[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud Backup](../../index.md) > [Step-by-step guides](../index.md) > BareMetal in Cloud Backup > Leasing a BareMetal server connected to Cloud Backup # Renting a Yandex BareMetal server with a connection to Cloud Backup You can back up your BareMetal [servers](../../../baremetal/concepts/servers.md) with supported Linux-based operating systems: {#os-support} * CentOS 7. * Debian 11. * Ubuntu 16.04 LTS. * Ubuntu 18.04 LTS. * Ubuntu 20.04 LTS. * Ubuntu 22.04 LTS. * Ubuntu 24.04 LTS. To connect a server to Yandex Cloud Backup, you need the `backup.user` [role](../../security/index.md#backup-user) or higher. {% note warning %} Starting August 1, 2026, the [`baremetal.editor`](../../../baremetal/security/index.md#baremetal-editor) and [`baremetal.admin`](../../../baremetal/security/index.md#baremetal-admin) roles get new permissions that allow them to connect BareMetal servers to Yandex Cloud Backup, as well as bind and unbind them from [backup policies](../../concepts/policy.md). If you do not plan to connect your resources to Cloud Backup and do not want to grant such permissions to your users, you can proactively disable these features using the `backup.denyActivation` [authorization policy](../../../iam/concepts/access-control/access-policies.md#backup-denyActivation) assigned to your folder, cloud, or organization. For more information on how to create an authorization policy, see [Creating an access policy for a resource](../../../iam/operations/access-policies/assign.md). {% endnote %} ## Server rent {#server-rent} {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to lease a server. 1. Navigate to **BareMetal**. 1. Click **Lease server** and in the window that opens, select `Stock configurations` and a suitable BareMetal server [configuration](../../../baremetal/concepts/server-configurations.md). To select the suitable server configuration, click the section with its name in the central part of the screen. {% note info %} To quickly find the right configuration, you can use the filter with the hardware characteristics of the configurations on the right side of the screen. {% endnote %} {% note tip %} You can reduce the cost of renting a server in some configurations by ordering server [assembly](../../../baremetal/concepts/server-custom-configurations.md#assembly). To use the discount, hover over **Cheaper with assembly** ![circle-info.svg](../../../_assets/console-icons/circle-info.svg) under the configuration at hand and click ![person-nut-hex.svg](../../../_assets/console-icons/person-nut-hex.svg) **Go to assembly** in the pop-up window. When ordering a server with assembly, follow the steps below to configure the server properties. In this case, the server will not be available immediately, but only after the assembly is completed (within four calendar days), and at a lower price. {% endnote %} 1. Under **Configuration**, **Location**, and **Lease conditions**, make sure the server configuration you have provided so far is adequate. If not, click ![arrow-left](../../../_assets/console-icons/arrow-left.svg) under **Configuration** to return to configuration setup. 1. In the **Lease duration** field, select the [lease period](../../../baremetal/concepts/servers.md#server-lease): `1 day`, `1 month`, `3 months`, `6 months`, or `1 year`. When this period expires, server lease will automatically be renewed for the same period. You cannot terminate the lease during the specified lease period, but you can [refuse](../../../baremetal/operations/servers/server-lease-cancel.md) to extend the server lease further. 1. In the **Number of servers** field, select how many servers of this configuration that you want to lease. 1. Under **Image**, select `Marketplace` and an [OS supported by Cloud Backup](#os-support). 1. Optionally, under **Disk**, configure [disk](../../../baremetal/concepts/disks/disk-types.md) partitioning: 1. Click **Configure disk layout**. 1. Specify partition settings. To create a new partition, click ![icon](../../../_assets/console-icons/plus.svg) **Add partition**. To configure [RAID](../../../baremetal/concepts/disks/raid.md) arrays and disk partitions by yourself, click **Remove RAID**. 1. Click **Save**. {% note info %} The disk partitioning parameters are vital to have your server restored from a backup later on. For more information, see [Restoring a VM or Yandex BareMetal server from a backup](../backup-vm/recover.md). {% endnote %} 1. Under **Network interfaces**, in the **Interface 1** section, select a [private subnet](../../../baremetal/concepts/private-network.md#private-subnet) in the [availability zone](../../../overview/concepts/geo-scope.md) you are renting the server in. If the server’s availability zone does not have a private subnet yet, or you want to create a new private subnet, click **Create** and, in the window that opens, specify subnet settings as described in [Creating a private subnet](../../../baremetal/operations/subnet-create.md). 