Anyone using ProxMenuX for host backup?

[andersostling56]

I was trying out a backup and restore of the PVE host settings, but upon restore I am told that the PBS keyfile is required to restore the backup.
Where do I find said keyfile? Is it the PBS fingerprint that should be stored in a file on the PVE host?
Thanks
Anders

 

[LnxBil]

I don't use ProxMenuX, but the normal proxmox-backup-client. You need the following settings in order to use the restore:

• PBS IP
• Username / Password / Token
• Encryption Key
• optional fingerprint if you don't use properly signed certificates with CA
• datastore to use

 

[andersostling56]

PBS IP - check
User/Pwd - check
Enc key - ?
Fingerprint - check
Datastore - check

So the encryption key is missing, but I assume that this is only for encrypted backups, so if I choose not to encrypt it, it should not be required, right?

 

[leesteken]

Yes, you don't need encryption keys when you don't use (client-side) encryption.
I also don't know the tool you use, but since the encryption is done on the client it should have the encryption keyfile somewhere.
Also, make separate (paper) copies of the encryption keys and store them somewhere safe and away from the backups (as you need then for restores): https://pbs.proxmox.com/docs/backup-client.html#encryption

 

[andersostling56]

Yes, you don't need encryption keys when you don't use (client-side) encryption.
I also don't know the tool you use, but since the encryption is done on the client it should have the encryption keyfile somewhere.
Also, make separate (paper) copies of the encryption keys and store them somewhere safe and away from the backups (as you need then for restores): https://pbs.proxmox.com/docs/backup-client.html#encryption

Great advice, thanks.
I did a new test w/o encryption and it seems to work fine.

 

[MacRimi]

I was trying out a backup and restore of the PVE host settings, but upon restore I am told that the PBS keyfile is required to restore the backup.
Where do I find said keyfile? Is it the PBS fingerprint that should be stored in a file on the PVE host?
Thanks
Anders

In ProxMenux, encryption is opt-in. The first host backup asks "Do you want to encrypt this backup?" — pick No and no keyfile is generated.

If you say Yes, ProxMenux walks you through this:

1. Keyfile source— two options:
   • Generate a new one — creates pbs-key.conf locally at /usr/local/share/proxmenux/pbs-key.conf.
   • Use an existing one — if you already have a PBS-managed keyfile for the same repo (e.g. the one PVE uses for its own vzdump backups), ProxMenux auto-detects it; otherwise you point to the file.
   
   
2. Escrow (optional) — "Upload an encrypted copy of the key to PBS?"— Yes/No:
   • Yes → you set a passphrase, ProxMenux wraps the key in an openssl envelope (pbs-key.recovery.enc) and uploads it to PBS as keyrecovery.conf alongside every backup. PBS never sees the plain key — the envelope is passphrase-encrypted client-side. Only take this route if you trust the PBS host with an encrypted blob whose passphrase you keep separately.
   • No → the key stays local. ProxMenux shows you the path and reminds you to make your own offsite copy.
   
   
3. Download from the Monitor — the ProxMenux Monitor dashboard has a Download keyfile button (Host Backup → PBS encryption card). Download it and store the file in a safe place — an external drive, encrypted vault, another host you control. Treat it as a credential file: keep it intact and off the same machine you're backing up.

On a fresh Proxmox reinstall, the flow is:

• Reinstall ProxMenux, then Host Backup → PBS encryption → Import keyfile and upload the pbs-key.conf you saved.
• The imported key sits back at the standard path. Point ProxMenux at your PBS datastore and the encrypted snapshots restore normally.
• If you took the escrow route in step 2 and lost the local copy, you can still recover: pull the keyrecovery.conf blob from PBS, feed it to ProxMenux with the passphrase you set, and you're back in.

If you enable encryption and neither keep a local copy nor upload the envelope to PBS nor remember the escrow passphrase, the snapshots are unrecoverable.

Cheers.

 

[andersostling56]

In ProxMenux, encryption is opt-in. The first host backup asks "Do you want to encrypt this backup?" — pick No and no keyfile is generated.

If you say Yes, ProxMenux walks you through this:

1. Keyfile source— two options:
   • Generate a new one — creates pbs-key.conf locally at /usr/local/share/proxmenux/pbs-key.conf.
   • Use an existing one — if you already have a PBS-managed keyfile for the same repo (e.g. the one PVE uses for its own vzdump backups), ProxMenux auto-detects it; otherwise you point to the file.
   
   
2. Escrow (optional) — "Upload an encrypted copy of the key to PBS?"— Yes/No:
   • Yes → you set a passphrase, ProxMenux wraps the key in an openssl envelope (pbs-key.recovery.enc) and uploads it to PBS as keyrecovery.conf alongside every backup. PBS never sees the plain key — the envelope is passphrase-encrypted client-side. Only take this route if you trust the PBS host with an encrypted blob whose passphrase you keep separately.
   • No → the key stays local. ProxMenux shows you the path and reminds you to make your own offsite copy.
   
   
3. Download from the Monitor — the ProxMenux Monitor dashboard has a Download keyfile button (Host Backup → PBS encryption card). Download it and store the file in a safe place — an external drive, encrypted vault, another host you control. Treat it as a credential file: keep it intact and off the same machine you're backing up.

On a fresh Proxmox reinstall, the flow is:

• Reinstall ProxMenux, then Host Backup → PBS encryption → Import keyfile and upload the pbs-key.conf you saved.
• The imported key sits back at the standard path. Point ProxMenux at your PBS datastore and the encrypted snapshots restore normally.
• If you took the escrow route in step 2 and lost the local copy, you can still recover: pull the keyrecovery.conf blob from PBS, feed it to ProxMenux with the passphrase you set, and you're back in.

If you enable encryption and neither keep a local copy nor upload the envelope to PBS nor remember the escrow passphrase, the snapshots are unrecoverable.

Cheers.

Thank you for the clear explanation!
/A

 

[andersostling56]

One observation, might be me that done something wrong though...

I created a backup w/o encryption on my PBS. The list of backuped files and directories included cron.weekly. For verification, I removed (renamed) one file in that directory and ran a Restore of the latest backup. However, the deleted/renamed file did NOT reappear. No error messages.
/A