Hetzner Storage Box Setup Guide

This guide walks you through setting up a Hetzner Storage Box for use with Backrest backup solution.

Prerequisites

Hetzner Cloud account
SSH key pair generated on your system

Step 1: Create Storage Box

Log in to Hetzner Console
Navigate to Storage Boxes in the sidebar
Click Create Storage Box

Step 2: Select Configuration

Location

Choose Helsinki (eu-central)
- Provides geographic separation from Falkenstein VPS
- Good for disaster recovery

Storage Size

Select BX11 (1TB) - €3.87/month
- Sufficient for configurations and essential data
- Excludes media files
- Can upgrade later without data loss

Step 3: Configure Access

SSH Keys

During creation, add your SSH public keys:

Add keys from all machines that will access the Storage Box
Keys must be in OpenSSH format for port 23

Access Protocols

Enable the following:

✅ SSH Support (required for SFTP backups)
✅ External Reachability (required for connections from outside Hetzner network)
❌ SMB Support (optional, not needed for backups)
❌ WebDAV Support (optional, not needed for backups)

Step 4: Note Credentials

After creation, save these details:

Username: uXXXXXX (where XXXXXX is your box number)
Hostname: uXXXXXX.your-storagebox.de
SSH Port: 23 (not the standard 22!)
Password: Set via Hetzner Console if needed

Step 5: Add SSH Keys to Storage Box

SSH keys must be added to the Storage Box’s authorized_keys file:

# Connect to Storage Box with password
sftp -P 23 uXXXXXX@uXXXXXX.your-storagebox.de

# Create .ssh directory (if it doesn't exist)
mkdir .ssh
chmod 700 .ssh

# Upload your public key
put /path/to/your/id_ed25519.pub .ssh/authorized_keys

# Set correct permissions
chmod 600 .ssh/authorized_keys

# Exit
bye

Or via SSH (if port 23 interactive access works):

ssh uXXXXXX@uXXXXXX.your-storagebox.de -p 23

mkdir -p .ssh
chmod 700 .ssh
echo "your-public-key-content" >> .ssh/authorized_keys
chmod 600 .ssh/authorized_keys
exit

Step 6: Test Connection

Verify SSH key authentication works:

# Test connection (should not ask for password)
ssh -p 23 uXXXXXX@uXXXXXX.your-storagebox.de ls

# Or via SFTP
sftp -P 23 uXXXXXX@uXXXXXX.your-storagebox.de

If successful, you should connect without entering a password.

Step 7: Verify Settings

In Hetzner Console, confirm:

✅ SSH Support enabled
✅ External Reachability enabled
✅ Your SSH keys are listed

Storage Box URI Format

For Backrest repository configuration, use:

sftp://uXXXXXX@uXXXXXX.your-storagebox.de:23/backup-path

Important:

Use sftp:// with double slashes
Include port :23 in the URI
The path /backup-path will be created automatically by Restic

Security Notes

All data is encrypted in transit (SSH/SFTP)
Storage Box provides RAID redundancy
Geographic separation from your servers
SSH key authentication is more secure than passwords
Keep your SSH private keys secure
Store your Restic encryption password separately and securely

Troubleshooting

“Permission denied” errors

Verify SSH key is in authorized_keys on Storage Box
Check key file permissions (600 for private key)
Ensure you’re using the correct username

“Connection refused” or “Connection reset”

Verify External Reachability is enabled
Check SSH port is 23, not 22
Verify hostname is correct

“Host key verification failed”

Add Storage Box to known_hosts:

ssh-keyscan -p 23 uXXXXXX.your-storagebox.de >> ~/.ssh/known_hosts

Next Steps

After setting up the Storage Box, proceed to the Backrest setup guide to configure automated backups.

Cost

BX11: €3.87/month (1TB storage)
Unlimited traffic included
No additional costs for snapshots (up to 10 for BX11)

TnT Wiki