Warning: This document is for the development version of Bareos Documentation. The main version is bareos-23.

Customizing the Configuration

Each Bareos component (Director, Client, Storage, Console) has its own configuration containing a set of resource definitions. These resources are very similar from one service to another, but may contain different directives (records) depending on the component. For example, in the Director configuration, the Director Resource defines the name of the Director, a number of global Director parameters and his password. In the File daemon configuration, the Director Resource specifies which Directors are permitted to use the File daemon.

If you install all Bareos daemons (Director, Storage and File Daemon) onto one system, the Bareos package tries its best to generate a working configuration as a basis for your individual configuration.

The details of each resource and the directives permitted therein are described in the following chapters.

The following configuration files must be present:

  • Director Configuration – to define the resources necessary for the Director. You define all the Clients and Storage daemons that you use in this configuration file.

  • Storage Daemon Configuration – to define the resources to be used by each Storage daemon. Normally, you will have a single Storage daemon that controls your disk storage or tape drives. However, if you have tape drives on several machines, you will have at least one Storage daemon per machine.

  • Client/File Daemon Configuration – to define the resources for each client to be backed up. That is, you will have a separate Client resource file on each machine that runs a File daemon.

  • Console Configuration – to define the resources for the Console program (user interface to the Director). It defines which Directors are available so that you may interact with them.

Configuration Path Layout

When a Bareos component starts, it reads its configuration. In Bareos < 16.2.2 only configuration files (which optionally can include other files) are supported. Since Bareos Version >= 16.2.2 also configuration subdirectories are supported.


In this section, the following naming is used:

  • CONFIGDIR refers to the base configuration directory. Bareos Linux packages use /etc/bareos/.

  • A component is one of the following Bareos programs:

    • bareos-dir

    • bareos-sd

    • bareos-fd

    • bareos-traymonitor

    • bconsole

    • Bareos tools, like Volume Utility Commands and others.

  • COMPONENT refers to one of the listed components.

What configuration will be used?

When starting a Bareos component, it will look for its configuration. Bareos components allow the configuration file/directory to be specified as a command line parameter -c PATH.

  • configuration path parameter is not given (default)

    • CONFIGDIR/COMPONENT.conf is a file

      • the configuration is read from the file CONFIGDIR/COMPONENT.conf

    • CONFIGDIR/COMPONENT.d/ is a directory

      • the configuration is read from CONFIGDIR/COMPONENT.d/*/*.conf (subdirectory configuration)

  • configuration path parameter is given (-c PATH)

    • PATH is a file

      • the configuration is read from the file specified in PATH

    • PATH is a directory

      • the configuration is read from PATH/COMPONENT.d/*/*.conf (subdirectory configuration)

As the CONFIGDIR differs between platforms or is overwritten by the path parameter, the documentation will often refer to the configuration without the leading path (e.g. COMPONENT.d/*/*.conf instead of CONFIGDIR/COMPONENT.d/*/*.conf).


When subdirectory configuration is used, all files matching PATH/COMPONENT.d/*/*.conf will be read, see Subdirectory Configuration Scheme.

Relation between Bareos components and configuration

Bareos configuration default paths on Unix

Bareos component

Configuration File

Subdirectory Configuration Scheme

(default path on Unix)

(default path on Unix)




Director Configuration






Storage Daemon Configuration






Client/File Daemon Configuration






Console Configuration






Monitor Configuration



Volume Utility Commands



(use the bareos-sd configuration)



Subdirectory Configuration Scheme

If the subdirectory configuration is used, instead of a single configuration file, all files matching COMPONENT.d/*/*.conf are read as a configuration, see What configuration will be used?.

Reason for the Subdirectory Configuration Scheme

In Bareos < 16.2.2, Bareos uses one configuration file per component.

Most larger Bareos environments split their configuration into separate files, making it easier to manage the configuration.

Also some extra packages (bareos-webui, plugins, …) require a configuration, which must be included into the Bareos Director or Bareos Storage Daemon configuration. The subdirectory approach makes it easier to add or modify the configuration resources of different Bareos packages.

The Bareos configure command requires a configuration directory structure, as provided by the subdirectory approach.

From Bareos Version >= 16.2.4 on, new installations will use configuration subdirectories by default.

