Proxmox Backup Server 3.2.13 → 3.3.6
8 releases · 2 breaking changes · 2 security fixes · 0 advisories fixed
2security2breaking0deprecated48feature13fix
Breaking changes
- breaking fix #3336: datastore: remove group if the last snapshot is removed to avoid confusing situations where the group directory still exists and blocks re-creating a group with another owner even though the empty group was not visible in the web UI. in 3.3.5
- breaking Improvements to Secure Boot management. With the need to update the revocation database embedded in the shim boot loader, some edge-cases were discovered and improved in the proxmox-secure-boot metapackage. Ship an apt pinning snippet to ensure that Proxmox provided packages are installed, even if… in 3.3
Security changes
- security api: datastore list: move checking if a datastore is mounted after we ensured that the user may actually access it. While this had no effect security wise, it could significantly increase the cost of this API endpoint in big setups with many datastores and many tenants that each have only access… in 3.3.3
- security Fix a RCE vulnerability in the shim bootloader used for Secure Boot support. See PSA-2024-00007-1 for details. in 3.3
Every release in between
3.3.6 Apr 3, 2025
otherdatastore: ignore group locking errors when removing snapshots, they normally happen only due to old-locking, and the underlying snapshot is deleted in any case at this point, so it's no help to confuse the user.
featureapi: datastore: add error message on failed removal due to old locking and tell any admin what they can do to switch to the new locking.
featureui: only add delete parameter on token edit, not when creating tokens.
featurepbs-client: allow reading fingerprint from system credential.
otherdocs: client: add section about system credentials integration.
3.3.5 Apr 2, 2025
otherapi: config: use guard for unmounting on failed datastore creation
otherclient: align description for backup specification to docs, using archive-name and type over label and ext.
featureclient: read credentials from CREDENTIALS_DIRECTORY environment variable following the "System and Service Credentials" specification. This allows users to use native systemd capabilities for credential management if the proxmox-backup-client is used in systemd units or, e.g., through a wrapper…
fixfix #3935: datastore/api/backup: move datastore locking to '/run' to avoid that lock-files can block deleting backup groups or snapshots on the datastore and to decouple locking from the underlying datastore file-system.
fixapi: fix race when changing the owner of a backup-group.
breakingfix #3336: datastore: remove group if the last snapshot is removed to avoid confusing situations where the group directory still exists and blocks re-creating a group with another owner even though the empty group was not visible in the web UI.
featurenotifications: clean-up and add dedicated types for all templates as to allow declaring that interface stable in preparation for allowing overriding them in the future (not included in this release).
featuretape: introduce a tape backup job worker-thread option for restores. Depending on the underlying storage using more threads can dramatically improve the restore speed. Especially fast storage with low penalty for random access, like flash-storage (SSDs) can profit from using more worker threads.…
othergarbage collection: generate index file list via datastore iterators in a structured manner.
fixfix #5331: garbage collection: avoid multiple chunk atime updates by keeping track of the recently marked chunks in phase 1 of garbage to avoid multiple atime updates via relatively expensive utimensat (touch) calls. Use a LRU cache with size 32 MiB for tracking already processed chunks, this…
featurelogging helper: use new builder initializer – not functional change intended.
3.3.4 Mar 13, 2025
fixfix #6185: client/docs: explicitly mention archive name restrictions
otherdocs: using-the-installer: adapt to raised root password length requirement
otherdisks: wipe: replace dd with write_all_at for zeroing disk
fixfix #5946: disks: wipe: ensure GPT header backup is wiped
otherdocs: fix hash collision probability comparison
3.3.3 Feb 11, 2025
securityapi: datastore list: move checking if a datastore is mounted after we ensured that the user may actually access it. While this had no effect security wise, it could significantly increase the cost of this API endpoint in big setups with many datastores and many tenants that each have only access…
fixRevert "fix #5710: api: backup: stat known chunks on backup finish" due to a big performance impact relative to what this is protectign against. We will work out a more efficient fix for this issue in the future.
otherprune simulator: show backup entries that are kept also in the flat list of backups, not just in the calendar view.
otherdocs: improve the description for the garbage collection's cut-off time
otherpxar extract: correctly honor the overwrite flag
featureapi: datastore: add missing log context for prune to avoid a case where the worker state being unknown after it finished.
otherdocs: add synopsis and basic docs for prune job configuration
otherbackup verification: handle manifest update errors as non-fatal to avoid that the job fails, as we want to continue with verificating the rest to ensure we uncover as much potential problems as possible.
fixfix #4408: docs: add 'disaster recovery' section for tapes
fixfix #6069: prune simulator: correctly handle schedules that mix both, a range and a step size at once.
fixclient: pxar: fix a race condition where the backup upload stream can miss an error from the create archive function, because the error state is only set after the backup stream was already polled. This avoids a edge case where a file-based backup was incorrectly marked as having succeeded while…
3.3.2 Dec 10, 2024
fixfile-restore: fix regression with the new blockdev method used to pass disks of a backup to the isolated virtual machine.
