Acronis Agent Install: Plesk (Linux)

This guide details the process of installing the Acronis Backup extension and agent on a Linux Plesk server.

To complete the guide, you’ll need to access your server through SSH or remote console.

If you’d like to learn how to access your server via the remote console, read the following guide:
How to access IPMI / Remote Console

This guide is to be used if Secure Boot is ENABLED on your Linux server.
This can be checked with the following command:
( (command -v dnf && dnf install -y mokutil) || (command -v yum && yum install -y mokutil) || (command -v apt-get && apt-get update -y && apt-get install -y mokutil) ) >/dev/null 2>&1 ; echo -e "\n-----------\n" ; mokutil --sb-state
If the command outputs “SecureBoot disabled” or “EFI variables are not supported on this system”, use this guide instead:
Acronis Agent Install: Plesk (Linux)
If the command outputs “SecureBoot enabled”, you may continue with this guide.

Installing Acronis with Secure Boot requires a system reboot.
This is used to enroll Machine Owner Keys for the Acronis “snapapi” kernel module.

Adding a Protection Plan

Before we can start, your Acronis Cyber Protect tenant requires at least ONE valid Protection Plan.

Additionally, we strongly recommend cloning and using a separate Protection Plan for each protected workload, as any changes made to a multi-use plan will affect all workloads protected by that plan.

You can find a list of Protection Plan templates at the linked page. Make sure to select a “Standard Backups - Plesk” plan.
Protection Plan templates
A guide showing how to import the downloaded Protection Plan file is linked below:
How to import a Protection Plan

A guide showing how to clone the imported Protection Plan can be found further down in the same guide:
Cloning a Protection Plan
If you already have a suitable Protection Plan, you may continue to the next section:
Allowing Acronis IPs into the firewall

Allowing Acronis traffic through the firewall

To set up and run Acronis backups, you need to whitelist the following outgoing TCP ports:

443
7770-7800
8443
44445

To accomplish this easily, we have created an Acronis Firewall Allow script for your convenience. This script works on Debian, Ubuntu, or any RHEL-based Linux distribution and accounts for multiple software firewall implementations: CSF, Imunify360, firewalld, UFW, and plain iptables/nftables.

You can make use of this script by running the below one-liner as root any user in the sudoers group.

( (command -v dnf && sudo dnf install -y wget) || (command -v yum && sudo yum install -y wget) || (command -v apt-get && sudo apt-get update && sudo apt-get install -y wget) ) >/dev/null 2>&1 ; sudo wget -q https://salt-fileserver.servercontrol.com.au/files/acronis/acronis_firewall_allow.sh -O /root/acronis_firewall_allow.sh && sudo chmod +x /root/acronis_firewall_allow.sh && sudo bash /root/acronis_firewall_allow.sh

If you ever need to revert any changes made by the script, simply execute the acronis_firewall_allow.sh file with the --revert flag.

If your SAU server is protected by a FortiGate Firewall, please refer to the below drop-down to see how to easily allow these IP addresses:
How to whitelist Acronis IPs on a FortiGate Firewall
Log into your FortiGate web UI.
Copy and paste the below code block into the FortiGate CLI.
These commands will create Acronis service object for use with a firewall
config firewall service custom
    edit "Acronis Backup Ports"
        set tcp-portrange 443 7770-7800 8443 44445
        set comment "Required Acronis outbound TCP ports"
    next
end
In your Firewall Policy table, create a LAN > WAN ACCEPT policy named “Acronis Backup Ports - Outgoing” that matches the below image. The “Acronis Backup Ports” service object will already exist if you ran the commands in the second step.

A written description of the policy configuration is below:
Name: Acronis Backup Ports - Outgoing
Incoming interface: vdXXXXX_lan (VLANXXXX)
Outgoing interface: vdXXXXX_wan
Source: all
Security posture tag: <Unchanged>
Destination: all
Schedule: always
Service: Acronis Backup Ports
Action: Accept
Inspection mode: Flow-based

Installing the Plesk extension

Install the official Acronis Plesk extension. This can be achieved by following the steps shown below.

Navigate to the server’s Plesk web interface.
Click on “Extensions” in the left sidebar.
Search for “Acronis”, and click on the result named “Acronis Backup”.
Set the package to “Free”, and click the “Get It Free” button.

If your server previously used our R1Soft backup solution, this is the point where the R1Soft agent needs to be removed from the server.
Doing this at a later time may cause the server to crash!

