Bacula is an open-source, enterprise-grade backup solution that manages backup, recovery, and verification of data across a network of computers. It supports Linux, Windows, macOS, and various Unix systems, making it a solid choice for heterogeneous environments where centralized backup management is needed.
This guide covers installing and configuring Bacula 11.0.1 on Rocky Linux 10 and AlmaLinux 10. We set up all core components – Director, Storage Daemon, File Daemon, and Console – with MariaDB as the catalog database. By the end, you will have a working backup server capable of running local and remote backup jobs. For the full Bacula architecture overview, see the official Bacula documentation.
Prerequisites
- A server running Rocky Linux 10 or AlmaLinux 10 with at least 2 GB RAM and 20 GB free disk space for backups
- Root or sudo access
- A static IP address or hostname that resolves to the server
- Firewall access to ports 9101 (Director), 9102 (File Daemon), and 9103 (Storage Daemon) – all TCP
- For remote clients: Bacula File Daemon installed on each client machine
Step 1: Update the System
Start by updating all packages to the latest available versions.
sudo dnf update -yReboot if a kernel update was applied.
sudo rebootStep 2: Configure SELinux
Bacula does not ship SELinux policies in the default packages, so it may fail to operate with SELinux in enforcing mode. The simplest approach is to set SELinux to permissive mode. If you need to keep SELinux enforcing, you will need to create custom policies for the Bacula daemons. For more details on managing SELinux, see our guide on how to configure SELinux on Rocky Linux 10 / AlmaLinux 10.
Set SELinux to permissive mode.
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/configConfirm the change took effect.
getenforceThe output should show Permissive.
Step 3: Install MariaDB for the Bacula Catalog
Bacula requires a database backend for its catalog – the index of all backed-up files. It supports MariaDB/MySQL, PostgreSQL, and SQLite. This guide uses MariaDB since it is available directly from the Rocky Linux 10 AppStream repository. If you want the latest MariaDB release with additional features, check our dedicated guide on how to install MariaDB on Rocky Linux 10 / AlmaLinux 10.
Install the MariaDB server package.
sudo dnf install -y mariadb-serverEnable and start the MariaDB service.
sudo systemctl enable --now mariadbVerify the service is running.
systemctl status mariadbYou should see active (running) in the output, confirming MariaDB started successfully.
Create the Bacula Database and User
Log in to the MariaDB shell.
sudo mysql -u rootCreate the Bacula database and grant privileges to a dedicated user. Replace StrongPassword123 with your own secure password.
CREATE DATABASE bacula;
GRANT ALL PRIVILEGES ON bacula.* TO 'bacula'@'localhost' IDENTIFIED BY 'StrongPassword123';
FLUSH PRIVILEGES;
EXIT;Step 4: Install Bacula Backup on Rocky Linux 10
Bacula 11.0.1 is available in the Rocky Linux 10 / AlmaLinux 10 AppStream repository. Install the Director, Storage Daemon, File Daemon, and Console packages.
sudo dnf install -y bacula-director bacula-storage bacula-client bacula-consoleThis pulls in the required dependencies including bacula-common, bacula-libs, and bacula-libs-sql.
Switch the Catalog Backend to MySQL/MariaDB
By default, Bacula may use the PostgreSQL catalog library. Switch it to MySQL/MariaDB using the alternatives system.
sudo alternatives --config libbaccats.soSelect the MySQL option from the list. The output looks like this – enter 1 to select the MySQL library:
There are 3 programs which provide 'libbaccats.so'.
Selection Command
-----------------------------------------------
1 /usr/lib64/libbaccats-mysql.so
2 /usr/lib64/libbaccats-sqlite3.so
*+ 3 /usr/lib64/libbaccats-postgresql.so
Enter to keep the current selection[+], or type selection number: 1Create the Bacula Database Tables
Bacula ships with a helper script that creates all the required tables in the MariaDB database.
sudo /usr/libexec/bacula/make_mysql_tables -u rootIf the command completes without errors, the catalog schema is ready.
Step 5: Create Backup and Restore Directories
Bacula needs dedicated directories for storing backup volumes and staging restored files.
sudo mkdir -p /bacula/backup /bacula/restoreSet ownership and permissions so only the bacula user can access these directories.
sudo chown -R bacula:bacula /bacula
sudo chmod -R 700 /baculaStep 6: Configure the Bacula Director
The Director is the central component that controls all backup and restore operations. Open the configuration file.
sudo vim /etc/bacula/bacula-dir.confUpdate the Director block to set the listen address. This binds the Director to the local interface – change to 0.0.0.0 or a specific IP if remote consoles need access.
Director {
Name = bacula-dir
DIRport = 9101
QueryFile = "/etc/bacula/query.sql"
WorkingDirectory = "/var/spool/bacula"
PidDirectory = "/var/run"
Maximum Concurrent Jobs = 20
Password = "@@DIR_PASSWORD@@"
Messages = Daemon
DirAddress = 127.0.0.1
}Configure Backup and Restore Jobs
Find the Job sections in the file and configure the local backup and restore jobs. Make sure the Storage directive points to File1 and the restore path points to your restore directory.
