Learn Proxmox Backup Server - Installation & Initial Configuration

#Introduction

You understood the architecture in episode 2 — now it is time to build. Episode 3 is the moment concepts turn into a real server: you install PBS 4.2, configure the network, create the first datastore, and get to know the user and realm system. From here on, all the practical episodes run on the server you build yourself.

Think of this process like building a bank vault: the building structure (installation), the storage room (datastore), and the access card system (users & realms). If the foundation or the vault layout is wrong, it is hard to fix after it is full of money.

#Installation

#ISO Installer

The easiest and most recommended way is the ISO installer for PBS 4.2. Boot from the ISO and follow the wizard:

Choose the language, time zone, and country.
Set the hostname (e.g. pbs1.example.local) and a static IP — do not use DHCP for production.
Choose the disk and filesystem for root: use ZFS (mirror/raidz) or ext4+xfs; ZFS is the recommended default.
Set the root password and email for notifications.

#Apt Repository

PBS can also be installed on top of an existing Debian. Add the official repository then install the proxmox-backup-server package:

Add the official PBS repository

echo "deb https://enterprise.proxmox.com/debian/pbs bookworm pbs-enterprise" > /etc/apt/sources.list.d/pbs-enterprise.list
apt update && apt install proxmox-backup-server

Note: the enterprise repository requires a subscription; for trials use the no-subscription repository (pbs-no-subscription), which is available without a license. After installation, the proxmox-backup service is automatically active.

#Network and Web UI Configuration

Set a static IP via /etc/network/interfaces (or netplan), and make sure the hostname is resolvable. Verify access:

Check the web UI and version

curl -kI https://localhost:8007
proxmox-backup-manager versions

If curl -kI returns HTTP/1.1 200, the PBS web UI is up on port 8007. Open https://IP-PBS:8007 in a browser and log in as user root@pam with the password set during installation.

Warning

PBS is a server that manages backup data — give it a static IP, not DHCP. A changing IP will break PVE client connections, sync jobs, and API accounts that reference the server address. Note the IP and hostname before continuing.

#Creating a Datastore

#Path, GC Schedule, and Verify Schedule

The datastore is the core of storage. Create its folder then register it in PBS:

Create the datastore folder

mkdir -p /var/lib/proxmox-backup/datastore/store1

proxmox-backup-manager datastore create store1 \
  /var/lib/proxmox-backup/datastore/store1 \
  --gc-schedule "sun 02:00" --verify-new

--gc-schedule "sun 02:00" schedules garbage collection every Sunday at 02:00, and --verify-new automatically verifies new snapshots. The schedule can be edited any time via the web UI (Datastore → Options) or proxmox-backup-manager datastore update.

After the datastore is created, PBS displays key metrics in the web UI: size (raw storage), original (data size before dedup), deduplication, and compressed — explained in episode 6.

#Users and Realms

#PAM: Local System Users

The PAM realm uses PBS's Linux system users. The root@pam user is created during installation. For additional users, create a system account then map it to PBS:

Create a PAM user

adduser operator
proxmox-backup-manager user create operator@pam

#AD/LDAP and the Proxmox VE Realm

The AD/LDAP realm connects PBS to your company's directory service so authentication is centralized. For environments that are entirely Proxmox-based, the Proxmox VE realm lets PVE users use the same account in PBS without duplicate users. Realm configuration is done in the web UI: Administration → Authentication → Realms → Add.

The realm choice determines where credentials are verified: PAM on the local system, AD/LDAP on the directory server, and the Proxmox VE realm on the PVE cluster. For this series we use PAM to stay focused on the concepts, then episode 12 covers per-tenant users and ACLs.

#Creating the First User

Create a backup user that the PVE client will use later:

Create the backup@pam user

proxmox-backup-manager user create backup@pam --password "secret123"

Note

For production, the backup user should ideally be used through an API token (instead of a direct password) — tokens can be rotated and have limited permissions. We build that in episode 12 together with per-datastore ACLs.

#Closing

Key takeaways:

Install PBS 4.2 via the ISO installer (choose disk & ZFS) or the apt repository on Debian.
Set a static IP and hostname; the web UI is active at https://IP:8007.
A datastore is the folder where all chunks live; create it with proxmox-backup-manager datastore create.
Schedule GC (--gc-schedule) and verification (--verify-new) from the start — not later.
The realm determines the authentication source: PAM (local), AD/LDAP (directory), or Proxmox VE.
The backup@pam user is the starting point for client integration.

In the next episode, episode 4, we will back up VMs/CTs from Proxmox VE — registering PBS as storage in the PVE datacenter with the server, datastore, and fingerprint, choosing the backup target, setting the backup mode (guest agent/snapshot/suspend/stop), and scheduling regular backups. Your VMs will start being protected!