Resource file conventions

  • Each configuration resource has to use its own configuration file.

  • The path of a resource file is COMPONENT.d/RESOURCETYPE/RESOURCENAME.conf.

  • The name of the configuration file is identical with the resource name:

    • e.g.

      • bareos-dir.d/director/bareos-dir.conf

      • bareos-dir.d/pool/Full.conf

    • Exceptions:

      • The resource file bareos-fd.d/client/myself.conf always has the file name myself.conf, while the name is normally set to the hostname of the system.

  • Example resource files:

    • Additional packages can contain configuration files that are automatically included. However, most additional configuration resources require configuration. When a resource file requires configuration, it has to be included as an example file:


      • For example, the Bareos WebUI entails one config resource and one config resource example for the Bareos Director:

        • CONFIGDIR/bareos-director.d/profile/webui-admin.conf

        • CONFIGDIR/bareos-director.d/console/admin.conf.example

  • Disable/remove configuration resource files:

    Normally you should not remove resources that are already in use (jobs, clients, …). Instead you should disable them by adding the directive Enable = no. Otherwise you take the risk that orphaned entries are kept in the Bareos catalog. However, if a resource has not been used or all references have been cleared from the database, they can also be removed from the configuration.


    If you want to remove a configuration resource that is part of a Bareos package, replace the resource configuration file by an empty file. This prevents the resource from reappearing in the course of a package update.

Using Subdirectories Configuration Scheme

New installation
  • The Subdirectories Configuration Scheme is used by default from Bareos Version >= 16.2.4 onwards.

  • They will be usable immediately after installing a Bareos component.

  • If additional packages entail example configuration files (NAME.conf.example), copy them to NAME.conf, modify it as required and reload or restart the component.

Updates from Bareos < 16.2.4
  • When updating to a Bareos version containing the Subdirectories Configuration, the existing configuration will not be touched and is still the default configuration.


    Problems can occur if you have implemented an own wildcard mechanism to load your configuration from the same subdirectories as used by the new packages (CONFIGDIR/COMPONENT.d/*/*.conf). In this case, newly installed configuration resource files can alter your current configuration by adding resources.

    Best create a copy of your configuration directory before updating Bareos and modify your existing configuration file to use that other directory.

  • As long as the old configuration file (CONFIGDIR/COMPONENT.conf) exists, it will be used.

  • The correct way of migrating to the new configuration scheme would be to split the configuration file into resources, store them in the resource directories and then remove the original configuration file.

    • For migrating the Bareos Director configuration, the script bareos-migrate-config.sh exists. Being called, it connects via bconsole to a running Bareos Director and creates subdirectories with the resource configuration files.

      # prepare temporary directory
      mkdir /tmp/bareos-dir.d
      cd /tmp/bareos-dir.d
      # download migration script
      wget https://raw.githubusercontent.com/bareos/bareos/master/contrib/misc/bareos-migrate-config/bareos-migrate-config.sh
      # execute the script
      bash bareos-migrate-config.sh
      # backup old configuration
      mv /etc/bareos/bareos-dir.conf /etc/bareos/bareos-dir.conf.bak
      mv /etc/bareos/bareos-dir.d /etc/bareos/bareos-dir.d.bak
      # make sure, that all packaged configuration resources exists,
      # otherwise they will be added when updating Bareos.
      for i in `find  /etc/bareos/bareos-dir.d.bak/ -name *.conf -type f -printf "%P\n"`; do touch "$i"; done
      # install newly generated configuration
      cp -a /tmp/bareos-dir.d /etc/bareos/

      Restart the Bareos Director and verify your configuration. Also make sure, that all resource configuration files coming from Bareos packages exists, in doubt as empty files, see remove configuration resource files.

    • Another way, without splitting the configuration into resource files is:

      move configuration to subdirectory

      Resources defined in both, the new configuration directory scheme and the old configuration file, must be removed from one of the places, best from the old configuration file, after verifying that the settings are identical with the new settings.

Configuration File Format

A configuration file consists of one or more resources (see Resource).

