Proxmox Backup Server 3.3.6 → 3.4
2 releases · 1 breaking change · 1 security fix · 0 advisories fixed
1security1breaking0deprecated41feature3fix
Breaking changes
- breaking fix #4382: api: access control: remove permissions of token on deletion. in 3.3.7
Security changes
- security Several vulnerabilities in GRUB that could be used to bypass SecureBoot were discovered and fixed (PSA-2025-00005-1) The Documentation for SecureBoot now includes instructions to prevent using vulnerable components for booting via a revocation policy. in 3.4
Every release in between
featureLatest 6.8.12-9 Kernel as new stable default
featurePerformance improvements for garbage collection. Garbage collection frees up storage space by removing unused chunks from the datastore. For this, it has to mark all chunks that are currently in use by backup snapshots. The marking phase now uses a cache to avoid redundant marking operations. This…
featureMore fine-grained control over backup snapshot selection for sync jobs. Sync jobs are useful for pushing or pulling backup snapshots to or from remote Proxmox Backup Server instances. Group filters already allow selecting which backup groups should be synchronized. In addition, it is now possible…
featureStatic build of the Proxmox Backup command-line client. Proxmox Backup Server is tightly integrated with Proxmox VE, but its command-line client can also be used outside Proxmox VE. Packages for the command-line client are already provided for hosts running Debian or Debian derivatives. A new…
featureLatest Linux 6.14 kernel available as opt-in kernel.
featureAllow configuring a default realm which will be pre-selected in the login dialog (issue 5379).
featureThe prune simulator now allows specifying schedules with both range and step size (issue 6069).
featureEnsure that the prune simulator shows kept backups in the list of backups.
featureFix an issue where the GUI would not fully load after navigating to the "Prune & GC Jobs" tab in rare cases.
featureDeleting the comment of an API token is now possible.
featureVarious smaller improvements to the GUI.
featureFix some occurrences where translatable strings were split, which made potentially useful context unavailable for translators.
featurePerformance improvements for garbage collection (issue 5331). Garbage collection frees up storage space by removing unused chunks from the datastore. For this, its first phase updates the atime (access time) of all chunk files that are currently in use by backup snapshots. The marking phase now…
featureAdd a safeguard against filesystems that do not honor atime updates (issue 5982). The first phase of garbage collection marks used chunk files by explicitly updating their atime. If the filesystem backing the chunk store does not honor such atime updates, phase two may delete chunks that are still…
featureAllow to customize the atime cutoff for garbage collection in the datastore's tuning options. The atime cutoff defaults to 24 hours and 5 minutes, as a safeguard for filesystems that do not always immediately update the atime. However, on filesystems that do immediately update the atime, this can…
featureAllow to generate a new token secret for an API token via the API and GUI (issue 3887).
featureRevert a check for known but missing chunks when creating a new backup snapshot (reverts fix for issue 5710). This check was introduced in Proxmox Backup Server 3.3 to enable clients to re-send chunks that disappeared. However, the check turned out to not scale well for large setups, as reported…
featureEnsure proper unmount if the creation of a removable datastore fails.
featureRemove a backup group if its last backup snapshot is removed (issue 3336). Previously, the empty backup group persisted with the previous owner still set. This caused issues when trying to add new snapshots with a different owner to the group.
featureDecouple the locking of backup groups, snapshots, and manifests from the underlying filesystem of the datastore (issue 3935). Lock files are now created on the tmpfs under /run instead of the datastore's backing filesystem. This can also alleviate issues concerning locking on datastores backed by…
featureEnsure that permissions of an API token are deleted when the API token is deleted (issue 4382).
featureEnsure that chunk files are inserted with the correct owner if the process is running as root.
featureFix an issue where prune jobs would not write a task log in some cases, causing the tasks to be displayed with status "Unknown".
featureWhen listing datastores, parse the configuration and check the mount status after the authorization check. This can lead to performance improvements on large setups.
featureImprove the error reporting by including more details (for example the errno) in the description.
featureEnsure that "Wipe Disk" also wipes the GPT header backup at the end of the disk (issue 5946).
featureEnsure that the task status is reported even if logging is disabled using the PBS_LOG environment variable.
featureFix an issue where proxmox-backup-manager would write log output twice.
featureFix an issue where a worker task that failed during start would not be cleaned up.
featureFix a race condition that could cause an incorrect update of the number of current tasks.
featureIncrease the locking timeout for the task index file to alleviate issues due to lock contention.
featureFix an issue where verify jobs would be too eagerly aborted if the manifest update fails.
featureFix an issue where file descriptors would not be properly closed on daemon reload.
featureFix an issue where the version of a remote Proxmox Backup Server instance was checked incorrectly.
featureStatic build of the Proxmox Backup command-line client (issue 4788). Proxmox Backup Server is tightly integrated with Proxmox VE, but its command-line client can also be used outside Proxmox VE. Packages for the command-line client are already provided for hosts running Debian or Debian…
featureAllow to read passwords from credentials passed down by systemd. Examples are the API token secret for the Proxmox Backup Server, or the password needed to unlock the encryption key.
featureImprovements to the vma-to-pbs tool, which allows importing Proxmox Virtual Machine Archives (VMA) into Proxmox Backup Server:
featureOptionally read the repository or passwords from environment variables, similarly to proxmox-backup-client.
featureAdd support for the --version command-line option.
securitySeveral vulnerabilities in GRUB that could be used to bypass SecureBoot were discovered and fixed (PSA-2025-00005-1) The Documentation for SecureBoot now includes instructions to prevent using vulnerable components for booting via a revocation policy.
+22 more items in the release notes3.3.7 Apr 5, 2025
fixfix #5982: garbage collection: add a check to ensure that the underlying file system supports and honors file access time (atime) updates. The check is performed once on datastore creation and on start of every garbage collection (GC) task, just to be sure. It can be disabled in the datastore…
othergarbage collection: support setting a custom access time cutoff, overriding the default of one day and five minutes.
otherui: expose flag for GC access time support safety check and the access time cutoff override in datastore tuning options.
otherdocs: describe rationale for new GC access time update check setting and the access time cutoff check in tuning options.
featureaccess control: add support to mark a specific authentication realm as default selected realm for the login user interface.
breakingfix #4382: api: access control: remove permissions of token on deletion.
fixfix #3887: api: access control: allow users to regenerate the secret of an API token without changing any existing ACLs.
fixfix #6072: sync jobs: support flags to limit sync to only encrypted and/or verified snapshots.
featureui: datastore tuning options: expose overriding GC cache capacity so that admins can either restrict the peak memory usage during GC or allow GC to use more memory to reduce file system IO even for huge (multiple TiB) referenced data in backup groups.
otherui: datastore tuning options: increase width and rework labels to provide a tiny bit more context about what these options are.
otherui: sync job: increase edit window width to 720px to make it less cramped.
otherui: sync job: small field label casing consistency fixes.