Yandex Cloud
Search
Contact UsGet started
  • Blog
  • Pricing
  • Documentation
  • All Services
  • System Status
    • Featured
    • Infrastructure & Network
    • Data Platform
    • Containers
    • Developer tools
    • Serverless
    • Security
    • Monitoring & Resources
    • AI Studio
    • Business tools
  • All Solutions
    • By industry
    • By use case
    • Economics and Pricing
    • Security
    • Technical Support
    • Customer Stories
    • Start testing with double trial credits
    • Cloud credits to scale your IT product
    • Gateway to Russia
    • Cloud for Startups
    • Education and Science
    • Yandex Cloud Partner program
  • Blog
  • Pricing
  • Documentation
© 2025 Direct Cursus Technology L.L.C.
Yandex Cloud Backup
  • Getting started
    • All guides
    • Activating the service
    • Viewing service resource operations
    • Limiting RAM usage by the Cloud Backup agent
    • Viewing backup statistics
    • All tutorials
    • Connecting a BareMetal server to Cloud Backup
  • Access management
  • Pricing policy
  • Terraform reference
  • Monitoring metrics
  • Audit Trails events
  • Release notes
  • Troubleshooting

In this article:

  • Get your cloud ready
  • Required paid resources
  • Create a service account
  • Activate Cloud Backup
  • Lease a test server
  • Connect to the server
  • Install the Cloud Backup agent
  • Link the server to a backup policy
  • Run the backup process
  • Restore your server from backup
  • How to cancel a lease and delete resources
  1. Tutorials
  2. Connecting a BareMetal server to Cloud Backup

Connecting a Yandex BareMetal server to Cloud Backup

Written by
Yandex Cloud
Improved by
Danila N.
Updated at June 11, 2025
  • Get your cloud ready
    • Required paid resources
  • Create a service account
  • Activate Cloud Backup
  • Lease a test server
  • Connect to the server
  • Install the Cloud Backup agent
  • Link the server to a backup policy
  • Run the backup process
  • Restore your server from backup
  • How to cancel a lease and delete resources

Note

BareMetal is at the Preview stage.

You can connect an existing BareMetal server to Cloud Backup and configure backups of its data.

For more information about connecting a BareMetal server to Cloud Backup when ordering it, see Leasing a Yandex BareMetal server with a connection to Cloud Backup.

For more information on managing BareMetal servers, see Step-by-step guides for Yandex BareMetal.

Connecting to Cloud Backup is supported for servers running the following operating systems:

  • CentOS 7
  • Debian 10.
  • Debian 11.
  • Ubuntu 16.04 LTS.
  • Ubuntu 18.04 LTS.
  • Ubuntu 20.04 LTS.
  • Ubuntu 22.04 LTS.
  • Ubuntu 24.04 LTS.

To connect an existing server to Cloud Backup:

  1. Get your cloud ready.
  2. Create a service account.
  3. Activate Cloud Backup.
  4. Lease a test server.
  5. Connect to the server.
  6. Install the Cloud Backup agent.
  7. Link the server to a backup policy.
  8. Run the backup process.
  9. Restore your server from backup.

See also How to cancel a lease and delete resources.

Get your cloud readyGet your cloud ready

Sign up in Yandex Cloud and create a billing account:

  1. Navigate to the management console and log in to Yandex Cloud or register a new account.
  2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can navigate to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

Required paid resourcesRequired paid resources

The infrastructure support cost includes:

  • Server lease fee (see Yandex BareMetal pricing).
  • Fee for the BareMetal server connected to Cloud Backup and the backup size (see Yandex Cloud Backup pricing).

Create a service accountCreate a service account

Management console
  1. In the management console, select the folder you want to lease a BareMetal server in.

  2. From the list of services, select Identity and Access Management.

  3. Click Create service account.

  4. Enter a name for the service account. The naming requirements are as follows:

    • It must be from 2 to 63 characters long.
    • It can only contain lowercase Latin letters, numbers, and hyphens.
    • It must start with a letter and cannot end with a hyphen.
  5. Click Add role and assign the backup.editor and baremetal.editor roles to the service account.

  6. Click Create.

  7. To select the service account you created earlier, click the row with its name.

  8. In the top panel, click Create new key.

  9. Select Create authorized key.

  10. Select an encryption algorithm and click Create.

  11. In the window that opens, click Download file with keys and then click Close.

You will need the authorized key of the service account in the later steps.

Activate Cloud BackupActivate Cloud Backup

To activate Cloud Backup, you need at least the backup.editor role for the folder where you want to lease a server and connect it to Cloud Backup.

