Install the R1Soft Server Backup agent on Debian and Ubuntu

The R1Soft Linux agent is a single binary with one moving part that matters: the hcpdriver kernel module that captures block-level deltas without freezing the filesystem. On Debian and Ubuntu the install reads almost the same as the AlmaLinux walkthrough, but the apt repo, the headers package name, and Secure Boot handling all differ enough to bite you on first try.

This guide covers Debian 11 and 12, Ubuntu 20.04, 22.04, and 24.04 LTS, on the stock kernel and on Ubuntu's HWE stack. End-to-end on a 2-vCPU VPS: about 12 minutes.

Prerequisites

• Debian 11/12 or Ubuntu 20.04/22.04/24.04, fully patched
• Root or sudo
• Outbound TCP/443 to repo.r1soft.com and krnlbld.r1soft.com
• Inbound TCP/1167 from your Server Backup Manager
• A working SBM 6.16 or newer with a valid R1Soft license
• Secure Boot disabled, OR a signing workflow ready — see the warning below

Add the R1Soft apt repo

curl -fsSL https://repo.r1soft.com/r1soft.asc \
  | gpg --dearmor -o /usr/share/keyrings/r1soft-archive-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/r1soft-archive-keyring.gpg] \
http://repo.r1soft.com/apt stable main" \
  > /etc/apt/sources.list.d/r1soft.list

apt-get update

The signed-by form is the modern apt convention — apt-key add has been deprecated since Debian 11 and removed in 12. If you copy older R1Soft docs that still use apt-key, the install works but you will see deprecation warnings on every apt update.

Install the agent and build prerequisites

apt-get install -y serverbackup-enterprise-agent \
  linux-headers-$(uname -r) build-essential

On Debian, linux-headers-$(uname -r) exists for the stock kernel. On Ubuntu LTS with the HWE kernel (the default for desktop installs and many cloud images), you instead need linux-headers-generic-hwe-22.04 or the version-matched name. Check:

uname -r
apt-cache search linux-headers-$(uname -r)

If the exact match is missing, do not fall back to a generic headers package — the hcpdriver build will succeed and then refuse to load because the module is keyed to the kernel ABI string.

Build the hcpdriver

serverbackup-setup --get-module

The agent first looks up the running kernel in the R1Soft module index at krnlbld.r1soft.com. Recent Ubuntu LTS and Debian stable kernels are usually indexed within 24-48 hours of release. If the prebuilt is missing, the script falls back to a local compile using your installed build-essential and headers.

Verify the module is loaded:

lsmod | grep hcp

You should see hcpdriver in the output. If not, stop here — the rest of the agent will start without errors but recovery points will be empty.

Set the agent password

serverbackup-setup --user-password

Pick a strong per-host password. Reusing one password across the fleet means a single compromised agent gives an attacker pull access to every disk safe on the SBM. Generate with openssl rand -base64 24 and store in your secrets manager keyed by hostname.

The same password goes into SBM when you add the protected machine.

Open the firewall

The SBM connects to the agent on TCP/1167. With ufw:

ufw allow from 10.20.30.40 to any port 1167 proto tcp
ufw reload

Replace 10.20.30.40 with your SBM's IP. If you run nftables directly (default on Debian 11+), add an accept rule scoped to the SBM source. Do not open 1167 to the world — the agent has no rate limiting on auth attempts.

Start and enable the agent

systemctl enable --now cdp-agent
systemctl status cdp-agent
ss -tlnp | grep 1167

The service name is cdp-agent on every Linux distribution, a holdover from the product's R1Soft CDP origins.

Register the host on SBM

In Server Backup Manager:

1. Protected Machines → Add
2. Hostname or IP of the Debian or Ubuntu host
3. Port 1167
4. The password from serverbackup-setup --user-password
5. Click Test Connection — it should report Online

If the test fails, the four usual causes in order: firewall blocks 1167, agent not running, password mismatch, or hcpdriver failed to load. The agent answers TCP on a failed module — but disk safe creation will error with unable to open device for block reads.

Create the first disk safe

1. Disk Safes → New Disk Safe
2. Pick the registered Protected Machine
3. Select devices — /dev/sda plus any data disks, or LVM logical volumes
4. Storage path on the SBM volume
5. Compression: QuickLZ for hosting workloads, Zlib only if storage is the bottleneck
6. Encryption: AES-256 if the SBM volume is shared or off-site

Run a manual recovery point. The first one reads every block of every selected disk and is the slowest — expect 30-60 MB/s on commodity hardware. Subsequent points are deltas tracked by hcpdriver and complete in minutes.

Survive a kernel upgrade

hcpdriver is built against a specific kernel ABI. Every unattended-upgrade or apt full-upgrade that touches the kernel will leave the agent running against a stale module after the next reboot. Two ways to handle it:

• Per-host systemd oneshot. Drop a unit at /etc/systemd/system/r1soft-module.service that runs serverbackup-setup --get-module after every boot, before cdp-agent.service. Cheap and reliable.
• Pin the kernel. Hold the kernel package with apt-mark hold linux-image-generic and upgrade kernels manually during a maintenance window, rebuilding the module immediately after reboot.

Most fleets pick the systemd oneshot. The trade-off is that an unindexed kernel will fall through to a local compile and hold the boot a few extra seconds — acceptable in exchange for not waking up to a machine with broken backups.

Verify end-to-end

systemctl is-active cdp-agent
lsmod | grep hcp
ss -tlnp | grep 1167

From SBM: open the new disk safe, mount the recovery point read-only, and browse a customer directory. If the filesystem is intact, your install is done.

Next steps

• Fix module load errors: hcpdriver kernel module troubleshoot.
• Send recovery points off-site: Disk Safe replication setup.
• Buy or expand: R1Soft license.