Run the following one-line command on your Linux server to remove R1Soft. This will work with CentOS, AlmaLinux, Ubuntu and Debian.
bash -c 'set -euo pipefail; r1softpacks="r1soft-getmodule serverbackup-agent serverbackup-async-agent* serverbackup-setup serverbackup-enterprise-agent"; svc(){ for s in cdp-agent sbm-agent; do (systemctl stop "$s" 2>/dev/null || service "$s" stop 2>/dev/null || true); done; }; pkg(){ if command -v dnf >/dev/null; then dnf remove -y --skip-broken $r1softpacks; elif command -v yum >/dev/null; then yum remove -y --skip-broken $r1softpacks; elif command -v apt-get >/dev/null; then apt-get update -y || true; apt-get purge -y $r1softpacks || true; apt-get autoremove -y || true; else echo "No supported package manager detected!"; exit 2; fi; }; svc; pkg; rm -f /etc/yum.repos.d/r1soft.repo >/dev/null 2>&1; [ -f /etc/apt/sources.list ] && sed -i "\|repo.r1soft.com/apt|d" /etc/apt/sources.list >/dev/null 2>&1 || true'
If you don’t have R1Soft installed, continue on.

Installing and registering the Acronis agent

From the server’s Plesk web interface, click on “Acronis Backup”.
Click on “I have an Acronis account”.
You will land on this page:
- Replace the Service URL with the following:
  https://backup.aci.servercontrol.com.au
- Enter the username and password for your Acronis “service account” user.
  A guide showing how to reset the password for this user can be found here:
  How to update the service account email/password
The filled-out page should look something like this. Note the different Service URL.
Click “Sign In” to continue.
Leave “Encryption” off.
Click Enable.
The extension will now run through the automated process of installing the Acronis agent.
If the process fails, it will usually provide details of a connectivity error you will need to resolve.
This should not happen if you ran the firewall allow script at the beginning of this guide.
Sometimes it will error out, citing a failure to find the correct kernel-devel headers.
If this occurs:
1. Schedule downtime with the customer.
2. Update the kernel using the system’s package manager.
3. At the scheduled time, reboot the server.
4. Install kernel headers:
```
yum install -y kernel-devel-$(uname -r) kernel-headers-$(uname -r) ; dnf install -y kernel-devel-$(uname -r) kernel-headers-$(uname -r) ; apt update && apt install -y linux-headers-$(uname -r)
```
After this, you should be able to continue as normal.
Once the process has completed, click “Done”.
The extension should now display this page:
Log in to the Acronis Cyber Protect Cloud portal, found here:
https://backup.aci.servercontrol.com.au/login
The default tenant username can be found in the MySAU portal, as shown in this guide:
How to access the Acronis Cyber Protect Cloud portal

Click “Devices”.

You should see your server listed here:
The Linux server must now undergo a reboot, BUT WAIT! Please read the info box below before rebooting.

Before you perform a restart, you’ll need to access the server via remote console.
A guide detailing this process can be found here:
How to access IPMI / Remote Console
Upon reboot, a blue screen will appear for a limited time. You must quickly press any letter key to enter Key Management.
Failure to complete this in time will require a full reinstall and re-registration of the Acronis agent.
Once you have the remote console open and ready, gracefully reboot the server. This can be done using one of the following commands:
- shutdown -r now
- reboot
During boot, you should encounter this blue screen, as previously mentioned.
Make sure to press any letter key as quickly as possible.
Use the arrow keys to navigate the menu.
Select “Enroll MOK”, and press Enter.
Select “Continue”, and press Enter.
Select “Yes”, and press Enter.
Enter the server’s root password, and press Enter.
Note: You get three attempts to complete this, so make sure it’s correct.
Select “Reboot”, and press Enter.
Once the server is back online, test the kernel module is running with this command:
```
lsmod | grep snapapi
```
If the command outputs anything, it means the kernel module is loaded.
Proceed to the next section to apply your Protection Plan.
While the Plesk extension does create a Protection Plan automatically, our Plans have been manually tuned to minimise backup issues and match your desired backup retention period.

Applying the protection plan

Click on the server name, and select “Protect”.
Click on the ellipses, and click Delete.
Check the box and click Delete to remove the default plan.
Select the required Protection Plan. Make sure it’s a “Plesk” plan, or interaction with the Plesk extension will break.
The “Protect” section will now display the selected Protection Plan.

Acronis agent setup is complete!
If you’d like to manually run an initial backup to test this, refer to this guide:
How to manually start a backup

Documentation Index

Acronis Agent Install: Plesk (Linux) - Secure Boot

Adding a Protection Plan

Allowing Acronis traffic through the firewall

Installing the Plesk extension

Installing and registering the Acronis agent

Applying the protection plan