Bareos programs can work with

Character Sets

Bareos is designed to handle most character sets of the world, US ASCII, German, French, Chinese, … However, it does this by encoding everything in UTF-8, and it expects all configuration files (including those read on Win32 machines) to be in UTF-8 format. UTF-8 is typically the default on Linux machines, but not on all Unix machines, nor on Windows, so you must take some care to ensure that your locale is set properly before starting Bareos.

To ensure that Bareos configuration files can be correctly read including foreign characters, the LANG environment variable must end in .UTF-8. A full example is en_US.UTF-8. The exact syntax may vary a bit from OS to OS, so that the way you have to define it will differ from the example. On most newer Win32 machines you can use notepad to edit the conf files, then choose output encoding UTF-8.

Bareos assumes that all filenames are in UTF-8 format on Linux and Unix machines. On Win32 they are in Unicode (UTF-16) and will hence be automatically converted to UTF-8 format.


When reading a configuration, blank lines are ignored and everything after a hash sign (#) until the end of the line is taken to be a comment.


A semicolon (;) is a logical end of line and anything after the semicolon is considered as the next statement. If a statement appears on a line by itself, a semicolon is not necessary to terminate it, so generally in the examples in this manual, you will not see many semicolons.

Including other Configuration Files

If you wish to break your configuration file into smaller pieces, you can do so by including other files using the syntax @filename where filename is the full path and filename of another file. The @filename specification can be given anywhere a primitive token would appear.

include a configuration file

Since Bareos Version >= 16.2.1 wildcards in pathes are supported:

include multiple configuration files

By using @|command it is also possible to include the output of a script as a configuration:

use the output of a script as configuration

or if a parameter should be used:

use the output of a script with parameter as a configuration
@|"sh -c '/etc/bareos/generate_client_configuration_to_stdout.sh clientname=client1.example.com'"

The scripts are called at the start of the daemon. You should use this with care.


A resource is defined as the resource type, followed by an open brace ({), a number of Resource Directive, and ended by a closing brace (})

Each resource definition MUST contain a Name directive. It can contain a Description directive. The Name directive is used to uniquely identify the resource. The Description directive can be used during the display of the Resource to provide easier human recognition. For example:

Resource example
Director {
  Name = "bareos-dir"
  Description = "Main Bareos Director"
  Query File = "/usr/lib/bareos/scripts/query.sql"

defines the Director resource with the name bareos-dir and a query file /usr/lib/bareos/scripts/query.sql.

When naming resources, for some resource types naming conventions should be applied:


names should be postfixed with -fd


names should be postfixed with -sd


names should be postfixed with -dir

These conventions helps a lot when reading log messages.

Resource Directive

Each directive contained within the resource (within the curly braces {}) is composed of a Resource Directive Keyword followed by an equal sign (=) followed by a Resource Directive Value. The keywords must be one of the known Bareos resource record keywords.

Resource Directive Keyword

A resource directive keyword is the part before the equal sign (=) in a Resource Directive. The following sections will list all available directives by Bareos component resources.

Upper and Lower Case and Spaces

Case (upper/lower) and spaces are ignored in the resource directive keywords.

Within the keyword (i.e. before the equal sign), spaces are not significant. Thus the keywords: name, Name, and N a m e are all identical.

Resource Directive Value

A resource directive value is the part after the equal sign (=) in a Resource Directive.


Spaces after the equal sign and before the first character of the value are ignored. Other spaces within a value may be significant (not ignored) and may require quoting.


In general, if you want spaces in a name to the right of the first equal sign (=), you must enclose that name within double quotes. Otherwise quotes are not generally necessary because once defined, quoted strings and unquoted strings are all equal.

Within a quoted string, any character following a backslash () is taken as itself (handy for inserting backslashes and double quotes (“)).


Since Bareos Version >= 20 strings can be spread over multiple lines using quotes like this:

Multiline string values
FooBar = "This is the first line of text"
         "  This is another line"
  "This is the third line   "


If the configure directive is used to define a number, the number is never to be put between surrounding quotes. This is even true if the number is specified together with its unit, like 365 days.


Numbers are not to be quoted, see Quotes. Also do not prepend numbers by zeros (0), as these are not parsed in the expected manner (write 1 instead of 01).

Data Types

When parsing the resource directives, Bareos classifies the data according to the types listed below.



