Using Backup Manager on Bare Metal Servers

You have a bare metal server and you want scheduled backups with a clear way to restore them. This guide covers Backup Manager bare metal setup: install the client, open the dashboard, restore files and databases from the command line, and prepare MySQL, MariaDB, or PostgreSQL so scheduled backups can dump your databases.

Note: This guide is only for bare metal servers. Servers with cPanel use a different Backup Manager client. If you run a cPanel VPS or Dedicated server, see the Backup Manager cPanel Guide for VPS/Dedicated Servers or the Backup Manager WHM Guide for VPS/Dedicated Servers.

Important: Troubleshooting bare metal servers is outside the scope of InMotion Hosting support. For hands-off setup, backup configuration, and ongoing server management, contact InMotion Solutions. For anything else, consult your operating system documentation.

Backup Manager Bare Metal Requirements

Check these items before you install the client.

• Either systemd 229 or later, or a cron daemon that can read /etc/cron.d/.
• OpenSSL.
• curl.
• bash.
• libc or glibc. The musl library is not supported.
• An init system: SysV, systemd, or upstart.
• If MySQL or MariaDB is installed, root must be able to run mysql and mysqldump without a password prompt. See MySQL and MariaDB configuration later in this guide.

Tested operating systems

InMotion Hosting tested the Backup Manager client on these distributions. Newer releases of the supported distributions, such as Ubuntu 24.04 and Debian 13, should also work. The Python column shows each distribution’s default Python version.

If your distribution is on the supported list, you can install the client next.

Install Backup Manager

Run every command in this section as the root user. The installer must run as root.

Step 1: Install wget

You download the installer with wget, so install it first. On Debian and Ubuntu:

apt-get -y install wget

On RedHat-family systems, including Fedora, CentOS, and AlmaLinux:

yum -y install wget

Step 2: Run the installation script

Run these commands one at a time:

1. Switch to the root user:

sudo su -

2. Move to root’s home directory:

cd /root

3. Download the installer:

wget -O bakmgr-setup.sh https://proxy-cache.inmotionhosting.com/network-images/backups/bakmgr/bakmgr-setup.txt

4. Make the installer executable:

chmod +x bakmgr-setup.sh

5. Run the installer with your server name:

./bakmgr-setup.sh --host $(hostname -s)

6. Delete the installer when it finishes:

rm -f bakmgr-setup.sh

Important: The hostname must match your server’s machine name in the Account Management Panel (AMP). If you changed the server’s hostname, replace $(hostname -s) with your server ID (for example, ded1234) after --host.

The installer runs these actions in order:

• Stops with an error if the standard Backup Manager client (/opt/backups/bin/backup_runner) is already installed. That client is the one used on managed cPanel servers.
• Installs gcc, openssl, curl, and bzip2 with yum, dnf, zypper, or apt-get, whichever your system has.
• Tries to open TCP port 4001 in ufw, firewalld, CSF, and APF so the dashboard is reachable.
• Downloads the Backup Manager client through the update script.
• Registers the server under the name you passed with --host.

With the client installed, you can see where it logs and which tools it added.

Log File Locations

Check these first when a backup does not behave as expected.

• Main log: /var/log/bakmgr.log
• Dashboard log on SysV systems: /var/log/bakmgr-dash.log
• Dashboard log on systemd and upstart systems: syslog

Next, here are the scripts the installer adds.

Available Scripts

Three configuration files control what gets backed up and how the dashboard runs.

Configuration Files

• /etc/bakmgr/bakmgr.yaml: controls what the backups include. You can edit it by hand, but the dashboard is the better tool when it can do the job.
• /etc/bakmgr/.auth.json: stores the API credentials the client receives when it registers. You should not need to edit it.
• /etc/bakmgr/dash.yaml: holds the dashboard settings. Restart the bakmgr service to apply changes. A default template lives at /etc/bakmgr/dash.yaml.example.

Most day-to-day changes happen in the dashboard, which the next section covers.

