Proxmox Backup Server 4.0 released!

Well I updated mine to PBS 4 and now get a boot error:
error: file '/boot/grub/x86_64-efi/bli.mod' not found.

I'm guessing something was wonky about the UEFI setup. Trying to figure out how to get it to boot now.

Edit: Had to reinstall grub using Debian installer iso. Works now.
 
Last edited:
Getting the following when running pbs3to4 --full

Code:
: pbs3to4 --full
= CHECKING VERSION INFORMATION FOR PBS PACKAGES =

INFO: Checking for package updates..
PASS: all packages up-to-date
INFO: Checking proxmox backup server package version..
FAIL: could not match the 'proxmox-backup' package version, is it installed?
INFO: Check running kernel version..
PASS: running kernel '6.14.8-2-pve' is considered suitable for upgrade.

I upgraded Proxmox to version 9 recently. PBS is running on an LXC.

My PBS is currently hosed after 3 to 4 upgrade.
I had a similar error to you, but I am slightly different.

I am running PBS inside LXC on TrueNAS Scale 25.04.2, so definitely an unsupported setup.

Code:
= CHECKING VERSION INFORMATION FOR PBS PACKAGES =
INFO: Checking for package updates..
PASS: all packages up-to-date
INFO: Checking proxmox backup server package version..
FAIL: could not match the 'proxmox-backup' package version, is it installed?
INFO: Check running kernel version..
WARN: unexpected running and installed kernel '6.12.15-production+truenas'.

I fully acknowledge my setup is unsupported.
This is a homelab situation, the backups storage box is a TrueNAS box.
I referenced this guide originally for the Bookworm install
https://forum.proxmox.com/threads/pbs-on-truenas-have-your-cake-and-eat-it-too.162860/

The dist upgrade went fine and it is now a Trixie LXC container upgraded from originally a Bookworm LXC container, it is just the kernel is the TrueNAS kernel.
proxmox-backup-proxy and proxmox-backup services are running, and the logs look normal, but when I try to access the web interface I get connection reset error and it doesn't load.

Nothing helpful in the logs, doesn't even show my attempt to load the web page in any log I have found so no error I can really troubleshoot.
Code:
openssl s_client -connect localhost:8007

CONNECTED(00000004)
Can't use SSL_get_servername
depth=0 O = Proxmox Backup Server, OU = 81F45FD4-ED16-4A0B-A2AE-635EE9081313, CN = mypbs.HOME.local
verify error:num=18:self-signed certificate
verify return:1
depth=0 O = Proxmox Backup Server, OU = 81F45FD4-ED16-4A0B-A2AE-635EE9081313, CN = mypbs.HOME.local
verify return:1
---
******** redacted cert data here ********

    Verify return code: 18 (self-signed certificate)
    Extended master secret: no
    Max Early Data: 0
---

---
read R BLOCK
40E7D131B4720000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:322:

I dunno what the cause is.
Not had the chance to properly troubleshoot this yet however.

Out of curiosity I decided to start with a fresh Trixie LXC container and then installed PBS 4 on top of that.
It worked fine, no issues accessing web interface.

So it is not an outright incompatibility running PBS4 inside LXC on top of TrueNAS Scale, something just went south with the upgrade process from 3 to 4.
Just interesting that the upgrade hosed the original PBS.

I am reckon there is some minor bug there brought on because I am running it inside LXC on top of TrueNAS Scale which is not a supported way of doing it. (I did it this way so the container could have direct access to an underlying ZFS dataset in TrueNAS BTW)

No matter, seeing that it looks like it is going to work OK with a fresh install in a fresh Trixie LXC container, I will just go with that and migrate my datastore over to the new PBS instance, minor annoyance.


I will note however, I have now upgraded 2 bare metal PBS hosts at work from version 3 to version 4, and both of them went smoothly without a single problem.

Next step is to upgrade our PVE hosts from 8 to 9.
 
Last edited:
Just in case nobody reported this yet, it looks like OpenID logins are broken in PBS4.

They worked fine in PBS3, they work fine in PVE8 and PVE9.

But in PBS4, you immediately get logged out again after a couple seconds.
 
  • Like
Reactions: vermium
Just in case nobody reported this yet, it looks like OpenID logins are broken in PBS4.

