[PVE-User] Backup Beta - restore failing

[PVE-User] Backup Beta - restore failing

[Lindsay Mathieson]

Have installed the Backup Server on a VM with storage on a NFS serve 
(our NAS) - not recommend I know, but its for testing.


Have backups working fine, performance is ok and the diff backups are 
very fast. However can't get a restore to work, get this error in the 
web gui:

/usr/bin/proxmox-backup-client restore '--crypt-mode=none' 
vm/311/2020-07-11T00:57:52Z index.json 
/var/tmp/vzdumptmp121335/index.json --repository 
proxmox@pbs@192.168.5.49:test' failed: exit code 255


If I run the same command from the console, I get:

    /usr/bin/proxmox-backup-client restore '--crypt-mode=none'
    vm/311/2020-07-11T00:57:52Z index.json
    /var/tmp/vzdumptmp121335/index.json --repository
    proxmox@pbs@192.168.5.49
    Error: parameter verification errors

    parameter 'repository': value does not match the regex pattern


proxmox@pbs has DatastorePowerUser rights.




-- 
Lindsay

Re: [PVE-User] Backup Beta - restore failing

[Dietmar Maurer]

> Have backups working fine, performance is ok and the diff backups are 
> very fast. However can't get a restore to work, get this error in the 
> web gui:
> 
> /usr/bin/proxmox-backup-client restore '--crypt-mode=none' 
> vm/311/2020-07-11T00:57:52Z index.json 
> /var/tmp/vzdumptmp121335/index.json --repository 
> proxmox@pbs@192.168.5.49:test' failed: exit code 255
> 
> 
> If I run the same command from the console, I get:
> 
>     /usr/bin/proxmox-backup-client restore '--crypt-mode=none'
>     vm/311/2020-07-11T00:57:52Z index.json
>     /var/tmp/vzdumptmp121335/index.json --repository
>     proxmox@pbs@192.168.5.49
>     Error: parameter verification errors
> 
>     parameter 'repository': value does not match the regex pattern
> 
> 
> proxmox@pbs has DatastorePowerUser rights.

Seem there is a problem how we compute the repository - the datastore part is missing.
It should look like <user@pbs@<IP>:<datastore>. For example, if your datastore
name is 'store1':

--repository proxmox@pbs@192.168.5.49:store1

You can test easily if that works with:

# proxmox-backup-client snapshots --repository proxmox@pbs@192.168.5.49:store1


Please can you show post the pbs storage configuration?

Re: [PVE-User] Backup Beta - restore failing

[Lindsay Mathieson]

On 11/07/2020 4:33 pm, Dietmar Maurer wrote:
> Please can you show post the pbs storage configuration?


pbs: backupbeta
         datastore test
         server 192.168.5.49
         content backup
         fingerprint 
1c:f0:e0:76:67:a5:f3:b7:b6:2b:5c:33:xxxxxxxxx:98:8f:31:15:0b:0d:53:93:2b:2f:52
         maxfiles 2
         nodes vni,vnh,vnb
         username proxmox@pbs


> Seem there is a problem how we compute the repository - the datastore part is missing.
> It should look like <user@pbs@<IP>:<datastore>. For example, if your datastore
> name is 'store1':
>
> --repositoryproxmox@pbs@192.168.5.49:store1
>
> You can test easily if that works with:
>
> # proxmox-backup-client snapshots --repositoryproxmox@pbs@192.168.5.49:store1

  proxmox-backup-client restore '--crypt-mode=none' 
vm/311/2020-07-11T00:57:52Z index.json 
/var/tmp/vzdumptmp121335/index.json --repository 
proxmox@pbs@192.168.5.49:backupbeta

Processed without the param verification error and I got asked for the 
password, and two fingerprint verications/did I really want to continue 
prompts, but then it fails with:

Error: HTTP Error 400 Bad Request: no permissions


nb:

  * Std install with no custom certs, so using the default self
    generated certs in the proxmox cluster and backup server
  * Have added the pub keys to authorized_keys in both the ProxMox host
    and the Backup server so automatic ssh works in both directions.

Should I try adding the backup storage in proxmox as a FQDN rather than 
a static IP?

