Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
Bareos is an open-source network backup server written in C++ that schedules, runs and catalogs backups of Linux, Windows and macOS clients, with a PostgreSQL catalog and a PHP web interface. This Lynxroute build is hardened and ready out of the box: every daemon secret regenerated uniquely on each instance at first launch, the catalog reached over a local socket with no password to leak, the web interface behind an nginx TLS perimeter, the backup ports scoped to private networks, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
AGPL-3.0 license - fully auditable, no vendor lock-in.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS BAREOS
Bareos (Backup Archiving Recovery Open Sourced) is an open-source network backup solution written in C++ and split into cooperating daemons: a director that schedules jobs and owns the catalog, a storage daemon that writes backup volumes, and file daemons that run on the machines being protected. It performs full, differential and incremental backups on a schedule, with retention driven by pools and volumes, browsable file-level restore, job-level verification, client-side compression and encryption, and backup of Linux, Windows and macOS clients through the same director. Everything is driven from a text console or the bundled PHP web interface. Job history, file indexes and volume state are persisted in a PostgreSQL catalog on the instance. AGPL-3.0 license, no vendor lock-in. Running your own backup server keeps the catalog, the file index and the backup data itself inside your own AWS account.
SCOPE OF THIS BUILD
This AMI installs the Bareos community packages published by the project. The VMware plugin family is deliberately not installed, because it wraps a proprietary third-party disk-access kit that cannot be redistributed in an image. The community build carries no vendor support entitlement.
WHAT THIS AMI ADDS
Security hardening:
- Every daemon secret regenerated uniquely on each instance at first launch - the packages generate them at install time, so an image that shipped them as-is would put the same secrets on every instance
- First launch verifies that no build-time secret survives before any daemon is started
- The PostgreSQL catalog is reached over a local socket with peer authentication, so there is no catalog password stored anywhere
- The storage and client addresses are resolved on the instance at first launch instead of being baked in
- The web interface is served by nginx over TLS on port 443; the director, storage and file daemons are not web-facing
- The backup control and data ports are recommended only for private network ranges, so backup clients reach the server over your own VPC or VPN
- Vendor upsell links and the outbound version beacon removed from the web interface, so the buyer's browser makes no third-party calls; copyright and licence notices are preserved
- UFW firewall pre-configured - only ports 22, 80, 443 and the two backup ports accepted
- fail2ban and AppArmor pre-configured
- CVE scan - operating system packages are scanned for vulnerabilities before every release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, Kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
- Bareos security baked in: every daemon secret regenerated uniquely on each instance at first launch and verified before any daemon starts, PostgreSQL catalog reached over a local socket with no stored password, web interface behind an nginx TLS perimeter, backup ports scoped to private networks, UFW firewall pre-configured.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Complete backup server on one instance: director, storage daemon, file daemon, text console and web interface with a PostgreSQL catalog, covering full, differential and incremental jobs with file-level restore across Linux, Windows and macOS clients. AGPL-3.0 license - fully auditable, no vendor lock-in.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.medium Recommended | $0.05 |
t3.large | $0.05 |
t3.small | $0.03 |
m6i.xlarge | $0.05 |
m6i.large | $0.05 |
Dimensions summary
You pay by the hour based on the EC2 instance size you launch. Five instance types are available. The t3.small, t3.medium, and t3.large options are burstable instances that scale from smaller to larger compute and memory. The m6i.large and m6i.xlarge options are general-purpose instances offering steady compute. Pricing scales with the size and capacity of the instance you choose. All options run the same hardened backup, archiving, and recovery server image. Your total cost depends on which instance you pick and how many hours you run it.
Top-of-mind questions for buyers
Each dimension maps to an EC2 instance size. The t3.small, t3.medium, and t3.large are burstable instances that vary in compute and memory. The m6i.large and m6i.xlarge are general-purpose instances with steady compute. You pay the hourly rate for whichever size you launch.
The software meters running hours. When you stop the instance, the hourly software charge stops accruing. Stopped instances may still incur underlying AWS storage fees for attached volumes, but those are separate from this software charge and billed by AWS.
Every instance runs a CIS Level 1 hardened Ubuntu 24.04 LTS base. Each ships with a firewall, fail2ban, AppArmor, and auditd preconfigured. Unique credentials are generated at first boot. A software bill of materials and a CIS Conformance Report are bundled inside for audit review.
lynxroute.com
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Bareos 25.1.0 - Initial release (August 2026)
- Bareos 25.1.0 on Ubuntu 24.04 LTS
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- Operating system packages CVE-scanned before every release
- Every daemon secret regenerated uniquely on each instance at first launch, and verified before any daemon starts
- PostgreSQL catalog reached over a local socket with peer authentication - no catalog password stored
- Storage and client addresses resolved on the instance at first launch
- Web interface served by nginx over TLS on port 443
- Vendor upsell links and the outbound version beacon removed from the web interface; copyright and licence notices preserved
- VMware plugin family not installed - it wraps a proprietary disk-access kit that cannot be redistributed
- UFW firewall pre-configured (ports 22, 80, 443, 9101 and 9103 only)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (t3.medium recommended; t3.small minimum). Attach a dedicated EBS volume for backup data before real use - by default volumes are written to /var/lib/bareos/storage on the root disk.
- Open Security Group - allow TCP 443 from your IP
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/bareos-credentials.txt
- Open https://<PUBLIC_IP>/ in your browser - accept the self-signed certificate warning. Log in with Director "localhost-dir", username admin, and the password from step 4. First launch takes 30-90 seconds while secrets are regenerated and the daemons start; a progress page is shown until it is ready.
- Run the built-in self-test backup of this host and watch it complete: sudo bconsole *run job=backup-bareos-fd level=Full yes *wait *list jobs
- Browse and restore from it: *restore
The web interface password is generated uniquely on this instance and is not present in the AMI. Credentials are saved to /root/bareos-credentials.txt at first launch.
BACKING UP OTHER MACHINES Install the Bareos file daemon on each client, then add a Client resource in /etc/bareos/bareos-dir.d/client/ and a Job that references it, and reload the director from bconsole. The storage and client addresses on this instance are set to its private address at first launch, and the recommended security group opens the director port 9101 and the storage port 9103 to private ranges only, so clients are expected to reach the server over your VPC or VPN. To back up clients over the public internet instead, change Address in /etc/bareos/bareos-dir.d/storage/File.conf and open those ports to those clients yourself.
STORAGE Backup volumes are written to /var/lib/bareos/storage. Mount a dedicated volume there before storing real backups; the root disk is sized for evaluation only.
CATALOG The PostgreSQL catalog is reached over a local socket with peer authentication, so there is no catalog password to manage. It listens on 127.0.0.1 only.
This image installs the Bareos community packages. They carry no vendor support entitlement; support for this hardened image is provided by Lynxroute.
Replace the self-signed TLS certificate with a CA-signed certificate for production use: sudo certbot --nginx -d yourdomain.com
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For Bareos documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
This product has charges associated with it for seller support. Bareos is an open-source network backup solution designed to automate data backup, recovery, and verification across multiple systems. It provides centralized management, supports various storage types, and ensures secure and reliable data protection for enterprise and small-scale environments.
This product has charges associated with it for seller support. Bareos is an open-source backup, restore, and recovery software used to protect data across servers, virtual machines, and cloud environments.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.