3.3.1 Dec 3, 2024
featuretree-wide: add missing O_CLOEXEC flags to openat calls to avoid passing any open FD to new child processes which can have undesired side-effects like keeping a lock open longer than it should.
fixcargo: update proxmox dependency of rest-server and sys crates to include some fixes for open FDs and a fix for the active task worker tracking, as on failing to update the index file the daemon did not finished the worker, causing a reference count issue where an old daemon could keep running…
otherui: check that store is set before trying to select anything in the garbage collection (GC) job view.
featureLatest 6.8.12-4 Kernel as new stable default
featurePush direction for sync jobs. Sync jobs can already pull backup snapshots from remote Proxmox Backup Server instances. The new push direction allows copying backup snapshots from the local instance to remote instances. This can be useful in setups where the remote instance cannot initiate…
featureSupport for removable datastores. Datastores can now be created on removable media for offline storage. After unmounting the removable datastore, the medium can be removed. The datastore can be used on multiple Proxmox Backup Server instances.
featureWebhook target for the notification system. The new webhook notification target allows notification events to trigger HTTP requests. Request headers and body can be customized and can contain notification metadata. This allows users to push notifications to any target that supports webhooks.
featureNew change detection modes for speeding up file-based backups. Metadata and data of backup snapshots are now stored in two separate archives. Optionally, files that have not changed since the previous backup snapshot can be identified using the previous backup snapshot's metadata archive.…
featureAllow to set a consent banner that users must acknowledge before logging in (issue 5463). This can be required for compliance reasons. The banner supports Markdown and can be set in Configuration → Other → General → Consent Text.
featureColumns in the "Prune & GC Jobs" view are now sortable (issue 5422).
featureFix a short-lived regression where updating proxmox-backup-server without updating proxmox-widget-toolkit made the GUI inaccessible (issue 5503).
featureFix an issue where the "Change owner" dialog would not accept usernames shorter than 8 characters (issue 5861).
featureDisallow creating a datastore on / via the GUI, as this is most likely unintended.
featureFix an issue where clicking on an external link to the GUI would display a login screen, even if the current session was still valid.
featureShow only installed services in the node's system panel by default, but optionally allow showing all services (issue 5611).
featureRight-align numbers in the S.M.A.R.T. values table (issue 5831).
featureFix an issue where the installed Proxmox Backup Server version was incorrectly rendered with a hyphen instead of a dot.
featureImproved translations, among others:
featureBulgarian (NEW!)
featureArabic
featureFrench
featureGerman
featureItalian
featureJapanese
featureRussian
featureSpanish
featureTraditional Chinese
featurePush direction for sync jobs (issue 3044). Sync jobs can already pull backup snapshots from remote Proxmox Backup Server instances. The new push direction allows copying backup snapshots from the local instance to remote instances. This can be useful in setups where the remote instance cannot…
featurePull sync jobs can now optionally resync corrupt chunks (issue 3786). When syncing a backup group from a remote, the sync job checks whether the last local snapshot has previously failed verification. If this is the case, the sync job overwrites the local snapshot with the remote snapshot. As the…
featureSupport for removable datastores. Datastores can now be created on removable media for offline storage. After unmounting the removable datastore in the GUI, the medium can be removed. The datastore can be used on multiple Proxmox Backup Server instances. Multiple datastores per device are also…
featureCheck for known but missing chunks when creating a new backup snapshot (issue 5710). Known chunks are chunks that are contained in the previous snapshot of the backup group. When creating a new backup snapshot, the list of known chunks is sent to the client, so the client can skip uploading known…
featureFix a regression where an early HTTP connection close could result in high CPU usage and denial-of-service (issue 5868). Early connection closes are used by some monitoring solutions performing health checks.
featureAllow reusing already-existing datastores, but disallow creating datastores in non-empty directories (issue 5439).
featureFix a regression that prevented legacy notifications for successful sync jobs.
featureFix an issue where a delayed TLS Client Hello would cause the API server to respond with a plain HTTP 400 "Bad Request" response (issue 5105).
featureAbort garbage collection if a nested datastore is encountered, as garbage collection cannot be done safely on nested datastores.
featureUpdate choices of cryptographic primitives:
featureCSRF tokens now use a standard HMAC construction.
featureMigrate to yescrypt for hashing passwords. Old hashes will be upgraded to the new scheme once a user logs in.
featureMigrate to Ed25519 for authentication tickets.
featureUse constant-time comparison for additional hardening against timing side-channels.
breakingImprovements to Secure Boot management. With the need to update the revocation database embedded in the shim boot loader, some edge-cases were discovered and improved in the proxmox-secure-boot metapackage. Ship an apt pinning snippet to ensure that Proxmox provided packages are installed, even if…
securityFix a RCE vulnerability in the shim bootloader used for Secure Boot support. See PSA-2024-00007-1 for details.
+69 more items in the release notes3.2.14 Nov 27, 2024
otherpull-sync: do not interpret older missing snapshots as needs-resync
otherapi: directory: use relative path when creating removable datastore
otherui: prune keep input: actually clear value on clear trigger click
fixui: datastore edit: fix empty-text for path field
othersync: push: pass full error context when returning error to job
otherapi: mount removable datastore: only log an informational message if the correct device is already mounted.
featureapi: sync: restrict edit permissions for the new push sync jobs to avoid that a user is able to create or edit sync jobs in push direction, but not able to see them.
fixapi: create datastore: fix checks to avoid that any datastore can contain another one to better handle the case for the new removable datastores.