storage and client addresses are resolved on the instance at first launch instead of being baked in
  • The web interface is served by nginx over TLS on port 443; the director, storage and file daemons are not web-facing
  • The backup control and data ports are recommended only for private network ranges, so backup clients reach the server over your own VPC or VPN
  • Vendor upsell links and the outbound version beacon removed from the web interface, so the buyer's browser makes no third-party calls; copyright and licence notices are preserved
  • UFW firewall pre-configured - only ports 22, 80, 443 and the two backup ports accepted
  • fail2ban and AppArmor pre-configured
  • CVE scan - operating system packages are scanned for vulnerabilities before every release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/bareos-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer bareos --plan payg-gen2
az vm create -g my-rg -n bareos --size Standard_D2s_v3 \
  --image lynxroute:bareos:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Bareos 25.1.2-pre64.8f8d5d63e

Azure · 2026-10-24
  • Bareos updated 25.1.2-pre30.be754be47 -> 25.1.2-pre64.8f8d5d63e community build - director, storage daemon, file daemon, bconsole and the PHP WebUI on one hardened instance. AGPL-3.0 unchanged
  • The Bareos community repository publishes a rolling build of the current stable branch rather than tagged releases, so this label is the snapshot that was current at build time; upstream spells it 25.1.2~pre64.8f8d5d63e
  • Security: PHP 8.3 (WebUI) updated to 8.3.6-0ubuntu0.24.04.13 (USN-8948-1), fixing the PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619
  • PostgreSQL catalog configured and initialised at first boot; all six daemon secrets are regenerated per instance
  • Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com
  • Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates