Configure Jump Server Credentials Backup

Jump Server Backup lets your organization keep a daily encrypted copy of privileged credentials and resources on each Jump Server. If the JumpCloud cloud is unavailable, admins can still open that backup on the Jump Server host and work offline.

Backups stay on the Jump Server. They are not a substitute for normal Admin Portal access. They are a break-glass path when you need local access without depending on the SaaS platform.

note

This article is for administrators who manage Jump Server Backup keys in Privileged Access Management (PAM) Settings, and who may need to open a backup on a Jump Server host.

Prerequisites

• Your Admin Portal role must include the PAM Backup permission.
• At least one healthy Jump Server installed in your environment. Backups are written on the Jump Server host.
• A secure company location to store the Backup Key. Treat the key as company property, not personal data.

Considerations

• Daily backups do not start until you generate a Backup Key. If you never generate a key, Jump Servers do not keep these encrypted backup files.
• The Admin Portal shows a new Backup Key only once. After you leave the reveal screen, the key is masked and you cannot reveal it again.
• Rotating the key does not rewrite older backup files. New backups use the new key. Older backups still need the previous key.

Understanding Jump Server Backup

1. In the JumpCloud Admin Portal, generate a Backup Key in Settings > Jump Server Backup.
2. After the key exists, each Jump Server keeps a daily encrypted backup of privileged credentials and resources on that host.
3. For offline access, open a backup file on the Jump Server host with the CLI and enter the Backup Key that matches that file.

Item	Where it lives
Backup Key	Generated in Admin Portal Settings. You must store a copy securely. The portal shows a new key only once.
Encrypted backup files	On each Jump Server host (daily). The Admin Portal does not store the backup files.
Offline recovery	On the Jump Server host, using the CLI and the matching Backup Key.

Important

Daily backups do not start until you generate a Backup Key. If you never generate a key, Jump Servers do not keep these encrypted backup files.

Opening Jump Server Backup

1. Log in to the JumpCloud Admin Portal.
2. Go to Privileged Access Management > Settings.
3. Open the Jump Server Backup tab.

If no key exists yet, you see the empty state Enable Jump Server Backup.

Generating a Backup Key for the First Time

1. Click Generate Backup Key.
2. In the confirmation dialog Enable Jump Server Backup?, confirm that you understand the key is shown only once, then click Generate Backup Key.
3. When the key appears, copy it immediately and store it in your organization’s secure location.

warning

The Backup Key is shown only once. After you leave this screen, the Admin Portal masks the key and you cannot reveal it again. If you do not copy it now, you will not be able to decrypt backups that use this key.

On this screen you see:

Field	Description
Backup Key	The secret you use later to decrypt backup files on the Jump Server. Copy it now.
Key Version	An identifier for this key generation. Use it when you track which key belongs to which backups.

Viewing Active Backups

When you return to Jump Server Backup, the portal shows that backups are active. The Backup Key and Key Version are masked. You cannot copy the previous key from this screen.

note

With an active key, each Jump Server keeps a daily encrypted backup of privileged credentials and resources on that host. Check the Jump Servers list Last Backup column to see when a Jump Server last completed a backup cycle.

Generating a New Backup Key

Use Generate New Key when your organization needs to rotate the key. This does not rewrite older backup files.

1. On Jump Server Backup, click Generate New Key.
2. Read the confirmation dialog carefully, then confirm.
3. Copy the new key when it appears. Store it with your previous keys.

warning

New backups use the new key. Older backups still need the previous key. Save your current key before you generate a new one. Do not discard older keys if you still need older backup files.

Backup Key Best Practices

Practice	Why
Copy the key during the one-time reveal	The Admin Portal will not show that key again.
Store the key in a secure company location or sealed process	The key decrypts privileged credentials and resources offline.
Keep every previous key after a rotation	Older .bkp files still need the key that was active when they were created.
Limit who can use the Backup permission	Only trusted admins should generate or rotate keys.
Test recovery in a maintenance window	Confirm a saved key opens a real backup file on a Jump Server before you need it in an outage.

Accessing a Backup Offline on the Jump Server

Use these steps on the Jump Server Linux host when you need break-glass access. You open the backup in a terminal viewer, search it, and read the credentials you need.

Listing Available Commands

On the Jump Server host, run:

docker exec vo-sync vaultone-sync

This shows the usage guide and the available operations, including the backup commands.

Listing Backup Files

docker exec vo-sync vaultone-sync backup list

A list of the backup files on that Jump Server is displayed. Each file name starts with a number that identifies the day of the backup, so the last file in the list is the most recent one.

Opening a Backup File

1. Run:

docker exec -it vo-sync vaultone-sync backup open <FILENAME.bkp>

2. When prompted:

   • Confirm that you want to open the backup file (Y or N).
   • Provide a reason for accessing the backup. The reason is logged for auditing.
   • Enter the Backup Key that matches that file.

warning

The key is not shown as you type.

3. After the key is accepted, the backup opens in an interactive viewer in your terminal. See Browsing the Backup Data below.

note

Enter the Backup Key that was active when that backup file was created. If you rotated keys later, the newest key opens only newer backups. Older files still need their original key.

tip

If a backup file does not change from one day to the next, no new records were added. The most recent backup file is still the latest snapshot.

Browsing the Backup Data

The viewer shows the backup as a tree. The Resources list holds your Privileged Resources, and the Credentials list holds your Privileged Credentials. Each resource has a CredentialsId entry that points to the credential it uses. Expand an item to see its fields, including the credential values.

warning

Credentials appear in plain text. Once the backup is open, the viewer shows credential values as they are stored. Open the backup only in a secure terminal session, make sure nobody can see your screen, and close the viewer when you finish.

Finding a Resource or Credential by Name or ID

In a large backup, searching is faster than scrolling. The viewer searches the whole backup, so you can use the name of a resource, the name of a credential, or an ID.

1. Press / and type the text you want to find. For example, type /Cloudflare to find everything that contains Cloudflare.
2. Press Enter. The viewer jumps to the first match.
3. Press n to go to the next match, or N to go back to the previous match.
4. Press l or the right arrow key to expand the item and read its fields.

To search from the current position toward the top, use ? instead of /.

Use these keys to move around and to leave the viewer:

Press q to close the viewer and return to the terminal prompt. Press F1 at any time to open the full list of shortcuts.

Quick Reminder

Step	Where	What you do
Enable backups	Settings > Jump Server Backup	Generate Backup Key and copy it once
Confirm active	Jump Server Backup	See Backups active; key is masked
Rotate key	Generate New Key	Keep old keys for old files; copy the new key
Recover offline	Jump Server host CLI	backup list, then backup open with the matching key
Find a credential	Backup viewer	Press / and type the name, then Enter, then n or N