When you enable the service, the backup provider starts. For more information about the backup provider and data sent to it, see Service activation and backup provider.

Management console
CLI
  1. In the management console, select the folder where you want to lease a server and connect it to Cloud Backup.

  2. From the list of services, select Cloud Backup.

  3. If you have not activated Cloud Backup yet, click Activate.

    If there is no Activate button, Cloud Backup is already activated. Proceed to the next step.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

  1. View the description of the CLI command to activate the service:

    yc backup provider activate --help
    
  2. Activate the service in the default folder:

    yc backup provider activate --async
    

    Where --async displays the operation progress info. This is an optional parameter.

    Result:

    id: cdgmnefxiatx********
    description: activate provider
    created_at: "2024-10-14T09:03:47.960564Z"
    created_by: ajec1gaqcmtr********
    modified_at: "2024-10-14T09:03:47.960564Z"
    done: true
    metadata:
      '@type': type.googleapis.com/yandex.cloud.backup.v1.ActivateProviderMetadata
      folder_id: b1go3el0d8fs********
    response:
      '@type': type.googleapis.com/google.protobuf.Empty
      value: {}
    

After activation, the system automatically creates the following backup policies:

  • Default daily: Daily incremental backup with the last 15 backups retained.
  • Default weekly: Weekly incremental backup with the last 15 backups retained.
  • Default monthly: Monthly incremental backup with the last 15 backups retained.

If you prefer not to create them, use the --skip-default-policy parameter.

After activation, the system automatically creates the following backup policies:

  • Default daily: Daily incremental backup with the last 15 backups retained.
  • Default weekly: Weekly incremental backup with the last 15 backups retained.
  • Default monthly: Monthly incremental backup with the last 15 backups retained.

Lease a test serverLease a test server

If you are already leasing a server with an appropriate OS, go to Connect to the server. Make sure to check the network permissions you need to configure on the server.

Management console
  1. In the management console, select the folder you want to lease a server in.

  2. In the list of services, select BareMetal and click Lease server.

  3. In the Availability zone field, select the availability zone the server will be leased in.

  4. In the Pool field, select the pool the server will be leased from.

  5. Under Configuration, select the appropriate server configuration.

  6. (Optional) Under Disk, configure disk partitioning:

    1. Click Configure disk layout.

    2. Specify the partitioning parameters. To create a new partition, click Add partition.

      To build RAID arrays and configure disk partitions yourself, click Remove RAID.

    3. Click Save.

    Note

    The disk partitioning parameters are vital to have your server restored from a backup later on. For more information, see Restoring a VM or Yandex BareMetal server from a backup.

  7. Under Image, select Marketplace and an OS supported in Cloud Backup.

  8. Under Lease conditions:

    1. In the Number of servers field, specify 1.
    2. In the Lease duration field, select a lease period: 1 day, 1 month, 3 months, 6 months, or 1 year.

      When this period expires, server lease will be automatically renewed for the same period. You cannot terminate the lease during the specified lease period, but you can refuse to extend the server lease further.

  9. Under Network settings:

    1. In the Private subnet field, select an existing private subnet or click Create to create a new one.

    2. In the Public address field, select a public IP address assignment method:

      • Automatic: To assign a random IP address.
      • From a dedicated subnet: To assign an IP address from the range of addresses in a dedicated public subnet.

        In the field that opens, select a public subnet or click Order to order a new one.

        Warning

        The public subnet does not have a DHCP server. In this case, on the network interface of a server connected to a public subnet, set up a static IP address from the subnet’s range of public IP addresses and you also need to set the default gateway address.

      For the Cloud Backup agent to exchange data with the backup provider servers, make sure the server has network access to the IP addresses of Cloud Backup resources based on the following table:

      Port range Protocol Destination name CIDR blocks
      80 TCP CIDR 213.180.193.0/24
      80 TCP CIDR 213.180.204.0/24
      443 TCP CIDR 84.47.172.0/24
      443 TCP CIDR 84.201.181.0/24
      443 TCP CIDR 178.176.128.0/24
      443 TCP CIDR 213.180.193.0/24
      443 TCP CIDR 213.180.204.0/24
      7770-7800 TCP CIDR 84.47.172.0/24
      8443 TCP CIDR 84.47.172.0/24
      44445 TCP CIDR 51.250.1.0/24
  10. Under Access:

    1. In the Password field, use one of these options to create a password for the root user:

      • To generate a password for the root users, select New password and click Generate.

        Warning

        This option assumes that the user is responsible for password security. Save the password in a safe place. Yandex Cloud does not store this password, and you will not be able to view it once you lease the server.

      • To use the root user password saved in a Yandex Lockbox secret, select Lockbox secret.

