CRITICAL FIX: Added robust newline stripping as a defensive measure
when writing passwords to the config file.
The Problem:
Even though prompt_password() was fixed to output to stderr, the
newline was still somehow getting into the PBS_PASSWORD variable
in some cases, causing the config file to be malformed.
The Solution (Defense in Depth):
Before writing PBS_PASSWORD to config file, explicitly strip all
newline and carriage return characters:
PBS_PASSWORD_CLEAN=$(echo -n "$PBS_PASSWORD" | tr -d '\n\r')
This ensures the password is always clean, regardless of how it
was captured or what's in the original variable.
Changes:
- pbs-client-installer.sh:
- Line 298: Added newline filter in reconfigure_connection()
- Line 593: Added newline filter in create_systemd_service()
- Both use: tr -d '\n\r' to remove \n and \r characters
CHANGELOG.md:
- Updated to document defensive filtering approach
- Lists both functions that apply the filter
This is a belt-and-suspenders approach: we fix the source
(prompt_password) AND filter at write time for maximum safety.
Impact:
Config file will now ALWAYS have single-line passwords, even if
something goes wrong with password capture. This prevents the
"authentication failed - invalid credentials" error in the
backup service.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
User Experience Improvements:
1. Changed Default Realm from "pbs" to "pam"
- "pam" is the standard realm for root authentication
- More intuitive for most users
- Matches common Proxmox setup patterns
2. Changed Default Encryption from "yes" to "no"
- Removes friction for quick testing and setup
- Users can easily opt-in during configuration
- Reduces complexity for basic backup scenarios
- Advanced users still have the option available
3. Added "Run backup now" to Main Menu
- New option 4 in the existing configuration menu
- Allows immediate backup testing without reconfiguration
- Starts backup service and offers to follow logs
- Provides helpful commands if backup fails
- Makes it easy to test backups after setup
Changes:
- pbs-client-installer.sh:
- Line 265, 349: PBS_REALM default changed to "pam"
- Line 462: ENABLE_ENCRYPTION default changed to "no"
- Lines 895-939: Added option 4 "Run backup now" with log following
- Shifted "Exit" from option 4 to option 5
CHANGELOG.md:
- Documented all three changes in "Changed" section
- Highlighted default changes in bold
This makes the installer more user-friendly for the common case
(root@pam authentication, no encryption for testing) while still
supporting advanced configurations.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
CRITICAL BUG FIX: The prompt_password() function was capturing a newline
character along with the password/token, causing the config file to have
malformed multi-line password values.
The Problem:
- prompt_password() used `echo` to print a newline after password input
- This echo was captured by command substitution: PBS_PASSWORD=$(prompt_password ...)
- Config file ended up with:
PBS_PASSWORD="
actual-token-here"
- PBS client couldn't authenticate with the malformed password
- Error: "authentication failed - invalid credentials"
The Fix:
- Changed `echo` to `echo >&2` (output to stderr)
- Stderr is not captured by command substitution
- Only the actual password is captured and stored
- Config file now correctly has: PBS_PASSWORD="actual-token-here"
File Changed: pbs-client-installer.sh
- Line 54: echo >&2 # Output newline to stderr so it doesn't get captured
CHANGELOG.md Updated:
- Documented as CRITICAL fix
- Explains the authentication failure in backup service
- Notes config file formatting fix
Impact:
- Connection test passed but backup service failed with auth error
- This affected both password and API token authentication
- Backups would fail silently on scheduled runs
- Now fixed: backups will authenticate correctly
Testing:
User should run installer again and the backup service will now work.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
DOCUMENTATION UPDATE: Added detailed step-by-step guide covering the
entire installation process from PBS server setup to completion.
README.md Changes:
Prerequisites Section (Expanded):
- How to create API tokens in PBS web interface
- How to configure datastore permissions
- Common permission error and how to fix it
- Information gathering checklist before running installer
New: Step-by-Step Walkthrough (14 Steps):
1. Running the installer
2. PBS server configuration (IP, port, datastore)
3. Authentication method selection (why API tokens)
4. Entering API token details
5. Backup type selection (files/block/hybrid)
6. File backup paths configuration
7. Block device selection and auto-detection
8. Backup schedule configuration
9. Retention policy settings
10. Encryption setup and key management
11. 3-step connection test process
12. Systemd service creation
13. Optional immediate backup
14. Completion summary
Each step includes:
- Example prompts and responses
- Explanation of options
- Recommendations and best practices
- Common device types and their paths
- Troubleshooting tips
CHANGELOG.md Updates:
- Documented new comprehensive walkthrough
- Listed PBS server setup documentation
- Added permission error troubleshooting to Added section
This addresses the most common user questions and provides a
complete reference for first-time users. Users can now follow
the guide step-by-step to successfully configure PBS backups.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
CRITICAL FIX: The PBS client was waiting for interactive SSL
certificate fingerprint confirmation, causing the installer to
timeout during authentication testing.
