Learn Proxmox Backup Server - ACL, User & Remote Access

#Introduction

Backup already extended to hosts and containers in episode 11 — now there is an operational question: who is allowed to access what. In real environments, PBS is not used by one person: infrastructure teams, application teams, even different tenants share the same server. Episode 12 builds ACL, user, and remote access that makes PBS both secure and easy to manage.

Imagine PBS like a leased office building: every tenant has its own floor (datastore), an access card (user/token) that only opens its floor, and different permission levels — some can store and retrieve, some can only view. The main building door (HTTPS) is guarded, and the back door (SSH) is not opened without a reason.

#Users & ACL per Tenant

#The Concept: User, ACL, and Role

PBS separates who (user) from what is allowed (ACL/role) and where (path). ACLs are attached to a specific path (e.g. /datastores/store1) with a specific role:

DatastoreAdmin: full control over the datastore — create/delete snapshots, change configuration.
DatastoreBackup: perform backup and restore (write and read data).
DatastoreReader: read/view only — suitable for audits.
Datastore.Modify: write without delete rights — for granular adjustments.

The user-per-tenant pattern: one user per team/tenant, with ACLs restricted to its own datastore.

#Creating Users and ACLs

Create the finance tenant user

proxmox-backup-manager user create finance@pbs --password 'fin-strong-pass'

Grant backup rights on the finance datastore

proxmox-backup-manager acl update \
  /datastores/finance finance@pbs DatastoreBackup

finance@pbs can now backup/restore on /datastores/finance, but cannot see other datastores. With namespaces (episode 11), granularity can be even finer: /datastores/store1/finance separates tenants within a single physical datastore.

Note

ACL roles do not automatically inherit from each other: DatastoreReader cannot upgrade itself. Design minimal roles — give DatastoreBackup to operational teams, DatastoreReader to auditors, and keep DatastoreAdmin only for infrastructure admins.

#API Tokens for Integration

User passwords are for humans; API tokens are identities for machines (PVE, sync jobs, scripts). Tokens inherit their user's ACL permissions and can be revoked at any time without changing the user password:

Create an API token for the finance user

proxmox-backup-manager api-token create finance@pbs pve-backup --privsep

--privsep (privilege separation) limits the token to only the operations needed. Tokens are shown only once — save it immediately. In PVE, this token is used when registering PBS as storage (episode 4) in place of the password:

Use the token in pvesm

pvesm add pbs pbs1 --server 10.0.1.10 --datastore finance \
  --username finance@pbs --password 'pbs-token=...' --fingerprint AA:BB:...

Warning

Do not use the root@pam user with a full-access token for all integrations. One token per consumer (PVE cluster, sync job, CI script) makes audit and revoke easy — if one consumer is compromised, you revoke its token without touching the others.

#Secure Remote Access

#Web UI Only via HTTPS

The PBS web UI is HTTPS-native on port 8007 with a configurable certificate. For production:

Use a valid certificate (Let's Encrypt/ACME or an internal PKI) — not the default self-signed — so clients do not have to bypass certificate warnings. Details in episode 13.
Restrict web UI access with a firewall to the management network only.
Enable 2FA for admin users if many admins hold credentials.

#SSH Should Not Be Opened Without a Need

This rule is often ignored: PBS SSH does not need to be open to the world. Daily PBS administration goes through the web UI/API. If SSH is truly needed:

Restrict source IPs to the management network (AllowUsers in sshd_config).
Use key-based auth — disable password login.
Disable SSH in the firewall (UFW) by default.

Restrict SSH in sshd_config

PermitRootLogin prohibit-password
PasswordAuthentication no
AllowUsers ops@10.0.0.0/24

After changing the configuration, restart sshd and test the connection — do not close an active session before confirming new connections work.

#Closing

Key takeaways:

PBS separates user, path (ACL), and role: DatastoreBackup, DatastoreReader, DatastoreAdmin.
The user-per-tenant pattern + per-datastore ACL keeps isolation between teams/tenants.
API tokens (--privsep) are identities for machines; one token per consumer, easy to revoke.
Use the token in pvesm add pbs instead of the user password.
The web UI is only reachable via HTTPS with a valid certificate; the firewall restricts access.
SSH is opened only when needed, restricted by source IP, and uses key-based auth.

In the next episode, episode 13, we will harden the network: network isolation & firewall — separating the storage VLAN, limiting port 8007 access to PVE nodes only with UFW, and managing TLS certificates (Let's Encrypt/PKI) complete with fingerprint verification on the client side. Backups are the most valuable data in your network!