A Step-by-Step Production Guide for VMware Cloud Foundation Storage Destination
When configuring automated backups for VMware Cloud Foundation (VCF)—including SDDC Manager, NSX-T, and vCenter—you need a reliable, external SFTP destination. While you could spin up a heavy, general-purpose Linux distribution, VMware’s own Photon OS is the perfect lightweight champion for the job. It has a tiny footprint, boots instantly, and comes with OpenSSH pre-installed.
In this guide, we will walk through setting up a highly secure SFTP service on Photon OS using a locked-down ‘chroot jail’ environment, ensuring your VCF backups have a safe, isolated home.
Why Photon OS for VCF Backups?
- Minimalistic: Less bloat means a smaller attack surface and fewer security patches over time.
- Speed & Performance: It is engineered and optimized specifically for running seamlessly on VMware vSphere infrastructure.
- Built-in Security: We can leverage native OpenSSH features to strictly restrict the backup service account from accessing the rest of the file system.
Step 1: Create a Dedicated SFTP Group and User
For security best practices, we want to create a service account that can only handle file transfers and cannot log into a standard command-line terminal environment.
Log into your Photon OS instance via SSH as root and execute the following commands:
| # Create a dedicated group for SFTP users groupadd sftp_group # Create the backup user with NO terminal shell access # Set a secure password for the backup user |
Step 2: Build the Directory Structure (The ‘Chroot Jail’)
OpenSSH is extremely strict regarding directory permissions when enforcing a chroot jail. The root directory of the jail must be entirely owned by root and cannot be writable by any other user or group.
We will create the jail folder, and then create a sub-folder inside it where VCF will actually deposit the backup files.
| # Create the directory paths mkdir -p /sftp/vcfbackup/backups # Enforce strict root ownership on the jail directory # Grant the vcfbackup user ownership of the actual target folder |
| 💡 The VCF Pathing Trick: Because of this chroot setup, when the vcfbackup user logs in, OpenSSH hides the true system path. The user’s world starts at /sftp/vcfbackup, meaning to VCF, this directory looks like standard root ‘/’. Keep this in mind during configuration! |
Step 3: Configure OpenSSH for SFTP-Only Access
Now, we need to instruct the SSH daemon to intercept anyone belonging to sftp_group and force them into their designated sandbox.
Open the SSH configuration file using vim /etc/ssh/sshd_config, scroll to the very bottom, and paste the following block:
| Match Group sftp_group ChrootDirectory /sftp/%u ForceCommand internal-sftp PasswordAuthentication yes X11Forwarding no AllowTcpForwarding no |
To apply the new rules, safely restart the SSH daemon:
| systemctl restart sshd |
Step 4: Fix the Photon OS Firewall (Don’t Skip This!)
Here is a classic gotcha: By default, Photon OS drops incoming ICMP traffic (pings). However, the VCF SDDC Manager deployment and backup wizards run strict validation pre-checks before saving backup schedules. If SDDC Manager cannot ping your SFTP server, the setup wizard will fail.
Run these commands to allow ping traffic and ensure the rules survive a system reboot:
| # Allow incoming and outgoing ping traffic iptables -A INPUT -p icmp -j ACCEPT iptables -A OUTPUT -p icmp -j ACCEPT # Save the rules so they persist after a reboot |
Step 5: Map the Destination in SDDC Manager
With your Photon OS server fully prepped, log into your SDDC Manager UI and navigate to Administration > Backups. Fill out the backup destination form using these exact mapping details:
| Configuration Field | Target Value |
| SFTP Host FQDN / IP Address | The IP address or FQDN of your Photon OS VM |
| Port | 22 |
| Username | vcfbackup |
| Password | The secure password you created in Step 1 |
| Backup Directory | /backups (Do not use the full system path due to chroot context!) |
Click Save or Test Connection. VCF will run its automated validations, drop a quick verification file into the directory, and your automated system-level backups will be safely active and secure.
