[SOLVED] Proxmox-backup-client and API key?

[devilkin]

Hi,

I was wondering, and I can't find it in the documentation - can I somehow store the api key on a client and make proxmox-backup-client use that, instead of specifying the user with user@pbs@server:store ?

 

[oguz]

hi,

see [0]

this part:

An API token consists of two parts: an identifier consisting of the user name, the realm and a tokenname (user@realm!tokenname), and a secret value. Both need to be provided to the client in place of the user ID (user@realm) and the user password, respectively.

[0]: https://pbs.proxmox.com/docs/user-management.html?highlight=token#api-tokens

 

[Pavel N]

@oguz It's very unclear unclear how to use it in command line. So how do I upload single file using proxmox-backup-client and api key? Any example appreciated.

 

[dcsapak]

hi,

what exactly is unclear? the token secret can also be set in the environment variables, see https://pbs.proxmox.com/docs/backup-client.html#environment-variables

 

[Pavel N]

@dcsapak unclear is the cli format. For example wallets-gpg.pxar must not include second dot. wallets.gpg.pxar wont work, no helpful message is shown. Having two @ in repository name is confusing too. Having params as --api-key and --api-secret would not hurt anybody.

export PBS_REPOSITORY="user@pbs!upload-backups@your.domain.cz:storagename"
export PBS_PASSWORD="?????-????-?????-?????"

proxmox-backup-client backup wallets-gpg.pxar:/root/wallets-backup

 

[dcsapak]

For example wallets-gpg.pxar must not include second dot. wallets.gpg.pxar wont work, no helpful message is shown

that sound unintentional, would you mind opening a bug report on https://bugzilla.proxmox.com ?

Having two @ in repository name is confusing too.

i mean, thats debatable, but this isn't going away. even if we would change it, we'd have to keep it for backwards compatibility

Having params as --api-key and --api-secret would not hurt anybody.

yes it would, having it as parameter (especially the password/token) it would show up in process listings e.g. when doing 'ps ax' or using 'top' or similar
also if it's then invoked with sudo, in the default configuration the whole command gets logged into the syslog (inkl parameters)

so having a password/token as cli parameter is never a good idea