PBS: unable to create pull sync job

PBS: unable to create pull sync job

[Uwe Sauter]

Dear all,

as there is no separate list for the Proxmox Backup Server I hope to find some help here.

TL;DR: On the pulling server, I cannot see the datastore that is the source for the job. Permissions?


Situation:
I have two servers named corvus and cygnus.

corvus:
- corvus is the main backup server where my PVE cluster puts the daily backups.
- The datastore has different namespaces for daily and weekly backups.
- There are two additional users configured, one for the PVE cluster (pve@pbs), the other one for
cygnus (cygnus@pbs). Both are managed by the Proxmox Backup authentication server.
- cygnus@pbs has the RemoteSyncOperator permissions on the corvus datastore.

cygnus:
- Shall pull the weekly backups for long term storage.
- Datastore has currently no namespaces yet.
- Has no additional users (yet).
- corvus was added to the "remotes" using the credentials from cygnus@pbs on corvus.

So, when I try to create a pull sync job on cygnus' datastore I can select Source Remote "corvus"
but I cannot select a Source Datastore.


My impression is that either the permissions for cygnus@pbs on corvus are wrong or that the
communication between the two hosts does not work.

Unfortunately I couldn't find any logs regarding the communication between the hosts, neither
positive nor negative.

So I assume that the issue lies with the permissions.

As I am currently playing around as root@pam I don't think that the local permissions are relevant.


Any suggestions what permissions are missing on cygnus@pbs on corvus? Any ideas on debugging this?


Thanks, I appreciate any input.

	Uwe

Re: PBS: unable to create pull sync job

[Christian Ebner]

Hi,

On 2/25/26 12:23 PM, Uwe Sauter wrote:
> Dear all,
> 
> as there is no separate list for the Proxmox Backup Server I hope to find some help here.
> 
> TL;DR: On the pulling server, I cannot see the datastore that is the source for the job. Permissions?
> 
> 
> Situation:
> I have two servers named corvus and cygnus.
> 
> corvus:
> - corvus is the main backup server where my PVE cluster puts the daily backups.
> - The datastore has different namespaces for daily and weekly backups.
> - There are two additional users configured, one for the PVE cluster (pve@pbs), the other one for
> cygnus (cygnus@pbs). Both are managed by the Proxmox Backup authentication server.
> - cygnus@pbs has the RemoteSyncOperator permissions on the corvus datastore.

The user with RemoteSyncOperator permissions must be configured on the 
pulling (target) PBS instance on the corresponding remote path. This 
basically allows that user to read the remote configuration in order to 
connect and perform pruning on that remote. On the source side you will 
have to give Datastore.Backup or Datastore.PowerUser on the source 
datastore to the user configured for the remote connection.

Details are documented in 
https://pbs.proxmox.com/docs/managing-remotes.html#sync-jobs

> 
> cygnus:
> - Shall pull the weekly backups for long term storage.
> - Datastore has currently no namespaces yet.
> - Has no additional users (yet).
> - corvus was added to the "remotes" using the credentials from cygnus@pbs on corvus.

cygnus@pbs needs permissions to read the datastore on the remote host, 
which you are currently lacking. The RemoteSyncOperator does not allow this.

> 
> So, when I try to create a pull sync job on cygnus' datastore I can select Source Remote "corvus"
> but I cannot select a Source Datastore.
> 
> 
> My impression is that either the permissions for cygnus@pbs on corvus are wrong or that the
> communication between the two hosts does not work.
> 
> Unfortunately I couldn't find any logs regarding the communication between the hosts, neither
> positive nor negative.
> 
> So I assume that the issue lies with the permissions.
> 
> As I am currently playing around as root@pam I don't think that the local permissions are relevant.
> 
> 
> Any suggestions what permissions are missing on cygnus@pbs on corvus? Any ideas on debugging this?

Hope this helps,
Chris