This directive defines what is permitted to be accessed. It does this by using a list of regular expressions, separated by commas (,) or using multiple directives. If ! is prepended, the expression is negated. The special keyword *all* allows unrestricted access.

Depending on the type of the ACL, the regular expressions can be either resource names, paths or console commands.

Since Bareos Version >= 16.2.4 regular expression are handled more strictly. Before also substring matches has been accepted.

For clarification, we demonstrate the usage of ACLs by some examples for Command ACL (Dir->Console):

Allow only the help command
Command ACL = help
Allow the help and the list command
Command ACL = help, list
Allow the help and the (not existing) iDoNotExist command
Command ACL = help, iDoNotExist
Allow all commands (special keyword)
Command ACL = *all*
Allow all commands except sqlquery and commands starting with u
Command ACL = !sqlquery, !u.*, *all*


Some as above. Specifying it in multiple lines doesn’t change the meaning
Command ACL = !sqlquery, !u.*
Command ACL = *all*
Additional deny the setip and setdebug commands
Command ACL = !sqlquery
Command ACL = !u.*
Comamnd ACL = !set(ip|debug)
Comamnd ACL = *all*


ACL checking stops at the first match. So the following definition allows all commands, which might not be what you expected:

Wrong: Allows all commands
# WARNING: this configuration ignores !sqlquery, as *all* is matched before.
Command ACL = *all*, !sqlquery

Action to perform on Purge, mostly truncate.


Is either a domain name or an IP address specified as a dotted quadruple in string or an IP version 6 address specified as a colon separated syntax (::) or quoted string format. This directive only permits a single address to be specified. The Port must be specifically separated. If multiple Addresses are needed, please assess if it is also possible to specify ADDRESSES (plural).


Specify a set of Addresses and Ports. Probably the simplest way to explain this is to show an example.

The following example makes the director listen for connections on all interfaces both on IPv4 and IPv6.

Listen on IPv4 and IPv6 for Bareos < 21
DirAddresses = {
   ipv6 = { addr = :: ; port = 9101 }


Since Bareos Version >= 21 on two distinct sockets, this is not required anymore. This notation will be required if you want to restrict the addresses to listen on.

Listen on IPv4 and IPv6 for Bareos >= 21 (default)
DirAddresses = {
   ipv4 = { addr = ; port = 9101 }
   ipv6 = { addr = :: ; port = 9101 }

The following example shows all of the features the Addresses parser:

Showing Addresses features
Addresses  = {
    ip = { addr =; port = 1205;}
    ip = {
        addr =
        port = 1205
    ipv4 = {
        addr =; port = http;}
    ipv6 = {
        addr = 2001:db8::;
        port = 1205;
    ip = { addr = }
    ip = { addr = 2001:db8:: }
    ip = {
        addr = server.example.com

Where ip, ipv4, ipv6, addr, and port are all keywords. Note, that the address can be specified as either a dotted quadruple, or in IPv6 colon notation, or as a symbolic name (only in the ip specification). Also, the port can be specified as a number or as the mnemonic value from the /usr/etc/services file. If a port is not specified, the default one will be used. If an ip section is specified, the resolution can be made either by IPv4 or IPv6. If ipv4 is specified, then only IPv4 resolutions will be permitted, and likewise with IPv6.

Bareos >= 21 : Listening on all IPv6 and only IPv4 localhost
 Addresses  = {
  ipv6 = { addr = :: }
  ipv4 = { addr = }
Bareos >= 21 : Listening only on IPv4
 Addresses  = {
  ipv4 = { addr = }
Bareos >= 21 : Listening on specific IPv6 and none IPv4
Addresses  = {
  ipv6 = { addr = ::1 }
  ipv6 = { addr = 2001:0db8:0000:0000:ba4e:0s00:0000:ba3e;}

Specifies the commands that should be logged on execution (audited). E.g.

Audit Events = label
Audit Events = restore

Native | NDMPV2 | NDMPV3 | NDMPV4

See also:


Either select the native Bareos protocol or a NDMP protocol.


Specifies the authentication type that must be supplied when connecting to a backup protocol that uses a specific authentication type. Currently only used for NDMP Resource.

The following values are allowed: None (Use no password), Clear (Use clear text password), MD5 (Use MD5 hashing).