        In the Name, Version, and Key fields, select the secret, its version, and the key your password is saved in, respectively.

        If you do not have a Yandex Lockbox secret, click Create to create it.

        This option allows you either to set your own password (the Custom secret type) or to use an automatically generated one (the Generated secret type).

    2. In the Public SSH key field, select the SSH key saved in your organization user profile.

      If there are no SSH keys in your profile or you want to add a new key:

      • Click Add key.
      • Enter a name for the SSH key.
      • Upload or paste the contents of the public key file. You will need to create a key pair for the SSH connection to a server yourself.
      • Click Add.

      The SSH key will be added to your organization user profile.

      If adding SSH keys by users to their profiles is disabled in the organization, the public SSH key you add will be saved only to the OS user profile of the new BareMetal server.

    1. Under Server information:

      1. Enter the server name in the Name field.
      2. Optionally, add a server description in the Description field.
      3. Optionally, set labels in the Labels field.
  11. Click Lease server.

Save the server name and ID for use in the later steps.

For more information on leasing a server, see the BareMetal documentation.

Connect to the serverConnect to the server

KVM console
Linux/macOS
Windows 10/11
  1. In the management console, select the folder the server belongs to.
  2. In the list of services, select BareMetal.
  3. In the row with the server, click and select Start KVM console.
  4. In the window that opens, click KVM console.

To establish a server connection, specify its public IP address which can be found in the management console, in the Public address field under Network settings on the server page.

  1. In the terminal, run this command:

    ssh root@<server_public_IP_address>
    

    If this is your first time connecting to the server, you will get an unknown host warning:

    The authenticity of host '51.250.83.243 (51.250.83.243)' can't be established.
    ED25519 key fingerprint is SHA256:6Mjv93NJDCaf/vu3NYwiLQK4tKI+4cfLtkd********.
    This key is not known by any other names.
    Are you sure you want to continue connecting (yes/no/[fingerprint])?
    
  2. Type yes into the terminal and press Enter.

  3. Enter the password you specified when creating the server and press Enter.

To establish a server connection, specify its public IP address which can be found in the management console, in the Public address field under Network settings on the server page.

Make sure the Windows account has read permissions for the directory containing the keys.

  1. To connect to the server, run the following command in the command line:

    ssh root@<server_public_IP_address>
    

    If this is your first time connecting to the server, you will get an unknown host warning:

    The authenticity of host '89.169.132.223 (89.169.132.223)' can't be established.
    ECDSA key fingerprint is SHA256:DfjfFB+in0q0MGi0HnqLNMdHssLfm1yRanB********.
    Are you sure you want to continue connecting (yes/no/[fingerprint])?
    
  2. Type yes into the terminal and press Enter.

  3. Enter the password you specified when creating the server and press Enter.

Install the Cloud Backup agentInstall the Cloud Backup agent

  1. Copy the file with the service account authorized key you created earlier to the server. To do this, run this command on the local machine:

    scp <path_to_authorized_key_file_on_local_machine> \
    root@<server_public_IP_address>:<absolute_path_to_folder_on_server>
    
  2. Install the Yandex Cloud CLI. To do this, run this command on the server:

    curl -sSL https://storage.yandexcloud.net/yandexcloud-yc/install.sh | bash
    
  3. Install the required packages and utilities:

    Debian/Ubuntu
    CentOS
    apt update && apt install -y jq
    
    yum install epel-release -y && \
    yum update -y && \
    yum install jq -y && \
    yum install wget -y
    
  4. Authenticate in the Yandex Cloud CLI as a service account:

    yc config set service-account-key <absolute_path_to_authorized_key>
    
  5. Get an IAM token:

    yc iam create-token
    
  6. Install the Cloud Backup agent specifying the service account IAM token you got earlier:

    wget https://storage.yandexcloud.net/backup-distributions/agent_installer_bms.sh && \
    sudo bash ./agent_installer_bms.sh \
    -t=<IAM_token>
    

    Wait for the message informing you the Cloud Backup agent is registered:

    ...
    Agent registered with id D9CA44FC-716A-4B3B-A702-C6**********
    

Link the server to a backup policyLink the server to a backup policy

You can create backups in Cloud Backup only as part of a backup policy. By default, BareMetal servers are not linked to any policy.

To link a server to a backup policy:

Management console
CLI
  1. In the management console, select a folder where you want to link a server to a backup policy.

  2. From the list of services, select Cloud Backup.

  3. In the left-hand panel, select Backup policies.

  4. Select the policy to link the server to.

    Create a new backup policy if you need to.

