If you use Proxmox VE, the most natural choice for backups is Proxmox's own product, Proxmox Backup Server (PBS). It's an open-source, free-to-use enterprise backup solution that integrates fully with Proxmox VE. In this post we cover Proxmox Backup Server installation from scratch: choosing hardware, installing, creating a datastore, connecting to Proxmox VE, retention policies, restores and off-site copies. If you just moved from VMware, this is a good follow-up to our migrate VMware ESXi to Proxmox post.
What Is Proxmox Backup Server and Why Use It?
PBS is a backup server built to back up virtual machines, containers and physical Linux servers. Its real strength is this: it splits data into small chunks and stores each chunk only once. So 30 days of backups don't take as much space as 30 full copies; only the changed parts are added. Compared to backing up to an NFS share with vzdump, Proxmox VE's classic backup tool, the difference is huge:
| Feature | vzdump + NFS / local disk | Proxmox Backup Server |
|---|---|---|
| Incremental backups | No, full backup every time | Yes, only changed blocks are sent |
| Deduplication | No | Yes, across all backups |
| Encryption | No (needs to be done on the storage side) | Client-side AES-256 encryption |
| Backup verification | Manual | Scheduled verify jobs |
| Single file restore | Tedious | Pick and download files from the UI |
| Off-site copy | With seperate tools | Built-in sync jobs |
| Disk usage | High | Much lower |
At the time of writing the current release is PBS 4.2; it's based on Debian 13 "Trixie" and since 4.0 it can also use S3-compatible object storage as a datastore.
Hardware Requirements
| Use | CPU | RAM | Disk |
|---|---|---|---|
| Evaluation / testing | 2 cores | 2 GB | 8 GB+ |
| Small environment | 4 cores | 8 GB | Redundant OS disk + SSD or HDD datastore |
| Production | 4+ cores | 4 GB + 1 GB per TB of storage | 32 GB+ redundant OS disk, enterprise SSD datastore |
Don't forget the RAM rule: 4 GB for the OS and services, plus at least 1 GB per TB of backup space. For a 20 TB datastore, 24 GB of RAM is a reasonable target. Since PBS works with lots of small files, SSDs make a big difference; if you use HDDs, adding a small SSD "special device" for metadata in ZFS cuts garbage collection and verify times a lot. We explained the difference between disk technologies in our what is NVMe post.
Step 1: Installation
Option A: Install from ISO (Recommended)
Download the PBS ISO from Proxmox's download page, write it to a USB stick and boot the server from it. The installer is almost the same as Proxmox VE's: disk selection (if you have two disks, choose ZFS RAID1 for the OS), time zone, root password, email and network settings. A few minutes later the server is ready.
Option B: Install on Top of Debian 13
If you already have Debian 13 installed, you can install PBS as a package:
wget https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg \
-O /usr/share/keyrings/proxmox-archive-keyring.gpg
sha256sum /usr/share/keyrings/proxmox-archive-keyring.gpg # compare the output with the value in the official docs
cat > /etc/apt/sources.list.d/pbs.sources <<'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF
apt update
apt install -y proxmox-backup-serverStep 2: Web UI and Updates
Go to https://SERVER_IP:8007 in your browser and log in as root (Linux PAM). If you installed from ISO, the enterprise repository that requires a subscription is enabled by default. If you don't have a subscription, disable the enterprise repo and add the No-Subscription repo under Administration → Repositories, then update the system from the Updates section.
Step 3: Disks and Datastore
A datastore is where backups are kept. In the UI, go to Administration → Storage / Disks → ZFS → Create: ZFS, pick the disks and tick "Add as Datastore". You can do the same from the command line:
proxmox-backup-manager disk list
# create a ZFS mirror from two disks and add it as a datastore
proxmox-backup-manager disk zpool create store1 --devices sdb,sdc \
--raidlevel mirror --add-datastore true
# or turn an existing directory into a datastore
proxmox-backup-manager datastore create store1 /mnt/datastore/store1Pick a redundant layout like mirror (RAID1) or raidz2 for the backup disks; a single-disk backup server means losing all backups when that disk dies.
Step 4: Backup User and Fingerprint
Instead of connecting Proxmox VE to PBS with the root account, use a seperate user that only has backup rights. Create a user named backup@pbs with a strong password under Configuration → Access Control → User Management, then set the permission and get the certificate fingerprint:
# give backup@pbs backup permission on this datastore only
proxmox-backup-manager acl update /datastore/store1 DatastoreBackup --auth-id backup@pbs
# get the certificate fingerprint you'll enter in Proxmox VE
proxmox-backup-manager cert info | grep -i fingerprintThe DatastoreBackup role lets the user create backups and restore its own backups, but not delete other backups. This makes it harder to wipe backups even if the Proxmox VE side gets compromised in an attack.
Step 5: Connect to Proxmox VE and Create a Backup Job
In the Proxmox VE UI choose Datacenter → Storage → Add → Proxmox Backup Server; enter the server address, the backup@pbs username and password, the datastore name and the fingerprint you got in the previous step. From the command line:
# on the Proxmox VE host: add PBS as storage (prompts for the password)
pvesm add pbs pbs1 --server 10.0.0.20 --datastore store1 \
--username backup@pbs --fingerprint 'AA:BB:CC:...' --password
# generate a client-side encryption key
pvesm set pbs1 --encryption-key autogenFinally, create a backup job with Datacenter → Backup → Add: choose the new PBS storage as the target, a schedule (e.g. every night at 01:00) and the VMs to back up. The first backup is a full one so it takes a while; later ones only send changed blocks and finish much faster.