This is a Bareos password and it is stored internally in MD5 hashed format.


The following string values are allowed:

For backup job

Full, Differential, Incremental, VirtualFull

For verify job

InitCatalog, Catalog, VolumeToCatalog, DiskToCatalog

See details at Level (Dir->Job).


Either a yes or a no or a true or a false.


Either a yes or a no or a true or a false.


The following values are allowed: GZIP (GZIP1 to GZIP9), LZO, LZFAST (deprecated Version >= 19.2., LZ4, LZ4HC.

See Compression (Dir->Fileset->Include->Options).


See Device (Dir->Storage).


The following values are allowed: Tape, File, FIFO, GFAPI, Droplet Version >= 17.2.7.

See Device Type (Sd->Device).


A directory.



A list of directories.


A directory, and or a command using substitution.


String list of cipher to use for encryption.


The Include or Exclude resource must contain a list of directories and/or files to be processed, excluded in the backup job.


-2147483648 - +2147483647



A signed 32 bit integer value.

Don’t use quotes around the number, see Quotes.


in | out | both

String indicating sens of IO can be in or out or both Following aliases are also valid:


Alias for in.


Alias for in.


Alias for out.


Alias for out.


Alias for both.


Backup | Restore | Verify | Admin | Migrate | Copy | Consolidate

See Type (Dir->Job)


Quoted string for volume label.



Positive integer

If no value or zero is specified, the Storage daemon will use a default block size of 64,512 bytes (126 * 512).


MD5 hashed format of password.


See Messages Resource.


The following values are allowed: SmallestVolume, OldestVolume, Client, Volume, Job, SQLQuery, PoolOccupancy, PoolTime, PoolUncopiedJobs

See Selection Type (Dir->Job).


A keyword or name consisting of alphanumeric characters, including the hyphen, underscore, and dollar characters. The first character of a name must be a letter. A name has a maximum length currently set to 127 bytes.

Please note that Bareos resource names as well as certain other names (e.g. Volume names) must contain only letters (including ISO accented letters), numbers, and a few special characters (space, underscore, …). All other characters and punctuation are invalid.


0 - 65535



A positive 16 bit unsigned integer value.

Don’t use quotes around the number, see Quotes.


0 - 4294967295



A positive 32 bit unsigned integer value.

Don’t use quotes around the number, see Quotes.


List of plugins, that should get loaded from Plugin Directory


The following values are allowed: Backup, Archive, Cloned, Migration, Copy, Save


Only Backup is currently implemented.


1 - 65535



Specify a network network port.

Don’t use quotes around the parameter, see Quotes.

See also:


The protocol to run a the job. Following protocols are available:


Native Bareos job protocol.


Deprecated. Alias for NDMP_BAREOS.


Since Bareos Version >= 17.2.3. See NDMP_BAREOS.


Since Bareos Version >= 17.2.3. See NDMP_NATIVE.


The following values are allowed: always, ifnewer, ifolder, never.

See Replace (Dir->Job)


A resource defines a relation to the name of another resource.



See also:


A list of resource.



See Run Script (Dir->Job).



String command.

See Run Script (Dir->Job).


String line for schedule.

See Run (Dir->Schedule)



See also:


A size specified as bytes. Typically, this is a floating point scientific input format followed by an optional modifier. The floating point input is stored as a 32 bit integer value.



A size specified as bytes. Typically, this is a floating point scientific input format followed by an optional modifier. The floating point input is stored as a 64 bit integer value. If a modifier is present, it must immediately follow the value with no intervening spaces. The following modifiers are permitted:


1,024 (kibibytes)


1,0000 (kilobytes)


1,048,576 (mebibytes)


1,000,000 (megabytes)


1,073,741,824 (gibibytes)


1,000,000,000 (gigabytes)


1,099,511,627,776 (tebibytes)


1,000,000,000,000 (terabytes)


1,125,899,906,842,624 (pebibytes)


1,000,000,000,000,000 (petabytes)


1,152,921,504,606,846,976 (exbibytes)


1,000,000,000,000,000,000 (exabytes)

Don’t use quotes around the parameter, see Quotes.



The speed parameter can be specified as k/s, kb/s, m/s or mb/s.

