proxmox-backup-client Permission Check Failed

[giraffe_with_glasses]

Hi All!

I would like to schedule backups for a filesystem on my PVE host to the PBS server with proxmox-backup-client.

Running proxmox-backup-client backup "${LABEL}.pxar:${SOURCE_PATH}" --repository "${PBS_REPOSITORY}" without $PBS_PASSWORD set works fine. This prompts me for the password of root@pam and the backup runs successfully. But I would like to create a cron job for the backup and authenticate with an API Token. I have set up a token for root@pam and added permissions for it with DatastoreAdmin on /datastore, Propagate is set to "Yes". The token is enabled and not expired.

The following env vars have been set on the PVE host:

export PBS_REPOSITORY=******
export PBS_TOKEN_NAME="root@pam!tokenId"
export PBS_PASSWORD=******

I get the following error message:

Error: permission check failed.

Trying with a different user / API Token gives the same error. Changing Token permissions to Admin and/or setting the permission path to / does not help. I tried rebooting the servers, which does not help. I am using PVE 9.0.11 and PBS 4.0.18.

I would appreciate some help on this, thanks!

 

[Onslow]

Welcome, giraffe...

At https://pbs.proxmox.com/docs/user-management.html#api-tokens there is such a fragment:

"The API token is passed from the client to the server by setting the Authorization HTTP header with method PBSAPIToken to the value TOKENID:TOKENSECRET ."

So maybe your "export PBS_PASSWORD=******" should contain TOKENSECRET, not PBS_PASSWORD.
Similar, TOKENID, not PBS_TOKEN_NAME?

 

[Chris]

export PBS_TOKEN_NAME="root@pam!tokenId"

This is not an environment variable used by PBS client? Where did you get this from, as it is incorrect?

The user and token are part of the repository to be set in PBS_REPOSITORY, the token secret to be stored in PBS_PASSWORD. For details see https://pbs.proxmox.com/docs/backup-client.html#backup-client-usage, especially the backup repository locations and environment variables sections.