Proxmox Backup Server: Overview, Setup and Key Tips

If your virtualization platform is Proxmox VE, you probably store backups with its built-in tool as full files on a NAS. This is simple, but every backup is a full copy, space fills up quickly, and backing up several times a day is not practical. Proxmox Backup Server, or PBS for short, was built to solve exactly these problems.

What is PBS?

PBS is a standalone backup system based on Debian, released by the makers of Proxmox VE and installed on a separate server. The software is open source and needs no license to use; the paid subscription provides access to the enterprise update repository and official support. Its web interface is available on port 8007 by default.

Key features

• Deduplication: Data is split into chunks, and each chunk is stored only once, even across different machines. That is why keeping many copies takes relatively little space.
• Fast incremental backups: For running virtual machines, Proxmox VE tracks changed blocks, and only those are read and sent. If the VM is fully shut down, this tracking starts over and the next backup reads the whole disk, although only new chunks are still stored.
• Client-side encryption: Backups are encrypted before they are sent, which makes them suitable for storage on a remote server.
• Verification (Verify): Periodic checksum checks of chunks, with corruption reports.
• Sync: Copying backups to another PBS, for example in a data center or branch, to keep an offsite copy.
• Single-file restore: Pulling a specific file from a backup without restoring the whole machine.

Important setup tips

1. Separate hardware: Don’t run PBS as a virtual machine on the same cluster it backs up; if the cluster fails, the backups become unavailable too.
2. The right disks: Because data is split into many small chunks, disk performance matters a lot. SSDs greatly improve backup, verify and restore speed; with regular hard drives, expect lower speeds.
3. Connecting to Proxmox VE: Under Datacenter > Storage, add a storage of type Proxmox Backup Server with the server address, datastore name, user account and fingerprint. Create a user or API token with the minimum required permissions for this connection, not the root account.
4. Retention policy: Set the number of copies in a Prune Job with options such as keep-last, keep-daily, keep-weekly and keep-monthly.
5. Garbage Collection: Deleting a copy with Prune does not free space immediately. The garbage collection job removes unused chunks and must be scheduled.
6. Scheduled Verify: Schedule verification for off-peak hours.

Keep the backup encryption key separate from your Proxmox servers. Without this key, encrypted backups cannot be restored, even by you.

PBS security

• Place the PBS server on a separate management network and restrict access to its web interface.
• Enable two-factor authentication for admin accounts.
• Set the permissions of the account Proxmox VE uses to send backups so it cannot delete backup copies.
• Keep one copy on a second PBS via Sync, or on offline media, so a breach of one server does not affect all your backups.

Checklist

• PBS is installed on hardware separate from the main cluster.
• Prune, Garbage Collection and Verify are scheduled.
• Proxmox VE connects with a least-privilege account.
• The encryption key is stored in a safe, separate place.
• One copy of the backups is on a second PBS or offsite.
• Both full VM restore and single-file restore have been tested.

PBS is a powerful, cost-effective tool for Proxmox environments, as long as it is designed and monitored properly. ITPlus724 engineers can deploy and configure PBS for your company’s infrastructure and integrate it with your current environment.