SSH_FILTER_BTRBK(1)

💅 SSH_FILTER_BTRBK(1) — the Btrbk Manual, but make it make sense

okay bestie, so this is ssh_filter_btrbk, and it's from the Btrbk manual (section 1, in case you were wondering 🎀). it's a lil ssh command filter script and honestly? it's giving bodyguard energy. let's get into it.

---

✨ NAME ✨

ssh_filter_btrbk — an ssh command filter script for btrbk. that's it, that's the name. iconic. periodt.

---

🌸 SYNOPSIS 🌸

ssh_filter_btrbk.sh [-s|--source] [-t|--target] [-d|--delete]
    [-i|--info] [--snapshot] [--send] [--receive]
    [-p|--restrict-path <path>] [-l|--log] [--sudo]

look at her. all those flags. so much range 💖

---

🦋 DESCRIPTION 🦋

so ssh_filter_btrbk.sh does exactly what it says on the tin: it restricts SSH commands to only the commands that btrbk actually uses. nothing more, nothing less. no cap.

here's the vibe: it peeks at the SSH_ORIGINAL_COMMAND environment variable (which sshd sets for you, tysm sshd 🫶) and it will only run that command if it contains commands used by btrbk. otherwise? nope. rejected. blocked. not today.

which commands get the green light is decided by the --source, --target, --delete and --info options. you're the one choosing.

and these ones are always allowed, no matter what:

• btrfs subvolume show — and heads up, this one is NOT affected by --restrict-path
• btrfs subvolume list — also NOT affected by --restrict-path
• readlink
• test -d — but only if the compat busybox configuration option is set
• cat /proc/self/mountinfo
• pipes through gzip, pigz, bzip2, pbzip2, bzip3, xz, lzop, lz4, zstd (that's the stream_compress situation)
• pipes through mbuffer (that's stream_buffer and rate_limit)

and here's an example line for /root/.ssh/authorized_keys on a backup target host, so you can copy it exactly:

command="ssh_filter_btrbk.sh --target --delete --restrict-path /mnt/btr_backup",restrict ssh-rsa AAAAB3NzaC1...hwumXFRQBL btrbk@example.org

chef's kiss. she's beautiful 😭

---

👑 OPTIONS 👑

• -s, --source — allows the commands for a backup source: btrfs subvolume snapshot and btrfs send. it's literally just shorthand for --snapshot --send. slay.
• -t, --target — allows the commands for a backup and archive target: btrfs receive and mkdir.
• -d, --delete — allows the commands for subvolume deletion: btrfs subvolume delete. so like, this gets used for the backup source if snapshot_preserve_daily is not set to “all”, and for backup targets if target_preserve_daily is not set to “all”. got it? got it 💜
• -i, --info — allows the informative commands: btrfs subvolume find-new and btrfs filesystem usage. this is what btrbk info and the diff commands use.
• --snapshot — allows the btrfs snapshot command: btrfs subvolume snapshot.
• --send — allows the btrfs send command: btrfs send.
• --receive — allows the btrfs receive command: btrfs receive.
• -p, --restrict-path <path> — restricts commands to <path>. but real talk: btrfs subvolume show and btrfs subvolume list are NOT affected by this option, so don't be surprised.
  • also, it's literally not possible to restrict commands to exact subvolume names, because btrfs-receive(8) takes a <path> as its argument — and that's a directory, not including the subvolume file name that's about to be created, since that name is encoded inside the send-stream. iykyk.
• -l, --log — logs the ACCEPT and REJECT messages to the system log. receipts! 📝
• --sudo — allows btrfs commands to be called via sudo. turn this on if you've got backend btrfs-progs-sudo in your btrbk configuration file.

---

🌈 AVAILABILITY 🌈

want more? go check out the btrbk project page at https://digint.ch/btrbk/ for all the further details bestie 🫶

---

🔥 SEE ALSO 🔥

btrbk(1), btrbk.conf(5), btrfs(8) — the whole friend group, go say hi 💖

---

🎀 AUTHOR 🎀

Axel Burri axel@tty0.ch — ty for your service king 👑

---

ok that's the whole page, no skips, no cuts. every flag, every command, every caveat, all of it 💀

and that's a wrap on the btrbk manual for ssh_filter_btrbk(1) — this one came straight from Btrbk 0.32.7, dated 2026-07-19. love that for us. stay safe out there and always restrict your ssh commands, mwah 💋✨