They worked fine in PBS3, they work fine in PVE8 and PVE9.

But in PBS4, you immediately get logged out again after a couple seconds.
Some relevant logs for the PBS team:

backup01 proxmox-backup-api[xxxx]: authentication failure; rhost=[::ffff:xxx.xxx.xxx.xxx]:xxxxx user=xxxx@myopenidrealm msg=password authentication is not implemented for OpenID realms
backup01 proxmox-backup-api[xxxx]: POST /api2/json/access/ticket: 401 Unauthorized: [client [::ffff:1xxx.xxx.xxx.xxx]:xxxxx] permission check failed.
 
My PBS is currently hosed after 3 to 4 upgrade.
I had a similar error to you, but I am slightly different.

I am running PBS inside LXC on TrueNAS Scale 25.04.2, so definitely an unsupported setup.

Code:
= CHECKING VERSION INFORMATION FOR PBS PACKAGES =
INFO: Checking for package updates..
PASS: all packages up-to-date
INFO: Checking proxmox backup server package version..
FAIL: could not match the 'proxmox-backup' package version, is it installed?
INFO: Check running kernel version..
WARN: unexpected running and installed kernel '6.12.15-production+truenas'.

I fully acknowledge my setup is unsupported.
This is a homelab situation, the backups storage box is a TrueNAS box.
I referenced this guide originally for the Bookworm install
https://forum.proxmox.com/threads/pbs-on-truenas-have-your-cake-and-eat-it-too.162860/

The dist upgrade went fine and it is now a Trixie LXC container upgraded from originally a Bookworm LXC container, it is just the kernel is the TrueNAS kernel.
proxmox-backup-proxy and proxmox-backup services are running, and the logs look normal, but when I try to access the web interface I get connection reset error and it doesn't load.

Nothing helpful in the logs, doesn't even show my attempt to load the web page in any log I have found so no error I can really troubleshoot.
Code:
openssl s_client -connect localhost:8007

CONNECTED(00000004)
Can't use SSL_get_servername
depth=0 O = Proxmox Backup Server, OU = 81F45FD4-ED16-4A0B-A2AE-635EE9081313, CN = mypbs.HOME.local
verify error:num=18:self-signed certificate
verify return:1
depth=0 O = Proxmox Backup Server, OU = 81F45FD4-ED16-4A0B-A2AE-635EE9081313, CN = mypbs.HOME.local
verify return:1
---
******** redacted cert data here ********

    Verify return code: 18 (self-signed certificate)
    Extended master secret: no
    Max Early Data: 0
---

---
read R BLOCK
40E7D131B4720000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:322:

I dunno what the cause is.
Not had the chance to properly troubleshoot this yet however.

Out of curiosity I decided to start with a fresh Trixie LXC container and then installed PBS 4 on top of that.
It worked fine, no issues accessing web interface.

So it is not an outright incompatibility running PBS4 inside LXC on top of TrueNAS Scale, something just went south with the upgrade process from 3 to 4.
Just interesting that the upgrade hosed the original PBS.

I am reckon there is some minor bug there brought on because I am running it inside LXC on top of TrueNAS Scale which is not a supported way of doing it. (I did it this way so the container could have direct access to an underlying ZFS dataset in TrueNAS BTW)

No matter, seeing that it looks like it is going to work OK with a fresh install in a fresh Trixie LXC container, I will just go with that and migrate my datastore over to the new PBS instance, minor annoyance.


I will note however, I have now upgraded 2 bare metal PBS hosts at work from version 3 to version 4, and both of them went smoothly without a single problem.

Next step is to upgrade our PVE hosts from 8 to 9.

I'm encountering a similar issue, but on VMs running on PVE. The pbs3to4 command completes successfully and the upgrade finishes without errors. However, when I try to access the web interface, the connection is reset.
 
Just to add onto my previous post.

The new LXC container that was working fine running PBS 4, has broken again.
I completed all the normal setup for PBS, everything appeared ready to go.
Then I rebooted the container.

I started getting the connection reset.
But then I tried changing the IP address of the container and rebooted it, then it started working fine again after the reboot.

Left it a little while, and it stopped working again.
Then I changed the IP address again and rebooted and it started working again.

Very weird.
I can confirm there are no IP conflicts, as that was my first thought.