See unit explanation at SIZE64.

Don’t use quotes around the parameter, see Quotes.


A quoted string containing virtually any character including spaces, or a non-quoted string. A string may be of any length. Strings are typically values that correspond to filenames, directories, or system command names. A backslash () turns the next character into itself, so to include a double quote in a string, you precede the double quote with a backslash. Likewise to include a backslash.

Strings can be spread over multiple lines using quotes.



See also:


Multiple STRING, specified in multiple directives, or in a single directive, separated by commas (,).


is similar to a Name, except that the name may be quoted and can thus contain additional characters including spaces.



A time or duration specified in seconds. The time is stored internally as a 64 bit integer value, but it is specified in two parts: a number part and a modifier part. The number can be an integer or a floating point number. If it is entered in floating point notation, it will be rounded to the nearest integer. The modifier is mandatory and follows the number part, either with or without intervening spaces. The following modifiers are permitted:



(60 seconds)


(3600 seconds)


(3600*24 seconds)


(3600*24*7 seconds)


(3600*24*30 seconds)


(3600*24*91 seconds)


(3600*24*365 seconds)

Any abbreviation of these modifiers is also permitted (i.e. seconds may be specified as sec or s). A specification of m will be taken as months.

The specification of a time may have as many number/modifier parts as you wish. For example:

1 week 2 days 3 hours 10 mins


1 month 2 days 30 sec

are valid date specifications.

Don’t use quotes around the parameter, see Quotes.

Variable Expansion

Depending on the directive, Bareos will expand to the following variables:

Variable Expansion on Volume Labels

When labeling a new volume (see Label Format (Dir->Pool)), following Bareos internal variables can be used:

Internal Variable





Month: 1-12


Day: 1-31


Hour: 0-24


Minute: 0-59


Second: 0-59


Day of the week: 0-6, using 0 for Sunday


Name of the Job


Name of the Director


Job Level


Job Type




unique name of a job


Name of the Storage Daemon


Name of the Clients


Numbers of volumes in the pool


Name of the Pool


Name of the Catalog


Type of the media

Additional, normal environment variables can be used, e.g. $HOME oder $HOSTNAME.

With the exception of Job specific variables, you can trigger the variable expansion by using the var command.

Variable Expansion in Autochanger Commands

At the configuration of autochanger commands the following variables can be used:




Archive Device Name


Changer Device Name


Changer Drive Index


Client’s Name


Job Name




Slot Base 0


Slot Base 1


Volume Name

Variable Expansion in Mount Commands

At the configuration of mount commands the following variables can be used:




Archive Device Name




Part Number


Mount Point


Last Part Name

Variable Expansion on RunScripts

Variable Expansion on RunScripts is described at Run Script (Dir->Job).

Variable Expansion in Mail and Operator Commands

At the configuration of mail and operator commands the following variables can be used:




Client’s Name


Director’s Name


Job Exit Code




Unique Job Id


Job Level


Unadorned Job Name


Since Time


Job Type (Backup, …)




Read Volume Name


Write Volume Name


Job Bytes


Job Bytes in human readable format


Job Files

Names, Passwords and Authorization

In order for one daemon to contact another daemon, it must authorize itself with a password. In most cases, the password corresponds to a particular name, so both the name and the password must match to be authorized. Passwords are plain text, any text. They are not generated by any special process; just use random text.

The default configuration files are automatically defined for correct authorization with random passwords. If you add to or modify these files, you will need to take care to keep them consistent.

Relation between resource names and passwords

Relation between resource names and passwords

In the left column, you can see the Director, Storage, and Client resources and their corresponding names and passwords – these are all in bareos-dir.conf. In the right column the corresponding values in the Console, Storage daemon (SD), and File daemon (FD) configuration files are shown.

Please note that the address fw-sd, that appears in the Storage resource of the Director, is passed to the File daemon in symbolic form. The File daemon then resolves it to an IP address. For this reason you must use either an IP address or a resolvable fully qualified name. A name such as localhost, not being a fully qualified name, will resolve in the File daemon to the localhost of the File daemon, which is most likely not what is desired. The password used for the File daemon to authorize with the Storage daemon is a temporary password unique to each Job created by the daemons and is not specified in any .conf file.