Use the Backup Manager Dashboard

The dashboard is a web interface for managing your backups. It runs on TCP port 4001.

Open the dashboard

Browse to your server’s hostname on port 4001. Remember to use https:// when you connect to this port.

https://<your-server-hostname>:4001

Replace <your-server-hostname> with your server’s hostname. The dashboard is password protected. To set the password the first time, or to reset it later, run this command as root on the server:

bakmgr dash-password

The dashboard login page also shows these instructions.

Note: The installer tries to open TCP port 4001 automatically in ufw, firewalld, CSF, and APF. If your server uses a different firewall, open TCP port 4001 in it manually.

Install a custom SSL certificate

The dashboard uses a self-signed certificate by default, so your browser may show a security warning. To replace it with your own, place the files here:

• SSL certificate: /etc/bakmgr/dash.crt
• Private key: /etc/bakmgr/dash.key
• CA bundle (optional): /etc/bakmgr/dash.cabundle

Then restart the bakmgr service so the dashboard loads the new files. On systemd systems, run:

systemctl restart bakmgr

On SysV or upstart systems, restart the bakmgr service with your init system’s own restart command.

Backups are only useful if you can get data back, so the next section covers restores.

Restore Data from the Command Line

The bakmgr command restores files and databases.

Restore files

Replace /path/to/file with the file or directory you want back:

bakmgr restore-files /path/to/file

Export a MySQL database

restore-mysql exports a database backup to the file path you give. The dump contains the output of the dump_cmd setting in /etc/bakmgr/bakmgr.yaml.

bakmgr restore-mysql /path/to/export/database.sql

Replace /path/to/export/database.sql with the location and file name you want.

PostgreSQL databases

For PostgreSQL, use restore-pgsql. Like restore-mysql, it writes a dump file to the path you give and does not change your live database. Run bakmgr restore-pgsql -h to see its options.

bakmgr restore-pgsql /path/to/export/database.sql

Get help and skip the backup prompt

Every restore command has its own help page. For files:

bakmgr restore-files -h

For MySQL:

bakmgr restore-mysql -h

For PostgreSQL:

bakmgr restore-pgsql -h

Note: If more than one backup exists for the type you request, Backup Manager asks which one to restore.

Tip: Add --latest to pick the most recent backup automatically, which is useful in scripts:

bakmgr restore-files --latest /path/to/file

Database backups depend on how your database server handles logins, which the next section covers.

Advanced Configuration: Database Server Setup

Backup Manager dumps each database with its own snapshot. It does not store database credentials in bakmgr.yaml. Instead, it relies on the local operating system user logging in to the database server without a password prompt. The next sections cover what MySQL, MariaDB, and PostgreSQL need for that to work.

Put database client binaries in the fixed PATH

Backup Manager calls mysqldump, pg_dump, and the other clients by bare name. Every bakmgr process (the scheduled backup, the dashboard, bakmgr restore-*, and the installer) replaces its inherited PATH with this fixed value when it starts:

/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Changes to PATH in .bashrc, /etc/profile.d/*, /etc/environment, or systemd drop-ins have no effect on Backup Manager. The clients must resolve from one of those directories. Distribution packages already put them there, and packages from the PostgreSQL YUM Repository (PGDG) add links in /usr/bin through alternatives.

If your binaries live somewhere else, such as /usr/pgsql-16/bin without alternatives, /opt/, or a Software Collection, symlink them into /usr/local/bin:

for b in psql pg_dump pg_dumpall; do
    ln -s /usr/pgsql-16/bin/$b /usr/local/bin/$b
done

To see what Backup Manager will find, run this check. Each tool you use should print a path:

env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
    sh -c 'command -v mysql mysqldump psql pg_dump pg_dumpall'

MySQL and MariaDB configuration

Backup Manager runs mysql and mysqldump as root, so it uses whatever client configuration root has, usually /root/.my.cnf. Root must log in without a password prompt.

