Rubrik Backup Service
You set up the rubrik backup service by installing a background agent on target hosts. This local agent talks to your backup cluster to run snapshots and file restores. Teams often install this agent across hundreds of servers using wide system roles. Broad roles make setup fast, but they give the agent deep host privileges. If an admin account is too open, one mistake can expose sensitive production data. How the rubrik backup service works on hosts The rubrik backup service runs as a local
Backup Security: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up the rubrik backup service by installing a background agent on target hosts. This local agent talks to your backup cluster to run snapshots and file restores. Teams often install this agent across hundreds of servers using wide system roles. Broad roles make setup fast, but they give the agent deep host privileges. If an admin account is too open, one mistake can expose sensitive production data.
How the rubrik backup service works on hosts
The rubrik backup service runs as a local background daemon on Linux and Windows machines. It listens for secure requests coming from the central backup cluster. When a backup starts, the cluster tells the host agent to prepare the system. The agent coordinates with the operating system or database to freeze writes for a moment. Then it reads the changed data blocks and sends them back to the cluster.
To do this work, the agent needs a local system account with high privileges. On Windows, teams often run the service under the local system account or a domain user. On Linux, the daemon usually runs with root permissions to read raw disk volumes. The service also uses security certificates to pair the host with the main cluster. Once paired, the cluster trusts the host agent to run backup and restore tasks.
Managing service accounts and host permissions
Database backups require extra setup beyond basic file system access. If you back up a database, the agent must log in to that database engine. Teams create a dedicated database role and give those keys to the local service. The agent uses these keys to trigger transaction log backups and check database health. It also needs write access on the host to put files back during a restore.
Many teams reuse the same domain account across every server in their fleet. They do this to avoid managing hundreds of unique passwords and roles by hand. When a backup fails, an engineer often logs in to the host to fix the service. They check the daemon status, read local log files, and restart the background process. Giving engineers full host admin rights just to check a backup agent creates risk.
Backup Security: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native setup solves and where gaps remain
Native cluster roles and host accounts control which machines can pair and run backups. They let you assign backup policies and limit who can click restore in the console. This setup handles basic role assignment for your scheduled backup jobs very well. It proves who logged in to the cluster and which host sent the data.
Still, static host roles do not control what engineers do during live maintenance sessions. Once an admin logs in to fix a failed agent, they hold full server rights. Native roles decide who can log in, not what individual commands do in flight. They do not block a bad command or rewrite sensitive fields like emails or card numbers. Teams still need a way to govern live shell commands and database queries on the host.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev sits inline in the wire protocol beside those services as an open-source proxy, a sidecar for your Postgres or API. On every query an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human review.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Why does the rubrik backup service fail to connect to the cluster?
Network firewall rules or expired host certificates usually cause connection drops. Check that the required ports are open between the host and the backup cluster.
What permissions does the agent need on a target server?
The agent needs local admin or root rights to read disk volumes and restore files. For databases, it also needs a dedicated database role with backup privileges.
How do you fix a stuck backup agent on a host?
An admin logs in to the host and restarts the background service daemon. They also check the local agent logs to see if a disk lock blocked the job.