1. Under **Network interfaces**, in the **Interface 1** section: * In the **Public address** field, select a public IP address assignment method: * `From ephemeral subnet`: Assign a random IP address. If you need to get the IP address when creating a server via a request to a DHCP server, enable **Assign via DHCP**. * `From a dedicated subnet`: To assign an IP address from the range of addresses of a [dedicated public subnet](../../../baremetal/concepts/public-network.md#public-subnet). In the field that opens, select a public subnet or click **Order** to [order](../../../baremetal/operations/reserve-public-subnet.md) a new one. {% note warning %} The dedicated public subnet [does not have](../../../baremetal/concepts/dhcp.md#dhcp-public-subnet) a DHCP server; therefore, on the network interface of the server connected to such subnet, you should manually configure a static IP address from the subnet’s range of available public IP addresses and specify the default gateway address. {% endnote %} * In the **Bandwidth** field, select a [server bandwidth](../../../baremetal/concepts/network-restrictions.md#bandwidth-for-pubic-network) package. Available bandwidth packages: * `10 TB per day, connection capacity, 1 Gbit/s` * `100 TB per day, connection capacity, 10 Gbit/s` {% note info %} You can select a bandwidth package only for configurations with a public IP address and network cards of 10 Gbps or higher. You can reduce the connection capacity to 10 TB per day only as early as 24 hours after the server lease starts. {% endnote %} For the [Cloud Backup](../../concepts/agent.md) agent to exchange data with the [backup provider](../../concepts/index.md#providers) servers, make sure the server has network access to the IP addresses of Cloud Backup resources based on the following table: {#ip-access} Port range | Protocol | Destination name | CIDR blocks --- | --- | --- | --- `80` | `TCP` | `CIDR` | `213.180.193.0/24` `80` | `TCP` | `CIDR` | `213.180.204.0/24` `443` | `TCP` | `CIDR` | `84.47.172.0/24` `443` | `TCP` | `CIDR` | `84.201.181.0/24` `443` | `TCP` | `CIDR` | `178.176.128.0/24` `443` | `TCP` | `CIDR` | `213.180.193.0/24` `443` | `TCP` | `CIDR` | `213.180.204.0/24` `7770-7800` | `TCP` | `CIDR` | `84.47.172.0/24` `8443` | `TCP` | `CIDR` | `84.47.172.0/24` `44445` | `TCP` | `CIDR` | `51.250.1.0/24` {% note tip %} When installing the [Cloud Backup agent](../../concepts/agent.md) on your VM or BareMetal server, you might need to install missing software components from the internet. To do this, add the following outgoing traffic rule to the [security group](../../../vpc/concepts/security-groups.md): * **Port range**: `0-65535`. * **Protocol**: `Any`. * **Destination name**: `CIDR`. * **CIDR blocks**: `0.0.0.0/0`. Once the Cloud Backup agent is installed, you can delete this rule. To access the VM over [SSH](../../../compute/operations/vm-connect/ssh.md), add the following incoming traffic rule: * **Port range**: `22`. * **Protocol**: `Any`. * **Destination name**: `CIDR`. * **CIDR blocks**: `0.0.0.0/0`. {% endnote %} 1. Under **Access**: 1. In the **Password** field, select one of the following options to create a root password: * To generate a new root password, select `New password` and click **Generate**. {% note warning %} This option requires you to maintain password security. Save the password you generated in a secure location. Yandex Cloud does not store it, and you will not be able to retrieve it once the server is deployed. {% endnote %} * To use the root password saved in a Yandex Lockbox [secret](../../../lockbox/concepts/secret.md), select `Lockbox secret`. In the **Name**, **Version**, and **Key** fields, select the secret containing your password, its version, and its key, respectively. If you do not have a Yandex Lockbox secret, click **Create** to create it. Choose the `Custom` secret type to specify a custom password or `Generated` to generate password automatically. 1. In the **Public SSH key** field, select the SSH key saved in your [organization user](../../../organization/concepts/membership.md) profile. If there are no SSH keys in your profile or you want to add a new key: 1. Click **Add key**. 1. Enter a name for the SSH key. 1. Select one of the following: * `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own. * `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own. * `Generate key`: Automatically create an SSH key pair. When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home//.ssh` directory. In Windows, unpack the archive to the `C:\Users\/.ssh` directory. You do not need additionally enter the public key in the management console. 1. Click **Add**. The system will add the SSH key to your organization user profile. If the organization has [disabled](../../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource. 1. Enable server backup in Cloud Backup: 1. Enable **Backup**. 1. Select an existing [backup policy](../../concepts/policy.md) or [create](../policy-vm/create.md) a new one. 1. Select a [service account](../../../iam/concepts/users/service-accounts.md) with the [`baremetal.editor`](../../../baremetal/security/index.md#baremetal-editor) and [`backup.user`](../../security/index.md#backup-user) roles assigned or [create](../../../iam/operations/sa/create.md) a new one. 1. Under **Server information**: 1. Specify the server name in the **Name** field. Follow these naming requirements: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. 1. Optionally, add a server description in the **Description** field. 1. Optionally, set [labels](../../../resource-manager/concepts/labels.md) in the **Labels** field. 1. Click **Lease server**. {% endlist %} For more information on renting a server, see [this BareMetal guide](../../../baremetal/operations/servers/server-lease.md). {% note info %} If you are using [LVM](https://en.wikipedia.org/wiki/Logical_Volume_Manager_(Linux)) to manage the disk space of the protected resource, learn [how to restore](../../concepts/backup.md#lvm) resources with LVM in Cloud Backup. {% endnote %}