Tip: MariaDB 10.4.0 and later let root log in through socket authentication, with no password, by default. For MySQL, it depends on how the server was installed. Run mysql as root: if it connects without asking for a password, you do not need a .my.cnf file. Create one if root needs a password.

To give root explicit credentials:

1. Create /root/.my.cnf with these contents, replacing CHANGEME with the root password:

[client]
user=root
password=CHANGEME

2. Restrict the file so only root can read it. The file holds a plain-text password, so this step protects it:

chmod 600 /root/.my.cnf

The account Backup Manager uses needs enough privileges to list and dump every database, along with its routines, views, and triggers. Using root@localhost is the simplest option. If you prefer a dedicated account, this grant should be enough:

GRANT SELECT, SHOW VIEW, TRIGGER, EVENT, LOCK TABLES, PROCESS,
      SHOW DATABASES, RELOAD ON *.* TO 'backup'@'localhost';

This grant is a recommendation. Backup Manager does not check it.

Important: Use the InnoDB storage engine. Dumps run with --single-transaction --skip-lock-tables, so InnoDB tables get a consistent snapshot without locking. MyISAM tables are not locked, so a dump taken while data is being written may be inconsistent.

To confirm the setup, list your databases:

mysql --batch --skip-column-names -e 'SHOW DATABASES'

Then print the start of a dump. Replace <some_db> with one of your database names:

mysqldump --single-transaction --skip-lock-tables <some_db> | head

Two behaviors to know about:

• Backup Manager skips information_schema, performance_schema, and sys. It does back up the mysql system database, which holds users and grants.
• Dumps use --force, so a dump continues past errors such as a broken view. Backup Manager marks the run as failed only if the dump exits with a non-zero code.

If you run PostgreSQL instead, or as well, the next section covers it.

PostgreSQL configuration

Backup Manager runs psql, pg_dump, and pg_dumpall as the postgres operating system user, with HOME set to that user’s home directory, and connects to the postgres database. If no postgres user exists, it runs them as root instead. The rest of the environment passes through unchanged, including the fixed PATH described earlier.

Make sure all of the following are true:

• psql, pg_dump, and pg_dumpall resolve from the fixed PATH.
• The postgres user can log in without a password prompt. The stock pg_hba.conf rule already allows this: local all postgres peer
• The connecting role is a superuser. pg_dumpall --globals-only (roles and tablespaces) needs superuser rights, and so does reading every database.
• If PostgreSQL listens on a non-default socket directory or port, configure that through libpq (the PostgreSQL client library), for example in ~postgres/.pg_service.conf or with a PGHOST and PGPORT systemd drop-in. Backup Manager does not pass a host or port itself, and settings in a shell rc file do not reach scheduled runs.

If you changed local connections to md5 or scram-sha-256, either restore peer for the postgres user in pg_hba.conf, or create ~postgres/.pgpass with mode 0600 and this line, replacing CHANGEME with the password:

localhost:5432:*:postgres:CHANGEME

To verify the setup, list the non-template databases:

sudo -u postgres psql -d postgres -At \
  -c 'SELECT datname FROM pg_database WHERE NOT datistemplate'

Then print the start of the roles and tablespaces dump:

sudo -u postgres pg_dumpall --globals-only | head

Two more details:

• Backup Manager skips template databases. It saves roles and tablespaces separately under dbname:__globals__.
• Dumps use pg_dump --clean, so restoring a dump drops existing objects before it recreates them.

If a backup still fails after this setup, the troubleshooting tables in the next section map common messages to causes.

Troubleshooting

Installer errors

If the installer stops right away, match the message to this table.

Database backup errors

When Backup Manager cannot list your databases, the dashboard configuration page shows the error. For scheduled-run errors, check journalctl -u bakmgr-cron and /var/log/bakmgr.log. Match the message you see to this table.

Conclusion

Backup Manager is now installed on your bare metal server, with a reachable dashboard, restore commands you know how to run, and database access set up for scheduled runs. Open the dashboard on port 4001 and review what bakmgr.yaml includes. If you would rather hand the setup to experts, InMotion Solutions can configure it for you.