diff --git a/cassandra/backup.sls b/cassandra/backup.sls
index 93a5ce1..fd1cacd 100644
--- a/cassandra/backup.sls
+++ b/cassandra/backup.sls
@@ -145,46 +145,23 @@
     - user: cassandra_user
     - pkg: cassandra_backup_server_packages
 
-{%- for key_name, key in backup.server.key.iteritems() %}
-
-{%- if key.get('enabled', False) %}
-
-{%- set clients = [] %}
-{%- if backup.restrict_clients %}
-  {%- for node_name, node_grains in salt['mine.get']('*', 'grains.items').iteritems() %}
-    {%- if node_grains.get('cassandra', {}).get('backup', {}).get('client') %}
-    {%- set client = node_grains.get('cassandra').get('backup').get('client') %}
-      {%- if client.get('addresses') and client.get('addresses', []) is iterable %}
-        {%- for address in client.addresses %}
-          {%- do clients.append(address|string) %}
-        {%- endfor %}
-      {%- endif %}
-    {%- endif %}
-  {%- endfor %}
-{%- endif %}
-
-cassandra_key_{{ key.key }}:
-  ssh_auth.present:
+{{ backup.backup_dir }}/.ssh:
+  file.directory:
+  - mode: 700
   - user: cassandra
-  - name: {{ key.key }}
-  - options:
-    - no-pty
-{%- if clients %}
-    - from="{{ clients|join(',') }}"
-{%- endif %}
+  - group: cassandra
+  - require:
+    - user: cassandra_user
+
+{{ backup.backup_dir }}/.ssh/authorized_keys:
+  file.managed:
+  - user: cassandra
+  - group: cassandra
+  - template: jinja
+  - source: salt://cassandra/files/backup/authorized_keys
   - require:
     - file: {{ backup.backup_dir }}/full
-
-{%- else %}
-
-cassandra_key_{{ key.key }}:
-  ssh_auth.absent:
-  - user: cassandra
-  - name: {{ key.key }}
-
-{%- endif %}
-
-{%- endfor %}
+    - file: {{ backup.backup_dir }}/.ssh
 
 cassandra_server_script:
   file.managed:
diff --git a/cassandra/files/backup/authorized_keys b/cassandra/files/backup/authorized_keys
new file mode 100644
index 0000000..14e7ae7
--- /dev/null
+++ b/cassandra/files/backup/authorized_keys
@@ -0,0 +1,19 @@
+{%- from "cassandra/map.jinja" import backup with context %}
+{%- for key_name, key in backup.server.key.iteritems() %}
+{%- if key.get('enabled', False) %}
+{%- set clients = [] %}
+{%- if backup.restrict_clients %}
+  {%- for node_name, node_grains in salt['mine.get']('*', 'grains.items').iteritems() %}
+    {%- if node_grains.get('cassandra', {}).get('backup', {}).get('client') %}
+    {%- set client = node_grains.get('cassandra').get('backup').get('client') %}
+      {%- if client.get('addresses') and client.get('addresses', []) is iterable %}
+        {%- for address in client.addresses %}
+          {%- do clients.append(address|string) %}
+        {%- endfor %}
+      {%- endif %}
+    {%- endif %}
+  {%- endfor %}
+{%- endif %}
+no-pty{%- if clients %},from="{{ clients|join(',') }}"{%- endif %} {{ key.key }}
+{%- endif %}
+{%- endfor %}
diff --git a/metadata/service/backup/client.yml b/metadata/service/backup/client.yml
new file mode 100644
index 0000000..0fbe5e1
--- /dev/null
+++ b/metadata/service/backup/client.yml
@@ -0,0 +1,4 @@
+applications:
+- cassandra
+classes:
+- service.cassandra.support
diff --git a/metadata/service/backup/server.yml b/metadata/service/backup/server.yml
new file mode 100644
index 0000000..0fbe5e1
--- /dev/null
+++ b/metadata/service/backup/server.yml
@@ -0,0 +1,4 @@
+applications:
+- cassandra
+classes:
+- service.cassandra.support