Config backups
Every commit on VyOS is kept locally as a revision (commit-revisions), and show system commit lists them with who made each change. That survives mistakes, but not losing the router. The commit archive copies every committed configuration to another server.
This build's syntax
Older guides configure a location as a URL, such as scp://user:pass@host:/path. In this build that fails: requires a transport protocol. Locations are now named, with structured settings underneath: location OPS scp server …, scp path …, and scp authentication username/password. (VyOS's own test suite, in /usr/libexec/vyos/tests/smoke/cli/, is a reliable reference for the syntax your build expects.)
Host keys
The first commit after setting it up didn't upload: Cannot connect to unknown host '198.51.100.10'. That's correct behaviour. The archive hook verifies the server's SSH host key, and a commit hook can't stop to ask whether to trust a new one. Record the key once (ssh-keyscan), and every commit after that is archived: a timestamped file appears on the ops server, and diff between two archives shows exactly what changed.
In production, give the backup account a key instead of a password, and keep the archive in Git (VyOS supports a git transport), so you get history and diffs for free.
set system config-management commit-revisions '100'
set system config-management commit-archive location OPS scp server '198.51.100.10'
set system config-management commit-archive location OPS scp path '/home/cfgbackup/r1'
set system config-management commit-archive location OPS scp authentication username 'cfgbackup'
set system config-management commit-archive location OPS scp authentication password 'backup-lab-only'
set system config-management commit-confirm action 'reload'- Line 1: Keep 100 revisions on the router.
- Lines 2–5: A named location, with this build's structured syntax.
- Line 6: Revert by reloading the previous config (needs revisions).
vyos@R1# set system config-management commit-archive location 'scp://cfgbackup:backup-lab-only@198.51.100.10:/home/cfgbackup/r1'
[... the other set lines of the stage trimmed ...]
vyos@R1# commit
[ system config-management ]
commit-archive location "scp://cfgbackup:backup-lab-
only@198.51.100.10:/home/cfgbackup/r1" requires a transport protocol
[[system config-management]] failed
Commit failed- Line 1: The URL becomes the location's name…
- Lines 5–6: …with no transport underneath it.
Unable to upload "scp://198.51.100.10/home/cfgbackup/r1/config.boot-R1.20261017_150529": Cannot connect to unknown host '198.51.100.10'.
run-parts: /etc/commit/post-hooks.d/02vyos-commit-archive exited with return code 1- Line 1: The hook won't trust a host key it hasn't seen.
- Line 3: The commit itself succeeded; only the upload failed.
vyos@R1:~$ ssh-keyscan -t ed25519 198.51.100.10 2>/dev/null | sudo tee -a /root/.ssh/known_hosts
198.51.100.10 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOSbfcCTrZec9/5sfbIbt7am4YfrSEeX98MC9fSory2S
vyos@R1:~$ mkdir -p ~/.ssh && ssh-keyscan -t ed25519 198.51.100.10 2>/dev/null >> ~/.ssh/known_hosts; ls -l ~/.ssh/known_hosts
-rw-r--r-- 1 vyos users 95 Oct 17 15:16 /home/vyos/.ssh/known_hosts
root@ops:~# ls -l /home/cfgbackup/r1
total 4
-rw-r--r-- 1 cfgbackup cfgbackup 3169 Oct 17 15:16 config.boot-R1.20261017_151630
root@ops:~# ls -l /home/cfgbackup/r1
total 8
-rw-r--r-- 1 cfgbackup cfgbackup 3169 Oct 17 15:16 config.boot-R1.20261017_151630
-rw-r--r-- 1 cfgbackup cfgbackup 3169 Oct 17 15:16 config.boot-R1.20261017_151656
root@ops:~# diff config.boot-R1.20261017_151630 config.boot-R1.20261017_151656
37c37
< location "Lab rack 1"
---
> location "Lab rack 2"- Lines 1–4: Record the server's key for the archive hook.
- Line 7: The next commit arrives…
- Lines 10–11: …and the one after.
- Lines 13–16: Exactly what changed between them.
vyos@R1:~$ show system commit
0 2026-10-17 15:16:54 by vyos via cli
1 2026-10-17 15:16:29 by vyos via cli
2 2026-10-17 15:05:28 by vyos via cli
3 2026-10-17 14:57:46 by vyos via cli
4 2026-10-17 14:41:09 by vyos via cli
5 2026-10-17 14:40:43 by vyos via cli
6 2026-10-17 14:39:59 by root via init- Lines 2–8: Newest first, with who and how.
Check your understanding
The first commit-archive upload fails with 'Cannot connect to unknown host'. What do you do?
- Record the backup server's SSH host key on the router (for example with ssh-keyscan), after checking it
- Disable host key checking
- Use the router's IP address instead
- Switch to FTP