Job {
Name = "BackupLocalFiles"
JobDefs = "DefaultJob"
}
Job {
Name = "RestoreLocalFiles"
Type = Restore
Client = bacula-fd
FileSet = "Full Set"
Storage = File1
Pool = Default
Messages = Standard
Where = /bacula/restore
}Configure the FileSet
The FileSet defines which files to include and exclude from backups. Update the Full Set FileSet to back up the root filesystem while excluding directories that should not be backed up.
FileSet {
Name = "Full Set"
Include {
Options {
signature = MD5
compression = GZIP
}
File = /
}
Exclude {
File = /var/lib/bacula
File = /proc
File = /sys
File = /tmp
File = /.journal
File = /.fsck
File = /bacula
}
}Configure the Catalog Connection
Update the Catalog section with your MariaDB credentials. Use the same password you set when creating the database.
Catalog {
Name = MyCatalog
dbname = "bacula"; dbuser = "bacula"; dbpassword = "StrongPassword123"
}Save the file and validate the Director configuration.
sudo bacula-dir -tc /etc/bacula/bacula-dir.confNo output means the configuration is valid. If there are errors, the command prints the offending line and directive.
Step 7: Configure the Bacula Storage Daemon
The Storage Daemon handles reading and writing backup data to disk or tape. Open its configuration file.
sudo vim /etc/bacula/bacula-sd.confFind the Device section under the Autochanger block and update the Archive Device to point to your backup directory.
Autochanger {
...
Device {
Name = FileChgr1-Dev2
Media Type = File1
Archive Device = /bacula/backup
LabelMedia = yes;
Random Access = Yes;
AutomaticMount = yes;
RemovableMedia = no;
AlwaysOpen = no;
}
...
}Save the file and verify the Storage Daemon configuration.
sudo bacula-sd -tc /etc/bacula/bacula-sd.confNo output confirms a valid configuration.
Step 8: Configure the Bacula File Daemon
The File Daemon (client agent) runs on each machine you want to back up. On the Bacula server itself, it is already installed. Open its configuration file.
sudo vim /etc/bacula/bacula-fd.confVerify the Director section has the correct Director name and that the FileDaemon section has an appropriate FDAddress. For a standalone server, 127.0.0.1 works. For remote clients backing up to this server, use the server’s actual IP.
Director {
Name = bacula-dir
Password = "@@FD_PASSWORD@@"
}
FileDaemon {
Name = bacula-fd
FDport = 9102
WorkingDirectory = /var/spool/bacula
Pid Directory = /var/run
Maximum Concurrent Jobs = 20
FDAddress = 127.0.0.1
}Validate the configuration.
sudo bacula-fd -tc /etc/bacula/bacula-fd.confStep 9: Open Firewall Ports for Bacula
Bacula uses three TCP ports that must be open in the firewall. If you are new to firewalld, see our guide on how to configure firewalld on Rocky Linux 10 / AlmaLinux 10.
| Port | Service |
|---|---|
| 9101/tcp | Bacula Director |
| 9102/tcp | Bacula File Daemon |
| 9103/tcp | Bacula Storage Daemon |
Open all three ports.
sudo firewall-cmd --permanent --add-port={9101,9102,9103}/tcp
sudo firewall-cmd --reloadVerify the ports are open.
sudo firewall-cmd --list-portsYou should see 9101/tcp 9102/tcp 9103/tcp in the output.
Step 10: Start and Enable Bacula Services
Start all three Bacula daemons and enable them to start at boot.
sudo systemctl enable --now bacula-dir bacula-fd bacula-sdVerify all services are running.
systemctl status bacula-dir bacula-fd bacula-sdAll three services should show active (running). If any service fails, check the logs with journalctl -u bacula-dir (or bacula-fd, bacula-sd) for configuration errors.
Confirm the Director is listening on port 9101.
sudo ss -tlnp | grep 9101The output confirms the Director daemon is accepting connections:
LISTEN 0 50 127.0.0.1:9101 0.0.0.0:* users:(("bacula-dir",pid=38394,fd=9))Step 11: Use bconsole to Run a Backup Job
The Bacula Console (bconsole) is the command-line interface for interacting with the Director. Connect to it.
sudo bconsoleYou should see a connection message followed by the * prompt, indicating a successful connection to the Director.
Check Director Status
Run the status dir command to check the Director status and see scheduled jobs.
*status dirThis shows the Director version, running jobs, and scheduled jobs.
Run a Backup Job
Run your first backup job from the console.
*run
Automatically selected Catalog: MyCatalog
Using Catalog "MyCatalog"
A job name must be specified.
The defined Job resources are:
1: BackupLocalFiles
2: RestoreLocalFiles
3: BackupCatalog
4: RestoreFiles
Select Job resource (1-4): 1Confirm the job details and enter yes to start the backup.
Run Backup job
JobName: BackupLocalFiles
Level: Incremental
Client: bacula-fd
FileSet: Full Set
Pool: File (From Job resource)
Storage: File1 (From Job resource)
When: 2026-03-21 12:00:00
Priority: 10
OK to run? (yes/mod/no): yes
Job queued. JobId=1Monitor Job Status
Check the client status to see if the backup completed.
