---
title: Charmhub | Deploy juju-backup-all using Charmhub - The Open Operator Collection
description: Deploy the latest version of juju-backup-all on any cloud.
url: https://charmhub.io/juju-backup-all/docs/e-security
---

# juju-backup-all

[Canonical BootStack Charmers](https://charmhub.io/publisher/bootstack-charmers "View all packages from Canonical BootStack Charmers")

* [Canonical BootStack Charmers](https://charmhub.io/publisher/bootstack-charmers "View all packages from Canonical BootStack Charmers")

Platform:

24.04

22.04

20.04

stable 101

```
juju deploy juju-backup-all
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

## [Security overview](https://charmhub.io/juju-backup-all/docs/e-security#p-34158-security-overview)

This charm creates a cron job that periodically performs backup for the Juju controller and various database charms. It uses the [Juju Backup All](https://github.com/canonical/juju-backup-all) library to run actions on other charms in the same models, and copy the backup result from other charms to this charm via Juju SSH. This charm is also an exporter server built with the [prometheus\_client](https://github.com/prometheus/client_python) library, and the collected backup metrics are exposed over the HTTP protocol.

### [Risks](https://charmhub.io/juju-backup-all/docs/e-security#p-34158-risks)

This charm offers config options to connect to Juju controllers. The config options include sensitive data, such as Juju controller information and Juju accounts. All the config options are visible in Juju CLI, and rendered and stored in an on-disk, plain-text configuration file only readable by the user created by the charm called `jujubackupall`. Users are recommended to [create a new Juju user](https://juju.is/docs/juju/manage-users) for backups with appropriate scopes.

This charm supports installing the [Juju Backup All Exporter](https://github.com/canonical/prometheus-juju-backup-all-exporter) snap from the charm resource uploaded by users. However, the uploaded resource will not be verified by the charm, and will be installed in dangerous mode (i.e. via `snap install <resource> --dangerous`). Therefore, a malicious snap resource can be installed to the system, and lead to data leakage or even a system outage. Users uploading the snap resource should be aware of these risks, and ensure the resources are correct and secure. In addition, the exporter service currently **only supports HTTP**, so users should also be aware that the **communication is not encrypted**.

In order to run backup actions on other charms and collect backup files from other charms, Juju Backup All charm manages a pair of public and private keys in `/var/lib/jujubackupall/ssh` for the `jujubackupall` user. The public key is added to the Juju model, granting this user an access to all the machines in the same model. Similar to other files managed by this charm, those keys are only readable by `jujubackupall` user.

---