From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 6B9B71FF0B3 for ; Wed, 09 Sep 2026 13:12:34 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 0DEBF2157E; Wed, 09 Sep 2026 13:12:34 +0200 (CEST) From: Erik Fastermann To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox-backup 0/5] report: cover the s3 configuration Date: Wed, 9 Sep 2026 13:12:23 +0200 Message-ID: <20260909111228.217535-1-e.fastermann@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 1 AWL -0.474 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 1.274 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Message-ID-Hash: U3SWSZXJRVDGABRE5C7YLHLK76IEJKSY X-Message-ID-Hash: U3SWSZXJRVDGABRE5C7YLHLK76IEJKSY X-MailFrom: efastermann@ruth.proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Erik Fastermann X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: NOTE: This patch series depends on an unapplied series [0]. Include the ability to list the s3 endpoints and corresponding buckets, which can help when debugging a system. See the individual commit messages for the rational. The first two patches are independent of that. The second one stops the report from exposing the password or API token of every configured remote, which remote.cfg stores base64 encoded. Reports are regularly attached to public forum threads, so this seems worth fixing on its own. There are other places where credentials can be exposed. I created an entry on the bug tracker for this [1]. [0] https://lore.proxmox.com/pbs-devel/20260811114332.283776-1-e.fastermann@proxmox.com/ [1] https://bugzilla.proxmox.com/show_bug.cgi?id=8023 Erik Fastermann (5): report: rename mislabeled datastore file group report: do not include remote passwords report: include the s3 endpoint configuration api: s3: drop unused rpcenv parameter from bucket listing report: list the accessible s3 buckets src/api2/config/s3.rs | 5 +- src/bin/proxmox_backup_manager/s3.rs | 7 +-- src/server/report.rs | 92 +++++++++++++++++++++++----- 3 files changed, 79 insertions(+), 25 deletions(-) -- 2.47.3