# Constrain Borg serve to exact repository paths when that is the intent

> Test the exact repository boundary granted to a Borg server client.

- Canonical URL: https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:06+00:00
- Modified: 2026-10-15T13:36:16+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Test the exact repository boundary granted to a Borg server client.

## Potentially affected

This applies to Borg 1.4.5 server-process restrictions, including supervised SSH forced-command deployments. It does not establish a complete SSH account policy or certify immutable recovery storage.

## DSE recommendation

DSE recommends writing the exact set of repositories a backup client should reach before selecting a restriction.

## Article

Test the exact repository boundary granted to a Borg server client.

## Source facts

Borg 1.4.5 serve distinguishes restrict-to-path from restrict-to-repository. A permitted path also allows its subdirectories, whereas a permitted repository grants access only to that repository and does not implicitly include descendants. Both can be specified more than once. The append-only option governs low-level repository segment appending; it does not prohibit reading or issuing archive delete and prune operations. Repository selection and low-level append behavior are therefore different controls with different boundaries.

Source: [Borg 1.4.5 — borg serve](https://borgbackup.readthedocs.io/en/stable/usage/serve.html).

## Applicability

This applies to Borg 1.4.5 server-process restrictions, including supervised SSH forced-command deployments. It does not establish a complete SSH account policy or certify immutable recovery storage.

## DSE recommendation

DSE recommends writing the exact set of repositories a backup client should reach before selecting a restriction. Prefer an exact repository boundary when sibling or descendant repositories should remain separate. Review low-level append behavior independently of the archive operations visible to the client, and keep repository maintenance authority separate from ordinary backup access. Record how the server process receives its restrictions so a future account or service change does not silently broaden the permitted storage tree.

## Verification

With disposable repositories, test the intended permitted target, a sibling repository, and a nested repository. Confirm the server enforces the selected boundary. Rehearse append-only behavior separately and record what clients can still read or logically remove, without describing that test as proof against every privileged administrator action.

## Official reference

[Borg 1.4.5 — borg serve](https://borgbackup.readthedocs.io/en/stable/usage/serve.html). Reviewed October 15, 2026.

## Primary reference

- Name: Borg 1.4.5 — borg serve
- Authority: borgbackup.readthedocs.io
- URL: https://borgbackup.readthedocs.io/en/stable/usage/serve.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Constrain Borg serve to exact repository paths when that is the intent,” DSE Security, https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.