Backups are not being encrypted via backup-client-script

[supportlooker]

Hello,

we have a script that we setup to use the backup-client on a external servers which simply calls the backup-client exports the encryption key and password and then selects the diretories we want to backup.

This script works fine on all of our servers except one server. The backups do reache pbs without an issues however they are not encrpyted.
I have been trying to look all over if there is something we need to do first on the external client to get this encrpytion working but i can't find any information. So i assume that all of this done by the client and yet somehow it doesn't work.

I would be very happy with any tips as to where i can look to figure this out

 

[fabian]

without any information how you are actually setting up and calling the client nobody will be able to help you..

 

[supportlooker]

export PBS_REPOSITORY="backup@pbs@backup.company.com:nvme10-1212"
export PBS_PASSWORD_FILE=password.sec
export PBS_ENCRYPTION_PASSWORD_FILE=encryption-key.sec
#export PBS_FINGERPRINT="00:00:00:00:00P"

proxmox-backup-client \
backups \
mysql-backups.pxar:/var/mysql/backups \

that is what we are running inside of a bash script

 

[Chris]

export PBS_REPOSITORY="backup@pbs@backup.company.com:nvme10-1212"
export PBS_PASSWORD_FILE=password.sec
export PBS_ENCRYPTION_PASSWORD_FILE=encryption-key.sec
#export PBS_FINGERPRINT="00:00:00:00:00P"

proxmox-backup-client \
backups \
mysql-backups.pxar:/var/mysql/backups \

that is what we are running inside of a bash script

Are both, the key and password file in the expected location? Maybe you should provide an absolute path to these files instead. Also, check the output of the client by invoking the shell script, that should give some more information.

 

[supportlooker]

yes they are in the expected location and even with an absolute path.
However the backups do work but not the encryption part.
None the less I tried to put the password and encrpytion key directly on the script it still didn't work as expected

 

[fluxX04]

Could be a copy & paste failure into the forum but

proxmox-backup-client \
backups \
mysql-backups.pxar:/var/mysql/backups \

backups is not a valid parameter, it's called backup.

 

[Chris]

Could be a copy & paste failure into the forum but

backups is not a valid parameter, it's called backup.

You are right, In that case there should not have been created any backups however, so I guess its a typo.

 

[Chris]

yes they are in the expected location and even with an absolute path.
However the backups do work but not the encryption part.
None the less I tried to put the password and encrpytion key directly on the script it still didn't work as expected

What client version are you using: proxmox-backup-client version?

 

[supportlooker]

yes, sorry it is just a typo.
I checked the version and it is
client version: 3.0.4

 

[Chris]

yes, sorry it is just a typo.
I checked the version and it is
client version: 3.0.4

Did you export the key to the required location? see step 3: https://pbs.proxmox.com/docs/backup...ster-key-to-store-and-recover-encryption-keys
Also, is the user the same? Do you have read access to the files as that user?

 

[supportlooker]

thanks for the answer. here is where it gets a bit complicated since i didn't set up all of this infrastructure I have no idea what exactly was done and what was not done.
I know that inside the .sec file there is some text combination that i assume is some kind of password but if there are any encryption keys or where they are located i have no idea.

On the other hand I also did not want to run the command to create the keypair again in case it might screw up something on the other servers.

from reading that documentation there should be a .json file somewhere with an encryption key and also a .pem keypair somewhere. Is that correct? If so any idea where they could be on the server we are trying to backup

 

[supportlooker]

ok i figured out the issue and it was simple but without knowing that we haven't done it it's impossible to debug.
Basically step number one which was to generate the encrpytion key was not done at all. After doing that it now works.

 

[supportlooker]

i do want to ask also in a similar vein. We have a different server where everything is working but the external files .sec files for some reason are not being read by the script. We ended up copying them directly into the .sh script. Do you have any tips for what might be behind that?

 

[SSTALIN]

I also want to make a backup of the backup but it doesn't work in any way. The other day a server was damaged and we need the backup copy that we have on a separate server but I don't know how to download it or transfer it to the other

 

[Chris]

i do want to ask also in a similar vein. We have a different server where everything is working but the external files .sec files for some reason are not being read by the script. We ended up copying them directly into the .sh script. Do you have any tips for what might be behind that?

Maybe wrong file permissions?

On a more general note: I would suggest to use the verbose client parameters over the implied default locations in such a script e.g. by passing the absolute path to the key via the --keyfile. This makes it easier to understand and debug.

 

[Chris]

I also want to make a backup of the backup but it doesn't work in any way. The other day a server was damaged and we need the backup copy that we have on a separate server but I don't know how to download it or transfer it to the other

Not at all related to this issue, please do not hijack threads with unrelated questions. You already opened a thread for this i guess [0]? You should post in English to get feedback more likely.

[0] https://forum.proxmox.com/threads/descargar-backup-de-proxmox-a-mi-computador-local.151384/