[SOLVED] PBS - dollar character in a password

[corriou]

Hello,

I have installed PBS yesterday and I am currently trying to backup files (VM backup is working fine).
I have followed what I found in the documentation (https://pbs.proxmox.com/docs/backup-client.html) but I did not succeed in backing up the files except by filling manually the password :

• when I choose to use environment variables (doesn't work):

root@XXXX:~# export PBS_PASSWORD=XXXXXXXXXXXXXXXXXXXXXX
root@XXXX:~# export PBS_FINGERPRINT=XXXXXXXXXXXXXXXXXXXXXX
root@XXXX:~# export PBS_REPOSITORY=admin@pbs@pbs:backup
root@XXXX:~# proxmox-backup-client backup home.pxar:/home
Starting backup: host/XXXX/2021-03-11T08:02:42Z
Client name: XXXX
Starting backup protocol: Thu Mar 11 09:02:43 2021
Error: permission check failed.

• when the PBS_PASSWORD is not set (works ):

root@XXXX:~# unset PBS_PASSWORD
root@XXXX:~# proxmox-backup-client backup home.pxar:/home
Password for "admin@pbs": ******************
Starting backup: host/XXXX/2021-03-11T08:06:40Z
Client name: XXXX
Starting backup protocol: Thu Mar 11 09:06:44 2021
Downloading previous manifest (Wed Mar 10 17:10:46 2021)
Upload directory '/home' to 'admin@pbs@pbs:8007:backup' as home.pxar.didx
home.pxar: had to upload 16.52 MiB of 36.31 MiB in 0.15s, average speed 106.84 MiB/s).
home.pxar: backup was done incrementally, reused 19.79 MiB (54.5%)
Uploaded backup catalog (540 B)
Duration: 0.68s
End Time: Thu Mar 11 09:06:45 2021

• when I try to insert the password in a script (doesn't work) :

echo -e '******************\n' | proxmox-backup-client backup home.pxar:/home
Error: error building client for repository admin@pbs@pbs:8007:backup - no password input mechanism available

If ever you have an idea, I would be gratefull.
Thansk for reading.

 

[Hannes Laimer]

Hey,

is it possible that the password contains a typo or something is not escaped correctly? This error message usually only occurs if the user doesn't exist or the password I not correct.

 

[corriou]

Would the $ be a typo ?

 

[Hannes Laimer]

You can try echo $PBS_PASSWORD, whatever it outputs is what will be used as a password. If it doesn't match, but the password in single quotes: export PBS_PASSWORD='<password>', this should escape everything in your password.

 

[corriou]

I changed my password. Indeed, the $ character is unusable in the password but escaping it works.

Thanks for the lead.

 

[corriou]

You can try echo $PBS_PASSWORD, whatever it outputs is what will be used as a password. If it doesn't match, but the password in single quotes: export PBS_PASSWORD='<password>', this should escape everything in your password.

export PBS_PASSWORD='<password>' works. I don't know why I didn't think about it. Thanks.

 

[Hannes Laimer]

Glad I could help

 

[Joi Owen]

I've learned over the years that a lot of bugs in security functions can be avoided by sanitizing your passwords to remove common shell metacharacters like $*!#[]()<> and &. It so very common for some dumb thing to accept a password string and then send it unquoted into another shell command, where it gets mangled. The exact list depends on the shells and scripting languages in use by the product.