Add custom private key (like ssh -i) for remote backup

[BlackZork]

My backup server uses a custom private ssh key that gives root access to remote machines. This key is stored on encrypted storage alongside with backup files.

It would be great if I could provide this key as --ssh-private-key argument to virtnbdbackup

[abbbi]

theres two things here:

1. the libvirt API connection (aka virsh qemu+ssh://host/system) which i dont know how to actually inject an ssh key into (and i think its not even possible, other than using ssh_config)
2. the regular paramiko ssh connection for executing command to the remote host, where i probably could inject key.

Maybe you can handle this via ssh_config and specific host settings/aliases?

[BlackZork]

Hi, I do not have a problem with qemu+ssh://host/system - it uses libvirtapi and access is configured in the same way as virt-manager or virsh - using polkit on server side.

The problem is that the part that tries to read files from filesystem directly - my "virtual machine manager" user does not have access to files. I have in logs:

[2026-04-01 11:40:04] DEBUG paramiko.transport channel - _log [main]:  [chan 1] EOF sent (1)
[2026-04-01 11:40:04] ERROR ssh client - run [main]:  Executing remote command failed, return code: [1] stderr: [qemu-img: Could not open '/var/lib/libvirt/images/gitlab.qcow2': Could not open '/var/lib/libvirt/images/gitlab.qcow2': Permission denied], stdout: []
[2026-04-01 11:40:04] WARNING root metadata - backupDiskInfo [main]:  Failed to read qcow image info: [Error during remote command: [qemu-img info '/var/lib/libvirt/images/gitlab.qcow2' --output json --force-share]: [qemu-img: Could not open '/var/lib/libvirt/images/gitlab.qcow2': Could not open '/var/lib/libvirt/images/gitlab.qcow2': Permission denied] []]
[2026-04-01 11:40:04] DEBUG ssh client - run [main]:  Executing remote command: [qemu-img info '/var/lib/libvirt/images/gitlab-data.qcow2' --output json --force-share]
[2026-04-01 11:40:04] DEBUG paramiko.transport channel - _log [main]:  [chan 2] Max packet in: 32768 bytes
[2026-04-01 11:40:04] DEBUG paramiko.transport channel - _log [Thread-1]:  [chan 2] Max packet out: 32768 bytes
[2026-04-01 11:40:04] DEBUG paramiko.transport transport - _log [Thread-1]:  Secsh channel 2 opened.
[2026-04-01 11:40:04] DEBUG paramiko.transport channel - _log [Thread-1]:  [chan 2] Sesch channel 2 request ok
[2026-04-01 11:40:04] DEBUG paramiko.transport channel - _log [Thread-1]:  [chan 2] EOF received (2)
[2026-04-01 11:40:04] DEBUG paramiko.transport channel - _log [main]:  [chan 2] EOF sent (2)
[2026-04-01 11:40:04] ERROR ssh client - run [main]:  Executing remote command failed, return code: [1] stderr: [qemu-img: Could not open '/var/lib/libvirt/images/gitlab-data.qcow2': Could not open '/var/lib/libvirt/images/gitlab-data.qcow2': Permission denied], stdout: []
[2026-04-01 11:40:04] WARNING root metadata - backupDiskInfo [main]:  Failed to read qcow image info: [Error during remote command: [qemu-img info '/var/lib/libvirt/images/gitlab-data.qcow2' --output json --force-share]: [qemu-img: Could not open '/var/lib/libvirt/images/gitlab-data.qcow2': Could not open '/var/lib/libvirt/images/gitlab-data.qcow2': Permission denied] []]
[2026-04-01 11:40:04] INFO root metadata - backupAutoStart [main]:  Autostart setting configured for virtual machine.
[2026-04-01 11:40:04] ERROR root virtnbdbackup - main [main]:  Error during backup

So in my case a feature when I can supply a key for --ssh-user is enough.

Now i workarouond it by starting separate bash session using ssh-agent && ssh add, but it is cumbersome to add it to backup scripts run from systemd-timers.

[abbbi]

yes, i think it could be archived with paramikos key_filename option,..

[BlackZork]

For now I just run my backup bash script with ssh agent:

ssh-agent backup.sh

And add custom key insde backup.sh:

ssh-add /path/to/key

[abbbi]

just for completeness, virsh equivalent for passing keyfile would be using a connection URI like this:

qemu+ssh://root@testhv01/system?keyfile=/root/.ssh/id_ed25519_dev