{
 "slug": "bareos",
 "name": "Bareos",
 "tagline": "Backup, archiving and recovery server with a PostgreSQL catalog and web UI",
 "category": "business-apps",
 "use_cases": [
  "backup",
  "disaster-recovery",
  "archiving"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Bareos GmbH & Co. KG",
  "url": "https://www.bareos.org",
  "license": "AGPL-3.0",
  "license_url": "https://github.com/bareos/bareos/blob/master/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443,
   9101,
   9103
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "25.1.2-pre64.8f8d5d63e",
   "last_build": "2026-10-24",
   "offer_id": "bareos",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:bareos:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.bareos?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/bareos/",
  "json": "https://lynxroute.com/products/bareos/product.json"
 },
 "release_notes": [
  {
   "version": "25.1.2-pre64.8f8d5d63e",
   "title": "Bareos 25.1.2-pre64.8f8d5d63e",
   "notes": "* Bareos updated 25.1.2-pre30.be754be47 -> 25.1.2-pre64.8f8d5d63e community build - director, storage daemon, file daemon, bconsole and the PHP WebUI on one hardened instance. AGPL-3.0 unchanged\n* The Bareos community repository publishes a rolling build of the current stable branch rather than tagged releases, so this label is the snapshot that was current at build time; upstream spells it 25.1.2~pre64.8f8d5d63e\n* Security: PHP 8.3 (WebUI) updated to 8.3.6-0ubuntu0.24.04.13 (USN-8948-1), fixing the PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619\n* PostgreSQL catalog configured and initialised at first boot; all six daemon secrets are regenerated per instance\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-10-24"
   }
  },
  {
   "version": "25.1.2-pre30.be754be47",
   "title": "Bareos 25.1.2-pre30.be754be47",
   "notes": "* Bareos updated 25.1.2-pre3.007d5a2ec -> 25.1.2-pre30.be754be47 community build - director, storage daemon, file daemon, bconsole and the PHP WebUI on one hardened instance. AGPL-3.0 unchanged\n* The Bareos community repository publishes a rolling build of the current stable branch rather than tagged releases, so this label is the snapshot that was current at build time; upstream spells it 25.1.2~pre30.be754be47\n* Security: catalog queries now escape client, job, log, volume and pool filters, and SQL escape buffers are sized dynamically to fix out-of-bounds writes\n* Fixes a director crash when cancelling duplicate jobs, volume relabelling after a purge truncate, and file descriptor leaks and API misuse in the Python file daemon plugins\n* PostgreSQL catalog configured and initialised at first boot; all six daemon secrets are regenerated per instance\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-10-02"
   }
  },
  {
   "version": "25.1.2-pre3.007d5a2ec",
   "title": "Bareos 25.1.2-pre3.007d5a2ec",
   "notes": "* Bareos 25.1.2-pre3.007d5a2ec community build - director, storage daemon, file daemon, bconsole and the PHP WebUI on one hardened instance\n* The Bareos community repository publishes a rolling build of the current stable branch rather than tagged releases, so this label is the snapshot that was current at build time; upstream spells it 25.1.2~pre3.007d5a2ec\n* Since the previous 25.1.2-pre0.fc2c79b6c build, upstream fixed the Debian and Ubuntu PostgreSQL plugin so that the configuration data under /etc/postgresql is included in a backup\n* PostgreSQL catalog configured and initialised at first boot; all six daemon secrets are regenerated per instance\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Built on the CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-09-21"
   }
  },
  {
   "version": "25.1.0-pre421.2d5a9991e",
   "title": "Bareos 25.1.0-pre421.2d5a9991e - Initial release (August 2026)",
   "notes": "* Bareos 25.1.0-pre421.2d5a9991e on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* Operating system packages CVE-scanned before every release\n* Every daemon secret regenerated uniquely on each instance at first launch, and verified before any daemon starts\n* PostgreSQL catalog reached over a local socket with peer authentication - no catalog password stored\n* Storage and client addresses resolved on the instance at first launch\n* Web interface served by nginx over TLS on port 443\n* Vendor upsell links and the outbound version beacon removed from the web interface; copyright and licence notices preserved\n* VMware plugin family not installed - it wraps a proprietary disk-access kit that cannot be redistributed\n* UFW firewall pre-configured (ports 22, 80, 443, 9101 and 9103 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-13"
   }
  }
 ],
 "release_history": [
  {
   "version": "25.1.2-pre64.8f8d5d63e",
   "azure": "2026-10-24"
  },
  {
   "version": "25.1.2-pre30.be754be47",
   "azure": "2026-10-02"
  },
  {
   "version": "25.1.2-pre3.007d5a2ec",
   "azure": "2026-09-21"
  },
  {
   "version": "25.1.2-pre0.fc2c79b6c",
   "azure": "2026-09-06"
  },
  {
   "version": "25.1.0-pre421.2d5a9991e",
   "azure": "2026-08-13"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer bareos --plan payg-gen2\naz vm create -g my-rg -n bareos --size Standard_D2s_v3 \\\n  --image lynxroute:bareos:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Bareos (Backup Archiving Recovery Open Sourced) is an open-source network backup solution written in C++ and split into cooperating daemons: a director that schedules jobs and owns the catalog, a storage daemon that writes backup volumes, and file daemons that run on the machines being protected. It performs full, differential and incremental backups on a schedule, with retention driven by pools and volumes, browsable file-level restore, job-level verification, client-side compression and encryption, and backup of Linux, Windows and macOS clients through the same director. Everything is driven from a text console or the bundled PHP web interface. Job history, file indexes and volume state are persisted in a PostgreSQL catalog on the instance. AGPL-3.0 license, no vendor lock-in. Running your own backup server keeps the catalog, the file index and the backup data itself inside your own AWS account.\n\nSCOPE OF THIS BUILD\n\nThis image installs the Bareos community packages published by the project. The VMware plugin family is deliberately not installed, because it wraps a proprietary third-party disk-access kit that cannot be redistributed in an image. The community build carries no vendor support entitlement.",
  "image_adds": "Security hardening:\n* Every daemon secret regenerated uniquely on each instance at first launch - the packages generate them at install time, so an image that shipped them as-is would put the same secrets on every instance\n* First launch verifies that no build-time secret survives before any daemon is started\n* The PostgreSQL catalog is reached over a local socket with peer authentication, so there is no catalog password stored anywhere\n* The storage and client addresses are resolved on the instance at first launch instead of being baked in\n* The web interface is served by nginx over TLS on port 443; the director, storage and file daemons are not web-facing\n* The backup control and data ports are recommended only for private network ranges, so backup clients reach the server over your own VPC or VPN\n* Vendor upsell links and the outbound version beacon removed from the web interface, so the buyer's browser makes no third-party calls; copyright and licence notices are preserved\n* UFW firewall pre-configured - only ports 22, 80, 443 and the two backup ports accepted\n* fail2ban and AppArmor pre-configured\n* CVE scan - operating system packages are scanned for vulnerabilities before every release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}