Changes to pbs-client-installer.sh:
- Authentication test now pipes 'y' to auto-accept SSL fingerprints
- Displays accepted fingerprint in logs for transparency
- Added SSL certificate issues to error troubleshooting
- References new test-connection.sh script in error messages
New file: test-connection.sh
- Parameterized diagnostic script for testing PBS connections
- No hardcoded credentials (security best practice)
- Handles SSL fingerprint acceptance interactively
- Tests all 3 steps: reachability, auth, datastore access
- Provides detailed error messages and guidance
- Usage examples for both password and API token auth
Updated CHANGELOG.md:
- Documented SSL fingerprint auto-acceptance as critical fix
- Listed all improvements since v1.0.0
- Highlighted test-connection.sh script addition
Updated README.md:
- Added comprehensive troubleshooting section
- Documented test-connection.sh usage with examples
- Explained 3-step connection verification process
- Added SSL fingerprint handling instructions
- Clarified timeout values for each step
This resolves the "authentication hanging" issue where the login
command was waiting indefinitely for user input on SSL fingerprint
confirmation.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Document the fix for using correct PBS client commands
(login instead of non-existent status command)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
The issue was using 'proxmox-backup-client status' which doesn't exist.
Changes:
- Use 'proxmox-backup-client login' for authentication testing
(This is the proper command to test credentials)
- Use 'proxmox-backup-client list' instead of 'snapshot list'
(Simpler command to verify datastore access)
- Reduced timeouts from 30s to 15s (these commands are faster)
- Added debug output showing the repository string being used
- Improved error message display from PBS client
This should resolve authentication timeouts and actually show
real error messages when credentials are invalid.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Block Device Detection:
- Strip btrfs subvolume notation [/@] from detected device path
- Validate detected device before showing it as default
- Show available block devices when invalid device is entered
- Better error messages for device detection issues
Connection Test Improvements:
- 3-step verification process for better diagnostics:
1. Server reachability test (5s timeout with curl)
2. Authentication test with 'status' command (30s timeout)
3. Datastore access verification (optional)
- Step-by-step feedback shows exactly where the failure occurs
- More specific error messages based on failure point
- Shows actual PBS client errors when authentication fails
- Succeeds if authentication works, even if snapshot list fails
(normal when no backups exist yet)
This resolves:
- Invalid device paths like /dev/mapper/root[/@]
- Connection timeouts that were actually authentication issues
- Better user experience with clear progress indicators
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Added:
- CHANGELOG.md following Keep a Changelog format
- Documented all changes from v1.0.0 to current unreleased version
- README section explaining reconfiguration options
- Enhanced troubleshooting section with connection test details
The CHANGELOG documents:
- Reconfiguration feature for existing installations
- Connection test timeout and improved error messages
- Installation method change from wget to git clone
The README now clearly explains:
- How to reconfigure existing installations
- Connection-only vs full reconfiguration options
- Use cases for quick connection updates
- Connection test timeout behavior and error types
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
The connection test now:
- Has a 30-second timeout to prevent indefinite hanging
- Shows "This may take up to 30 seconds..." message
- Differentiates between timeout (unreachable) and auth errors
- Provides specific troubleshooting steps based on error type
- Displays helpful commands for diagnosing connection issues
This fixes the issue where the script would hang indefinitely
when the PBS server was unreachable.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
When PBS client is already installed, the script now offers:
- Reconfigure connection only (server/credentials) - quick option
- Full reconfiguration (all settings)
- Reinstall PBS client and reconfigure
- Exit without changes
The connection-only reconfiguration preserves all backup settings
(paths, schedules, retention) and only updates PBS server details
and credentials. This is useful when switching backup servers or
updating authentication tokens.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Replace wget command with git clone for better version control
and easier updates. The previous wget URL was also malformed.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Added a comprehensive quick start guide for installing and configuring the PBS client, including installation commands, setup instructions, and troubleshooting tips.
Expanded README with detailed installation instructions, usage examples, troubleshooting tips, and security considerations for the PBS Client Installer.
