Self-Hosting Bacula: Security & Operations Checklist

What's Inside

This checklist is for system administrators, security engineers, and infrastructure teams who are deploying or auditing a self-hosted Bacula Enterprise installation. It covers 34 checkpoints across 12 security and operations domains:

• Operating System — distribution selection, minimal installation, automatic security updates
• Network & Firewall — inbound and outbound filtering, port restriction by source IP, SSH hardening
• User Management & Access Control — no root login, least-privilege accounts, role separation with restricted shells, 2FA for all privileged access
• Intrusion Detection — host-based IDS (CrowdSec or fail2ban), file integrity monitoring
• Alerting & Monitoring — tested email alerting with TLS, daily backup status confirmation without manual checks, dead-man's-switch alerting
• Backup Management Interface — network-restricted GUI access, individual named accounts with scoped roles, 2FA for GUI
• Bacula Configuration & Scripting — configuration quality, scripting security review (with a worked bad-script example), per-client unique passwords
• Encryption — client-side PKI encryption, TLS between all components, Storage Daemon volume encryption at rest, FIPS 140-2/3 applicability
• Logging, Reporting & Audit — centralised log retention, compliance reports, tamper-evident audit trails
• Backup Scope & Completeness — scope register, FileSet exclusion review
• Testing & Recovery — automated restore verification, tested disaster recovery plan with RTO/RPO
• Database & Infrastructure — catalog backup and restore testing, bootstrap file retention, database best-practice setup, maintenance scheduling, dedicated resources for the Bacula infrastructure