Backups
SFTP backup automation: transfer backups without hard-coding a password
SFTP backup automation is a secure file-transfer building block, not a complete backup product by itself. A reliable job needs dedicated credentials, non-interactive host-key verification, atomic or clearly named uploads, success/failure monitoring, retention, and periodic restores.
Use a dedicated restricted account/key
Create a credential used only for the backup destination and protect the private key or password outside source control. Restrict the destination account to the required storage path and capabilities where the server supports it.
Do not reuse an administrator SSH key for unattended backups.
Pin server identity non-interactively
Automation should verify the expected SSH host key and keep StrictHostKeyChecking enabled. Record how a legitimate key rotation is approved and deployed.
A DNS hostname is convenient, but host-key verification is what prevents silently sending backups to an impostor after DNS/network compromise.
Make uploads and retention observable
Use timestamped/snapshot-aware paths and avoid treating a partially uploaded file as a valid recovery point. Capture exit status, bytes transferred, duration, and newest successful backup age.
Implement retention on the side that can safely enumerate complete backups; test pruning so it cannot delete all recovery points.
Restore through the same credentials/process
Regularly download a real backup to an isolated destination, verify integrity/decryption, and rebuild the application data needed. Alert if the job has not produced a fresh backup within the expected window.
- Use dedicated backup credentials.
- Pin host keys.
- Detect partial/failed uploads.
- Test download and restore.