When you see the backup of a (non localhost) client failing with the message:
Fatal error: Failed to authenticate Storage daemon
Keep in mind that bacula uses tcpwrappers, though probably not in the way you expect it.
instead of doing:
bacula-sd : 111.222.333.444
do:
$name-sd : 111.222.333.444
where $name is the name you specified in the bacula-sd.conf
Most services that use tcpwrappers (tcpd) use the name of the service (bacula-sd in this case), but bacula has a cute approach to it that listens only to the name you defined for the service. As far as I can tell this applies only to bacula-sd, and not bacula-dir or bacula-fd.
So, say you would have the following config in bacula-sd.conf:
Storage { # definition of myself
Name = foo.bar-sd
SDPort = 9103 # Director's port
WorkingDirectory = "/var/lib/bacula"
Pid Directory = "/var/run/bacula"
Maximum Concurrent Jobs = 20
}
then your /etc/hosts.allow would read:
foo.bar-sd : 111.222.333.444
Please note that you will still need to take care of your passwords on both ends, any mismatches there will results in no backups being made. Be sure to test your backups regularly.