-- 
Lindsay

Re: [PVE-User] Backup Beta - restore failing

[Dietmar Maurer]

> > Please can you show post the pbs storage configuration?
> 
> 
> pbs: backupbeta
> datastore test
> server 192.168.5.49
> content backup
> fingerprint 1c:f0:e0:76:67:a5:f3:b7:b6:2b:5c:33:xxxxxxxxx:98:8f:31:15:0b:0d:53:93:2b:2f:52
> maxfiles 2
> nodes vni,vnh,vnb
> username proxmox@pbs
> 
> 
> 
> > Seem there is a problem how we compute the repository - the datastore part is missing.
> > It should look like <user@pbs@<IP>:<datastore>. For example, if your datastore
> > name is 'store1':
> > 
> > --repository proxmox@pbs@192.168.5.49:store1
> > 
> > You can test easily if that works with:
> > 
> > # proxmox-backup-client snapshots --repository proxmox@pbs@192.168.5.49:store1
> 
> 
> proxmox-backup-client restore '--crypt-mode=none' vm/311/2020-07-11T00:57:52Z index.json /var/tmp/vzdumptmp121335/index.json --repository proxmox@pbs@192.168.5.49:backupbeta

The datastore name in 'test', so please try "proxmox@pbs@192.168.5.49:test" instead.

Re: [PVE-User] Backup Beta - restore failing

[Dietmar Maurer]

> > proxmox-backup-client restore '--crypt-mode=none' vm/311/2020-07-11T00:57:52Z index.json /var/tmp/vzdumptmp121335/index.json --repository proxmox@pbs@192.168.5.49:backupbeta
> 
> The datastore name in 'test', so please try "proxmox@pbs@192.168.5.49:test" instead.

Please note that 'proxmox-backup-client' uses backup server datastore 
names, instead of pve storage names. I guess this can be confusing ...

Re: [PVE-User] Backup Beta - restore failing

[Lindsay Mathieson]

On 11/07/2020 6:28 pm, Dietmar Maurer wrote:
> The datastore name in 'test', so please try"proxmox@pbs@192.168.5.49:test"  instead.

Yup, that did the trick, thanks.

-- 
Lindsay

Re: [PVE-User] Backup Beta - restore failing

[Lindsay Mathieson]

On 11/07/2020 4:33 pm, Dietmar Maurer wrote:
> Seem there is a problem how we compute the repository - the datastore part is missing.
> It should look like <user@pbs@<IP>:<datastore>. For example, if your datastore
> name is 'store1':
>
> --repositoryproxmox@pbs@192.168.5.49:store1

Actually that looks to be my fault - looking at the gui log I posted, 
the ":test" is in fact there, I just neglected to copy it to the command 
line :( Sorry.


However now that side is working ok, getting:

Error: HTTP Error 400 Bad Request: no permissions

-- 
Lindsay

Re: [PVE-User] Backup Beta - restore failing

[Lindsay Mathieson]

On 11/07/2020 5:17 pm, Lindsay Mathieson wrote:
>
> However now that side is working ok, getting:
>
> Error: HTTP Error 400 Bad Request: no permissions
>
Works when I use root@pam

-- 
Lindsay

Re: [PVE-User] Backup Beta - restore failing

[Thomas Lamprecht]

On 11.07.20 10:17, Lindsay Mathieson wrote:
> On 11/07/2020 5:17 pm, Lindsay Mathieson wrote:
>>
>> However now that side is working ok, getting:
>>
>> Error: HTTP Error 400 Bad Request: no permissions
>>
> Works when I use root@pam
> 

If you add and user it starts out with no permissions, so you need to
add some to make it work.
https://pbs.proxmox.com/docs/administration-guide.html#access-control

The simplest would probably be to give the DatastoreAdmin role on the
/datastore/<id> path.

HTH

Re: [PVE-User] Backup Beta - restore failing

[Lindsay Mathieson]

On 11/07/2020 6:24 pm, Thomas Lamprecht wrote:
> If you add and user it starts out with no permissions, so you need to
> add some to make it work.
> https://pbs.proxmox.com/docs/administration-guide.html#access-control
>
> The simplest would probably be to give the DatastoreAdmin role on the
> /datastore/<id> path.

I did add the DatastorePowerUser role to path "/" for the user, but it 
didn't seem to take. After a bit of testing I found I had to switch to a 
different VM and back again in the GUI before it recognised the role 
addition. Maybe some caching at play?


Restores and Show config are working now.

-- 
Lindsay

Re: [PVE-User] Backup Beta - restore failing

[Thomas Lamprecht]

On 11.07.20 14:46, Lindsay Mathieson wrote:
> On 11/07/2020 6:24 pm, Thomas Lamprecht wrote:
>> If you add and user it starts out with no permissions, so you need to
>> add some to make it work.
>> https://pbs.proxmox.com/docs/administration-guide.html#access-control
>>
>> The simplest would probably be to give the DatastoreAdmin role on the
>> /datastore/<id> path.
> 
> I did add the DatastorePowerUser role to path "/" for the user, but it didn't seem to take. After a bit of testing I found I had to switch to a different VM and back again in the GUI before it recognised the role addition. Maybe some caching at play?
> 

There is a cache for permissions, so there /could/ theoretically be an issue with
not invalidating immediately after some permissions where changed.

> 
> Restores and Show config are working now.
> 

Ok, glad to hear!