Restore Single Disk from PBS - auth error

[informant]

Hi all,
i have add in PBS GUI a API-Token root@pam and set API-Permissions for this user to /datastore with admin rights in Right section and datastore right section.
After i have Login with ssh to my proxmox node and use this commands:

export PBS_PASSWORD=passwordfromapiuser
export PBS_FINGERPRINT=paste_from_my_PBS
pbs-restore --repository root@pam@ipofmybackupserver:mydatastorename vm/5139/2026-04-18T20:22:42Z drive-virtio0.img.fidx /var/lib/vz/images/5139/vm-5139-disk-0 --verbose --format raw --skip-zero

but after i use this, i get error:

restore failed (connection error): command error: permission check failed.

PBS syslog:

Apr 19 22:03:33 backup-srv unix_chkpwd[368050]: password check failed for user (root)
Apr 19 22:03:33 backup-srv proxmox-backup-api[3298958]: pam_unix(proxmox-backup-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:myipv4ofpnode user=root
Apr 19 22:03:35 backup-srv proxmox-backup-api[3298958]: authentication failure; rhost=[::ffff:myipv4ofpnode]:40990 user=root@pam msg=authentication error - AUTH_ERR (7)
Apr 19 22:03:38 backup-srv proxmox-backup-api[3298958]: POST //api2/json/access/ticket: 401 Unauthorized: [client [::ffff:myipv4ofpnode]:40990] permission check failed.

what is problem here? i have set all rights correct in backup-srv!
any ideas?

regards

 

[d.oishi]

Are you trying to log in as the PBS `root@pam` user, or are you trying to authenticate with an API token created for that user?

Right now, it looks like pbs-restore is attempting to log in as the root user, but export PBS_PASSWORD=passwordfromapiuser seems to contain the API token secret instead of the actual password for `root@pam`.

Also, for manual restore operations, proxmox-backup-client restore may be more convenient than pbs-restore, because the documentation and command reference are more complete.

 

[informant]

how can i use proxmox-backup-client restore for a single hdd ?
i can login with root@pam and i use api user root@pam with api toke in pbs-restore
regards

 

[d.oishi]

The `proxmox-backup-client` command is documented in detail here:

https://pbs.proxmox.com/docs/proxmox-backup-client/man1.html

For example, a restore command would look like this:

export PBS_PASSWORD=passwordfromroot@pam
export PBS_FINGERPRINT=paste_from_my_PBS
proxmox-backup-client restore vm/5139/2026-04-18T20:22:42Z drive-virtio0.img.fidx /var/lib/vz/images/5139/vm-5139-disk-0 --repository 'root@pam@ipofmybackupserver:mydatastorename'

Based on the error log, I suspect that `PBS_PASSWORD` is not set to the correct credential.

With `root@pam@ipofmybackupserver:mydatastorename`, you are authenticating as `root@pam`, not with an API token.
So in that case, `PBS_PASSWORD` needs to be the actual password for `root@pam`.

If you want to use an API token instead, the repository should be written as `root@pam!token@ipofmybackupserver:mydatastorename`, and `PBS_PASSWORD` should contain the API token secret.

 

[informant]

ok normal password of root@pam was not accepted in PBS_PASSWORT i have special carracters included with '' dont work to, but i test other way. Thanks to here.