Borg Repository on TrueNAS with locked down SSH user

TrueNAS General
,
1

Hi there,

I want to setup my TrueNAS CE to serve as a repo for borgbackup. I set up a user “borg” for that. It uses /var/empty as home and /usr/sbin/nologin as shell for security. However, things like setting command="borg serve --append-only --restrict-to-path <more no-whatever-options>, <public key> to the autorized_keys do not work because TrueNAS wipes all edits in /etc/ssh

In the GUI, I cannot select to allow ssh access without shell. I also cannot add the key - it always tells me Home directory is not writable, leave this blank" (with the “ at the end - seems to be a minor bug). I do not want a writable home directory; that user should only do borg serve or docker exec -i borg-serve borg serve.

Why is this not possible to set up in the GUI?

What is the “correct” way to have a mostly secure borg repo with the user and ssh access locked down?

Thanks in advance!

2

I haven’t tried that yet on TrueNAS, but can’t you add the public keys to the Authorized Keys field on the borguser details?

Credentials > Users > borg> Edit

Screenshot 2026-01-12 at 23.06.48
Screenshot 2026-01-12 at 23.06.48801×559 22.8 KB

3

Thanks for the suggestion. Unfortunately, that is where the Home directory is not writable, leave this blank" error message comes from (red text below that input text field; no matter if I enter “command .. key” or just the key).

“An error occurred: Sorry, you can’t embed media items in a post.” - How to change that, so that I can send the screenshot?

4

Responding to the the bot through the greeting message you received when you signed on will give you image posting capability:

image
image241×155 2.09 KB

1 Like
5

Thanks! Here is is:

grafik
grafik407×872 17.2 KB

So is that something that should be changed, or do I need a docker container with ssh server and borg, or is there a entirely different way?

6

For SSH key authentication to work the user must have a dedicated writeable home directory. ~/.ssh/authorized_keys is where the public key is stored.

Not 100% sure about the shell but possibly any shell not in /etc/shells will lead to a denied login, too. You need to try.

One can lock a user to SFTP only but I don’t know right now if that is possible in TrueNAS. I’ll check later.

7

This is a limitation by TrueNAS; the key could be stored somewhere else (and TrueNas even gives the option to place the line that then gets written into .ssh/configwhen I understand the advanced options correctly.

Which option would be better? A container with “my own” openssh-server or a not-so-locked-down ssh user with command=docker exec?

Borg can use FTP?