*status client
Automatically selected Client: bacula-fd
Terminated Jobs:
JobId Level Files Bytes Status Finished Name
===================================================================
1 Full 140,389 5.424 G OK 21-Mar-26 12:05 BackupLocalFilesA status of OK confirms the backup completed successfully.
Restore Files from Backup
To test a restore, run the restore command from bconsole.
*restore all
First you select one or more JobIds that contain files
to be restored. You will be presented several methods
of specifying the JobIds. Then you will be allowed to
select which files from those JobIds are to be restored.
To select the JobIds, you have the following choices:
...
Select item: 5
Select the most recent backup for a client
...
OK to run? (yes/mod/no): yesRestored files will be placed in /bacula/restore. After the restore completes, verify the files are present.
ls -la /bacula/restore/You should see a directory structure mirroring the backed-up filesystem.
Step 12: Useful bconsole Commands
Here are the most commonly used bconsole commands for daily Bacula administration. Refer to the Bacula documentation for a complete command reference.
| Command | Description |
|---|---|
| status dir | Show Director status and scheduled jobs |
| status client | Show File Daemon status and job history |
| status storage | Show Storage Daemon status |
| run | Start a backup or restore job |
| restore all | Restore all files from a backup |
| restore | Interactively select files to restore |
| messages | Show pending messages from jobs |
| show filesets | Display configured FileSets |
| reload | Reload Director configuration without restart |
| rerun jobid=N | Re-run a failed job |
Step 13: Add a Remote Bacula Client
To back up remote machines, install the Bacula File Daemon on each client. For data protection on storage volumes used by remote clients, consider setting up shared storage with NFS on Rocky Linux 10 / AlmaLinux 10.
Install the File Daemon on the Client
On RHEL-based systems (Rocky Linux, AlmaLinux, RHEL):
sudo dnf install -y bacula-clientOn Debian/Ubuntu systems:
sudo apt install -y bacula-clientConfigure the Remote File Daemon
Open the File Daemon configuration on the remote client.
sudo vim /etc/bacula/bacula-fd.confUpdate the Director section with the Bacula server’s Director name and a shared password. Set the FileDaemon name and the client’s IP address.
Director {
Name = bacula-dir
Password = "SharedSecretPassword"
}
FileDaemon {
Name = remote-client-fd
FDport = 9102
WorkingDirectory = /var/spool/bacula
Pid Directory = /var/run
Maximum Concurrent Jobs = 20
FDAddress = 192.168.1.20
}Validate the configuration and start the service.
sudo bacula-fd -tc /etc/bacula/bacula-fd.conf
sudo systemctl enable --now bacula-fdOn RHEL-based clients, open port 9102 in the firewall.
sudo firewall-cmd --permanent --add-port=9102/tcp
sudo firewall-cmd --reloadAdd the Client to the Bacula Director
Back on the Bacula server, open the Director configuration.
sudo vim /etc/bacula/bacula-dir.confAdd a Client resource for the remote machine. Use the same password set in the client’s bacula-fd.conf.
Client {
Name = remote-client-fd
Address = 192.168.1.20
FDPort = 9102
Catalog = MyCatalog
Password = "SharedSecretPassword"
File Retention = 1 year
Job Retention = 1 year
AutoPrune = yes
}Add a FileSet, Pool, and Jobs for the remote client.
FileSet {
Name = "RemoteFS"
Include {
Options {
signature = MD5
compression = GZIP
}
File = /etc
File = /home
File = /var/www
}
}
Pool {
Name = RemotePool
Pool Type = Backup
Label Format = "RM-"
}
Job {
Name = "BackupRemoteFiles"
Client = remote-client-fd
JobDefs = "DefaultJob"
Enabled = yes
FileSet = "RemoteFS"
}
Job {
Name = "RestoreRemoteFiles"
Type = Restore
Client = remote-client-fd
FileSet = "Full Set"
Storage = File1
Pool = RemotePool
Messages = Standard
Where = /bacula/restore
}Save the file, validate, and restart the Director.
sudo bacula-dir -tc /etc/bacula/bacula-dir.conf
sudo systemctl restart bacula-dirVerify the new client is visible from bconsole.
sudo bconsoleRun status client and select the remote client to confirm connectivity.
*status client
The defined Client resources are:
1: bacula-fd
2: remote-client-fd
Select Client (File daemon) resource (1-2): 2If the client connects successfully, you will see its status and job history. If the connection times out, verify the firewall on the client allows port 9102 and the passwords match between the Director and File Daemon configurations. If you are looking for an alternative to Bacula, consider Bareos, which is a fork of Bacula with additional community features.
Conclusion
You now have a working Bacula backup server on Rocky Linux 10 / AlmaLinux 10 with MariaDB as the catalog, local backup jobs configured, and the ability to add remote clients. The setup handles full and incremental backups with MD5 verification and GZIP compression.
For production use, set strong unique passwords for each daemon (replace the @@PASSWORD@@ tokens), schedule automated backup jobs with retention policies, and monitor the Bacula logs for failed jobs. Consider enabling TLS encryption between daemons if backups traverse untrusted networks.
