This patch prints the source of the encryption key when running
operations with proxmox-backup-client.
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Currently if you generate a default encryption key:
`proxmox-backup-client key create --kdf none`
all backup operations which don't explicitly disable encryption will be
encrypted with this key.
I found it quite surprising, that my backups were all encrypted without
me explicitly specfying neither key nor encryption mode
This patch informs the user when the default key is used (and no
crypt-mode is provided explicitly)
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
when authenticating a token, and not just when authenticating a
user/ticket.
Reported-By: Dominik Jäger <d.jaeger@proxmox.com>
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
sd_notify is not synchronous, iow. it only waits until the message
reaches the queue not until it is processed by systemd
when the process that sent such a message exits before systemd could
process it, it cannot be associated to the correct pid
so in case of reloading, we send a message with 'MAINPID=<newpid>'
to signal that it will change. if now the old process exits before
systemd knows this, it will not accept the 'READY=1' message from the
child, since it rejects the MAINPID change
since there is no (AFAICS) library interface to check the unit status,
we use 'systemctl is-active <SERVICE_NAME>' to check the state until
it is not 'reloading' anymore.
on newer systemd versions, there is 'sd_notify_barrier' which would
allow us to wait for systemd to have all messages from the current
pid to be processed before acknowledging to the child, but on buster
the systemd version is to old...
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
Without hyphens, we had 20 hex digits, so ~80 bit which is probably overkill.
Use 12 (13 with hyphen), this is still 48 bit.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
this was mostly selected by executing
and adding those with more than a hand full of commits, so no hard
feelings here, this was definitively also a team effort to get stuff
polished!
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
add missing help buttons (question mark, top right) so that we are
consistent and each panel has it.
I chose the IMHO most fitting sections.
Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
The space between '--' and 'path' in two of the commands was wrong. The other
changes make the names of the store and token consistent with the rest of the
section and should improve readability.
Also add the Datastore.Verify permission in the output of the command:
proxmox-backup-manager user permissions john@pbs --path /datastore/store1
A DatastoreAdmin now has this permission and that's what john@pbs is in the
example.
Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
its rather hacky, but our cbind mixin does not support columns (yet).
if it does sometime in the future, we could use that instead
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
log invalid owners to system log, and continue with next group just as
if permission checks fail for the following operations:
- verify store with limited permissions
- list store groups
- list store snapshots
all other call sites either handle it correctly already (sync/pull), or
operate on a single group/snapshot and can bubble up the error.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Further clarify that the paperkey should be a last resort
recovery option, after a password manager and usb drive.
Signed-off-by: Dylan Whyte <d.whyte@proxmox.com>
for more useful log output
old:
Nov 10 11:50:51 foo pvestatd[3378]: proxmox-backup-client failed: Error: error trying to connect: tcp connect error: No route to host (os error 113)
new:
Nov 10 11:55:21 foo pvestatd[3378]: proxmox-backup-client failed: Error: error trying to connect: error connecting to https://thebackuphost:8007/ - tcp connect error: No route to host (os error 113)
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
added a few more help buttons were appropriate:
* GC and Prune schedule windows
* Create Directory window
* API Tokens, link directly to token section
* verify jobs window
Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
This is a temporary hack until we find a sensible way to scan the
proxmox-widget-toolkit JS files as well.
Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
Stoiko Ivanov
Oguz Bektas
Dominik Csapak
Fabian Grünbichler
Thomas Lamprecht
Wolfgang Bumiller
Aaron Lauterer
Fabian Ebner
Dylan Whyte
Dietmar Maurer