Something weird going on for sure.
 
updated PBS3 this morning to latest patch:
Unpacking proxmox-backup-server (3.4.4-1) over (3.4.3-1) ...

pbs3to4 now throws an error:
FAIL: could not match the 'proxmox-backup' package version, is it installed?

pbs3to4 had no errors before this update.
 
Last edited:
I have a strange problem with pbs 4. Looks like haproxy check is causing web ui to crash.

This is my backend in haproxy:
Code:
backend be_pbs
    option forwardfor
    acl internal_subnets src x.x.x.x/x
    http-request deny if ! internal_subnets
    server pbs x.x.x.x:8007 check ssl verify none

When "check" is on server line, web ui is crashing with this output from curl:
curl -k https://x.x.x.x:8007
curl: (56) Recv failure: Connection reset by peer

When i remove "check" from server line and restarts proxmox-backup-proxy everything is working fine again.

Note: I am running pbs on a pve node.
 
I have a strange problem with pbs 4. Looks like haproxy check is causing web ui to crash.

This is my backend in haproxy:
Code:
backend be_pbs
    option forwardfor
    acl internal_subnets src x.x.x.x/x
    http-request deny if ! internal_subnets
    server pbs x.x.x.x:8007 check ssl verify none

When "check" is on server line, web ui is crashing with this output from curl:
curl -k https://x.x.x.x:8007
curl: (56) Recv failure: Connection reset by peer

When i remove "check" from server line and restarts proxmox-backup-proxy everything is working fine again.

Note: I am running pbs on a pve node.

You may have just nailed my problem too.
I also have HA-Proxy in front of my PBS container.
And I am using the check directive.

That explains the behaviour I am seeing.

When I changed the IP address of my PBS container that stopped HAProxy from talking to it as the IP was wrong.
When I changed it back, HAProxy was then hitting it again.

Also explains why the test LXC container I could not repeat the problem.
It is on a different IP address.
 
Last edited:
My PBS is currently hosed after 3 to 4 upgrade.
I had a similar error to you, but I am slightly different.

I am running PBS inside LXC on TrueNAS Scale 25.04.2, so definitely an unsupported setup.

Code:
= CHECKING VERSION INFORMATION FOR PBS PACKAGES =
INFO: Checking for package updates..
PASS: all packages up-to-date
INFO: Checking proxmox backup server package version..
FAIL: could not match the 'proxmox-backup' package version, is it installed?
INFO: Check running kernel version..
WARN: unexpected running and installed kernel '6.12.15-production+truenas'.

I fully acknowledge my setup is unsupported.
This is a homelab situation, the backups storage box is a TrueNAS box.
I referenced this guide originally for the Bookworm install
https://forum.proxmox.com/threads/pbs-on-truenas-have-your-cake-and-eat-it-too.162860/

The dist upgrade went fine and it is now a Trixie LXC container upgraded from originally a Bookworm LXC container, it is just the kernel is the TrueNAS kernel.
proxmox-backup-proxy and proxmox-backup services are running, and the logs look normal, but when I try to access the web interface I get connection reset error and it doesn't load.

Nothing helpful in the logs, doesn't even show my attempt to load the web page in any log I have found so no error I can really troubleshoot.
Code:
openssl s_client -connect localhost:8007

CONNECTED(00000004)
Can't use SSL_get_servername
depth=0 O = Proxmox Backup Server, OU = 81F45FD4-ED16-4A0B-A2AE-635EE9081313, CN = mypbs.HOME.local
verify error:num=18:self-signed certificate
verify return:1
depth=0 O = Proxmox Backup Server, OU = 81F45FD4-ED16-4A0B-A2AE-635EE9081313, CN = mypbs.HOME.local
verify return:1
---
******** redacted cert data here ********

    Verify return code: 18 (self-signed certificate)
    Extended master secret: no
    Max Early Data: 0
---

---
read R BLOCK
40E7D131B4720000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:322:

I dunno what the cause is.
Not had the chance to properly troubleshoot this yet however.

Out of curiosity I decided to start with a fresh Trixie LXC container and then installed PBS 4 on top of that.
It worked fine, no issues accessing web interface.