  5. Under Attached resources, click Attach a VM.

  6. In the window that opens, select the BareMetal servers tab and select the server from the list.

  7. Click Attach.

  1. View the description of the CLI command to link a BareMetal server to a backup policy:

    yc backup policy apply --help
    
  2. Get the ID of the policy to link the server to:

    yc backup policy list
    

    Result:

    +----------------------+----------------------+---------+---------+---------------------+---------------------+
    |          ID          |      FOLDER ID       |  NAME   | ENABLED |     CREATED AT      |     UPDATED AT      |
    +----------------------+----------------------+---------+---------+---------------------+---------------------+
    | abc7n3wln123******** | ghi681qpe789******** | policy1 | true    | 2023-07-03 09:12:02 | 2023-07-03 09:12:43 |
    | deflqbiwc456******** | ghi681qpe789******** | policy2 | true    | 2023-07-07 14:58:23 | 2023-07-07 14:58:23 |
    +----------------------+----------------------+---------+---------+---------------------+---------------------+
    

    Create a new backup policy if you need to.

  3. Get the ID of the server to link. To do this, select BareMetal from the list of services of the relevant folder in the management console. The IDs are specified in the server list in the ID field.

  4. Link the server to the backup policy by specifying its ID:

    yc backup policy apply <policy_ID> \
      --instance-ids <server_ID>
    

    Where --instance-ids is the ID of the BareMetal server to link to the policy.

For more information about the command, see the CLI reference.

Run the backup processRun the backup process

To start creating a BareMetal server backup outside of the backup policy schedule:

Management console
CLI
  1. In the management console, select the folder containing the backup policy.
  2. From the list of services, select Cloud Backup.
  3. In the left-hand panel, select BareMetal servers.
  4. In the row with the server, click and select Create backup.
  5. In the window that opens, select the backup policy for creating the backup and click Create.

Cloud Backup will start to create a backup of the BareMetal server. You can see the progress in the relevant server row in the Server status field.

Run this command specifying the backup policy and server IDs:

yc backup policy execute \
  --id <policy_ID> \
  --instance-id <server_ID>

Wait for the operation to complete.

Also, you can run the command in asynchronous mode using the --async parameter and track the backup process using the yc backup resource list-tasks command.

Restore your server from backupRestore your server from backup

Note

You can restore neither a VM backup to a BareMetal server, nor a BareMetal server backup to a VM.

If you need to restore one server's backup to another server, or if the OS has been reinstalled on the source server, reinstall the Cloud Backup agent on that server.

To avoid errors when recovering from a backup, start by comparing the parameters of the disks and partitions of the backup against those of the VM or Yandex BareMetal server. For more information, see Viewing the parameters of backup disks and partitions.

Tip

If the server had used a RAID array, we recommend that you restore the backup to a server with a similar partition configuration. We also recommend that you make the partitions at least as big as on the source server.

To restore your server from a backup:

Management console
CLI
  1. In the management console, select the folder where the backup is located.
  2. From the list of services, select Cloud Backup.
  3. In the left-hand panel, select Backups and open the BareMetal servers tab.
  4. In the row with the backup to restore the BareMetal server from, click and select Recover BareMetal server.
  5. In the window that opens, select the server you created the selected backup from. This server will be marked in the list as (current).
  6. Click Restore.

The process of BareMetal server recovery from the backup will start. Wait until it is complete.

  1. Get a list of backups for the server by specifying its ID:

    yc backup backup list \
      --instance-id <server_ID>
    

    Save the backup ID.

  2. Restore your server from the backup by specifying their IDs:

    yc backup backup recover \
      --destination-instance-id="<server_ID>" \
      --source-backup-id="<backup_ID>"
    

    The recovery of your BareMetal server will start. Wait for it to complete.

    Also, you can run the command in asynchronous mode using the --async parameter and track the backup process using the yc backup resource list-tasks command.

    For more information about the yc backup backup recover command, see the CLI reference.

Warning

After you recover a BareMetal server from another server’s backup, you may lose network access to the target server. This is because the network settings recovered from the backup, namely the network interface MAC addresses, were taken from the source server.

To restore the network on the target VM, update the MAC addresses in the server's network interface settings using the KVM console. You can get the current MAC addresses using the ip a command. For more information on setting up network interfaces in a particular OS, see the relevant OS guides.

How to cancel a lease and delete resourcesHow to cancel a lease and delete resources

  1. Cancel a BareMetal server lease.
  2. Delete the backup in Cloud Backup using the CLI.

See alsoSee also

  • Leasing a Yandex BareMetal server with a connection to Cloud Backup

Was the article helpful?

Previous
All tutorials
Next
Overview
© 2025 Direct Cursus Technology L.L.C.