[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud Backup](../../index.md) > [Concepts](../index.md) > [Connecting resources to Cloud Backup](index.md) > Servers BareMetal

# Connecting Yandex BareMetal servers to Cloud Backup


To back up your [BareMetal servers](../../../baremetal/concepts/servers.md) in Cloud Backup, you need them connected to the service and properly set up.

For more on connecting BareMetal servers to Cloud Backup, see [Managing BareMetal servers in Cloud Backup](../../operations/index.md#connect-baremetal).

For the Cloud Backup connection to work correctly, link to the server a [service account](#sa) with the [`baremetal.editor`](../../../baremetal/security/index.md#baremetal-editor) and [`backup.user`](../../security/index.md#backup-user) roles or higher and configure [network access](#vm-network-access).

After you connect it to Cloud Backup, [link](../../operations/policy-vm/attach-and-detach-vm.md#attach-vm) the BareMetal server to a [backup policy](../policy.md).

{% note info %}

At the time of creating a backup, the BareMetal server must be running.

{% endnote %}

You can also link a policy to a BareMetal server when ordering the latter. A policy is linked asynchronously after you create and initialize a server and after you install and configure the Cloud Backup agent. This may take up to 10-15 minutes.

## Supported Cloud Marketplace images with automatic installation of the Cloud Backup agent {#os}


On BareMetal servers, the Cloud Backup agent is available for automatic installation if ordering servers using the following Cloud Marketplace images:

* CentOS 7
* Debian 11
* Ubuntu 18.04 LTS
* Ubuntu 20.04 LTS
* Ubuntu 22.04 LTS
* Ubuntu 24.04 LTS

{% note info %}

The OS must be installed from a public image (a Yandex Cloud Marketplace product).

{% endnote %}

### Unaided installation on a supported operating system {#self-install}

You can install the Cloud Backup agent manually on a BareMetal server running one of these operating systems:

* CentOS 7.
* Debian 11.
* Ubuntu 16.04 LTS.
* Ubuntu 18.04 LTS.
* Ubuntu 20.04 LTS.
* Ubuntu 22.04 LTS.
* Ubuntu 24.04 LTS.

To install the agent on a server, follow [this guide on connecting a BareMetal server to Cloud Backup](../../operations/backup-baremetal/backup-baremetal.md).

If you have issues installing the Cloud Backup agent, [contact](https://center.yandex.cloud/support) support.

### Updating the operating system kernel {#os-kernel-update}

Updating the Linux [kernel](https://en.wikipedia.org/wiki/Linux_kernel) on a [resource](../index.md#protected-resources) connected to Cloud Backup may affect the performance of the Cloud Backup agent: it will not be able to create a backup of the resource or recover it from a backup.

This may affect the agent’s performance, since the SnapAPI module (developed by the [backup provider](../index.md#providers) for the agent to work with disks and built by the [DKMS framework](https://en.wikipedia.org/wiki/Dynamic_Kernel_Module_Support) for a specific Linux kernel) may not update after updating the kernel and may therefore cease to match the kernel version.

To restore the Cloud Backup agent’s performance affected by a Linux kernel update, you need to update the version of the Linux kernel headers DKMS refers to when building the SnapAPI module. Once the kernel header version matches the kernel version, DKMS will rebuild the SnapAPI module for the required Linux kernel version at the next start of the resource.

To upgrade the Linux kernel header version, follow [this guide on restoring the Cloud Backup agent on a BareMetal server](../../operations/backup-baremetal/restore-agent.md).

## Service account {#sa}

A [service account](../../../iam/concepts/users/service-accounts.md) is a special account the Cloud Backup agent uses to get registered with the Cyberprotect [provider](../index.md#providers).

When renting a BareMetal server you want to configure backups for in Cloud Backup, you need to link to it a service account with the [`baremetal.editor`](../../../baremetal/security/index.md#baremetal-editor) and [`backup.user`](../../security/index.md#backup-user) roles or higher.

You can [assign the role](../../../iam/operations/sa/assign-role-for-sa.md) to an existing service account or [create](../../../iam/operations/sa/create.md) a new service account with required roles.

## Network access permissions {#vm-network-access}

For the Cloud Backup agent to be able to exchange data with the backup provider servers, make sure the BareMetal server has network access to the IP addresses of the Cloud Backup resources as per the table below:

{% list tabs group=traffic %}

- Outgoing traffic {#outgoing}

  Port range | Protocol | Destination name | IPv4 CIDR
  --- | --- | --- | ---
  `80` | `TCP` | `Address range` | `213.180.193.0/24`
  `80` | `TCP` | `Address range` | `213.180.204.0/24`
  `443` | `TCP` | `Address range` | `84.47.172.0/24`
  `443` | `TCP` | `Address range` | `84.201.181.0/24`
  `443` | `TCP` | `Address range` | `178.176.128.0/24`
  `443` | `TCP` | `Address range` | `213.180.193.0/24`
  `443` | `TCP` | `Address range` | `213.180.204.0/24`
  `7770-7800` | `TCP` | `Address range` | `84.47.172.0/24`
  `8443` | `TCP` | `Address range` | `84.47.172.0/24`
  `44445` | `TCP` | `Address range` | `51.250.1.0/24`

  {% note tip %}

  When installing the Cloud Backup agent on your BareMetal server, you may need to install some missing software components from the internet. To have this done, allow all incoming network traffic for the network interface connected to the [public network](../../../baremetal/concepts/public-network.md) for as long as the installation continues. Once the Cloud Backup agent is installed, you can restrict network traffic once again in line with the network access permissions mentioned above.

  {% endnote %}

{% endlist %}

To provide network access:
{#provide-access}

* When [renting a server](../../../baremetal/operations/servers/server-lease.md), select `From ephemeral subnet` or `From a dedicated subnet` in the **Public address** field to assign a public IP address to the server.
* Make sure the sever network settings do not block outgoing traffic to the resources specified above.

## Connection statuses {#statuses}

You can view the server connection to Cloud Backup status info in the [management console](https://console.yandex.cloud) on the server list page in **BareMetal**. The following statuses are available:

* `Connected`: Cloud Backup is connected to the server, backups are being created as per the specified policies, the Cloud Backup agent is online.
* `No backup policy`: Cloud Backup is connected, but there are no associated policies; no backups are being created.
* `Failed`: Agent is offline, or agent registration failed.
* `Not connected`: Cloud Backup is not connected to the server.

#### See also {#see-also}

* [Managing BareMetal servers in Cloud Backup](../../operations/index.md#connect-baremetal)
* [Connecting Yandex Compute Cloud VMs to Cloud Backup](compute.md)
* [Connecting VMs and servers from outside Yandex Cloud to Cloud Backup](external-resources.md)