So it is not an outright incompatibility running PBS4 inside LXC on top of TrueNAS Scale, something just went south with the upgrade process from 3 to 4.
Just interesting that the upgrade hosed the original PBS.

I am reckon there is some minor bug there brought on because I am running it inside LXC on top of TrueNAS Scale which is not a supported way of doing it. (I did it this way so the container could have direct access to an underlying ZFS dataset in TrueNAS BTW)

No matter, seeing that it looks like it is going to work OK with a fresh install in a fresh Trixie LXC container, I will just go with that and migrate my datastore over to the new PBS instance, minor annoyance.


I will note however, I have now upgraded 2 bare metal PBS hosts at work from version 3 to version 4, and both of them went smoothly without a single problem.

Next step is to upgrade our PVE hosts from 8 to 9.
Hi,
Just for your information, i have the same problem, i opened a subjet about that.
 
I'm encountering a similar issue, but on VMs running on PVE. The pbs3to4 command completes successfully and the upgrade finishes without errors. However, when I try to access the web interface, the connection is reset.

You may have just nailed my problem too.
I also have HA-Proxy in front of my PBS container.
And I am using the check directive.

That explains the behaviour I am seeing.

When I changed the IP address of my PBS container that stopped HAProxy from talking to it as the IP was wrong.
When I changed it back, HAProxy was then hitting it again.

Also explains why the test LXC container I could not repeat the problem.
It is on a different IP address.
This was my problem to
 
updated PBS3 this morning to latest patch:
Unpacking proxmox-backup-server (3.4.4-1) over (3.4.3-1) ...

pbs3to4 now throws an error:
FAIL: could not match the 'proxmox-backup' package version, is it installed?

pbs3to4 had no errors before this update.
Ist the proxmox-backup meta package correctly installed? Please post the output of apt-cache policy proxmox-backup and install the package if it is not installed via apt update && apt install proxmox-backup
 
After successfully upgrading from v3 to v4, WebAuthn 2FA stopped working.
By running
Code:
rm /etc/proxmox-backup/tfa.json{,.lock}
I was able to log in again. Enrolling WebAuthn 2FA for any user (whether using PAM or PBS authentication) succeeds, but logging in with WebAuthn 2FA afterwards fails.


The host certificate and all WebAuthn settings are valid.

1754556791824.png


EDIT: Webauthn 2FA via Yubikey ist working for me.
 
Last edited:
Ist the proxmox-backup meta package correctly installed? Please post the output of apt-cache policy proxmox-backup and install the package if it is not installed via apt update && apt install proxmox-backup

no it doesn't seem so... Installing solved the issue.

Code:
proxmox-backup:
  Installed: (none)
  Candidate: 3.4.0
  Version table:
     3.4.0 500
        500 http://download.proxmox.com/debian/pbs bookworm/pbs-no-subscription amd64 Packages
     3.3.0 500
        500 http://download.proxmox.com/debian/pbs bookworm/pbs-no-subscription amd64 Packages
     3.2.0 500
        500 http://download.proxmox.com/debian/pbs bookworm/pbs-no-subscription amd64 Packages
     3.0.1 500
        500 http://download.proxmox.com/debian/pbs bookworm/pbs-no-subscription amd64 Packages
     3.0.0 500
        500 http://download.proxmox.com/debian/pbs bookworm/pbs-no-subscription amd64 Packages
 
After successfully upgrading from v3 to v4, WebAuthn 2FA stopped working.
By running
Code:
rm /etc/proxmox-backup/tfa.json{,.lock}
I was able to log in again. Enrolling WebAuthn 2FA for any user (whether using PAM or PBS authentication) succeeds, but logging in with WebAuthn 2FA afterwards fails.


The host certificate and all WebAuthn settings are valid.

View attachment 89032
could you double check that you are on the latest PBS packages (4.0.11-4 or later)
 
could you double check that you are on the latest PBS packages (4.0.11-4 or later)
Code:
root@pbs:~# proxmox-backup-manager version
proxmox-backup-server 4.0.11-2 running version: 4.0.11
root@pbs:~#
I’m on version 4.0.11-2 but can’t upgrade to 4.0.11-4.
I’m using the “pbs-no-subscription” repository. Is access limited to users with a subscription?

1754558230995.png
 
no, it's only on pbs-test so far!