Keycyte PAM 3.2 · Deployment Guide
Backup and Restore
Keycyte PAM creates application-level backups of its database: servers, vault entries, users, roles, policies, settings and, optionally, logs. You configure backups on Settings > Backup. Only MASTER administrators can open this page.
What a Backup Contains
A backup is one encrypted file with the extension .keycyte (for example backup_20261101_020000.keycyte). Keycyte PAM serializes the database content, compresses it and encrypts it with the encryption key of the deployment (KEYCYTE_KEYSTORE_KEY_HEX).
| Included | Not included |
|---|---|
| Servers, Password Vault and Private Vault entries, password history | Session recordings (~/record) |
| Users, roles, permission profiles, policies, access control rules, tags | Transferred files (~/drive) |
| Settings (authentication, notification, connection, syslog, RADIUS and TACACS+ server, licence) | Certificate files and .env in the installation package |
| Logs, if Logs is selected in the backup configuration | Container images |
Warning
A backup can only be restored on a deployment that uses the same encryption key. Keep a secure copy of the .env file, or at least of KEYSTORE_KEY_HEX, separately from the backups. Without the key, backups cannot be decrypted.
Back up ~/record, ~/drive and the installation package folder with your own file backup tools.
Where Backup Files Are Stored
Every backup is first written to the backups folder of the application directory: ~/keycyte/backups on the host (/app/backups in the PAM server container). If the backup configuration uses SFTP, the file is then copied to the SFTP server.
Tip
Plan disk space for backup files: archive or remove old files in ~/keycyte/backups regularly.
Configuring a Backup
To configure a backup:
-
In the Admin Panel, open Settings > Backup.
-
Click Add.
-
In the Backup Configuration dialog, fill in the fields:
Field Description Method SFTPorSMB.Address Host name or IP address of the backup server. Port SSH port of the SFTP server. Shown for SFTP only. Path Folder on the backup server where the file is stored. Username User name on the backup server. Password Password of the user. For SFTP, you can use a private key instead. Private Key Private key for SFTP authentication. Shown for SFTP only. Passphrase Passphrase of the private key, if it has one. Shown for SFTP only. Period Interval of scheduled backups, in minutes. 0or empty disables scheduled backups for this configuration.Description Free text that helps you identify the configuration. Logs Include the log tables in the backup. Backups with logs can be much larger. Status Enables the configuration. Scheduled backups run only for enabled configurations. -
Click Save.
The configuration appears in the list with its Method, Address, Path and Status.
Scheduled Backups
The backup scheduler checks the enabled configurations every minute and starts a backup when the Period of a configuration has passed since its last run. The first scheduled backup of a configuration runs shortly after the PAM server starts.
Scheduled backups run only on the master node. See High Availability.
Running a Backup Now
To run a backup immediately, click the run icon in the Action column of a configuration.
The backup is created with the settings of that configuration. A Success message appears when it finishes.
Downloading a Backup
To download a backup file, click the download icon in the Action column.
You can also copy backup files directly from ~/keycyte/backups on the host.
Restoring a Backup
Restoring replaces the database content of Keycyte PAM with the content of the backup file.
Warning
A restore deletes all current data in the tables that the backup contains, and then inserts the data from the backup. Changes made after the backup was created are lost. Create a new backup before you restore.
Before You Begin
- You are signed in with the MASTER role.
- The backup file was created by a deployment that uses the same encryption key.
- Users are informed; active sessions can be affected.
To restore a backup:
-
Open Settings > Backup.
-
Click Restore.
-
Select the
.keycytebackup file.The restore starts immediately after you select the file. A Success message appears when it finishes.
-
Sign out and sign in again, and check the restored data.
If a backup taken before permission profiles existed is restored, Keycyte PAM assigns the built-in full permission profile to every ADMIN account after the restore.