Step 6: Retention, Cleanup and Verification
Deleting old backups in PBS happens in two stages: prune decides which backups are no longer kept, and garbage collection removes chunks that no backup uses anymore from disk. Verify jobs regularly check that backups aren't corrupted. All three need to be scheduled:
# retention policy: mark old backups
proxmox-backup-manager prune-job create daily-prune --store store1 --schedule daily \
--keep-last 3 --keep-daily 7 --keep-weekly 4 --keep-monthly 6
# remove the marked data from disk
proxmox-backup-manager datastore update store1 --gc-schedule daily
# weekly integrity check
proxmox-backup-manager verify-job create weekly-verify --store store1 --schedule weekly \
--ignore-verified true --outdated-after 30| Setting | Meaning | Example value |
|---|---|---|
keep-last | Keep the last N backups regardless of date | 3 |
keep-daily | One backup for each of the last N days | 7 |
keep-weekly | One backup for each of the last N weeks | 4 |
keep-monthly | One backup for each of the last N months | 6 |
keep-yearly | One backup for each of the last N years | 1–2 (as needed) |
With this example policy you get around 20 restore points spread over about 6 months, and thanks to deduplication that takes only a few times the size of a full backup.
Restoring
- Full VM restore: In Proxmox VE, click the PBS storage, pick the backup and hit Restore. With the live-restore option the VM can be started while the restore is still running.
- Single file restore: With File Restore you can browse inside a backup and download a single file or folder, no need to restore the whole VM.
- Test it: A backup that's never been restored is a backup that's never been proven to work. Restore a random VM to a test environment once a month.
The 3-2-1 Rule and Off-site Copies
A good backup strategy suggests 3 copies of the data, on 2 different media, with 1 in a different location. The easiest way to do this with PBS is to set up a second PBS and pull backups there with a sync job. On the second PBS, first add the main PBS under Configuration → Remotes (address, user, password, fingerprint), then create the sync job:
# on the second (remote) PBS: pull from the main PBS every day
proxmox-backup-manager sync-job create main-sync --remote main-pbs \
--remote-store store1 --store remote1 --schedule dailySince the remote PBS pulls the data itself, the main server can't delete the remote copy even if it's compromised. On top of that, PBS 4.x can use S3-compatible object storage as a datastore, and you can also back up to tape (LTO) libraries if you want.
Security Tips
- Open port 8007 only to your Proxmox VE servers and your management IP.
- Enable two-factor authentication (TOTP or WebAuthn) on the root account.
- Use a seperate user or API token for each Proxmox VE cluster and grant permissions per datastore.
- Turn on client-side encryption and keep the key somewhere else.
- Take the off-site copy with the pull method and don't give the main server access to the remote PBS.
Common Problems
| Symptom | Likely cause | Fix |
|---|---|---|
| "fingerprint" error in Proxmox VE | Wrong fingerprint or the certificate was renewed | Get the new fingerprint with cert info and update the storage settings |
| permission denied (403) | User has no permission on the datastore | Check the ACL and grant the needed role on the datastore path |
| Datastore is full | Prune runs but garbage collection doesn't | Check the GC schedule and start it manually once |
| Backups and GC are very slow | HDD datastore without metadata cache or a slow network | Add SSDs or a ZFS special device, check the network |
| Verify errors | Disk problem or corrupted chunk | Check disk health (SMART, zpool status), take a new backup of the affected VM |
Proxmox Backup Server with VECDC
In a small environment you can set up PBS yourself, but with many hosts, long retention and off-site copies, the right design matters alot. With our Proxmox Backup Server consulting service we do the setup together, from hardware choice and retention policies to off-site sync and restore tests. For the Proxmox VE side, check out our Proxmox consulting service too.
For a backup server, our dedicated servers are delivered within 24 hours. Since you can choose the location when ordering, you can easily meet the 3-2-1 rule by placing your off-site PBS in a different location from your main infrastructure. If you're new to Proxmox, our Proxmox vs VMware post may help as well.
Frequently Asked Questions
Is Proxmox Backup Server free?
Yes. Proxmox Backup Server is open source and can be used for free with all features. A paid subscription is optional for the tested enterprise update repository and official support; without one you get updates from the no-subscription repository.
Can Proxmox Backup Server be installed on the same server as Proxmox VE?
It's technically possible but not recommended. If the server breaks or gets hit by ransomware, the backups are lost too. Always keep backups on a seperate physical server, ideally with an additional second server in a different location.
Can Linux servers other than virtual machines be backed up?
Yes. With the proxmox-backup-client tool you can back up the file systems of physical Linux servers or ones running on other platforms to the same datastore, with the same deduplication and encryption features.
What happens if I lose the encryption key?
If you use client-side encryption, backups can't be restored without the key; nobody, including Proxmox, can open that data. That's why it's very important to keep the key and its paper backup somewhere safe outside the Proxmox VE cluster.
In Short
Proxmox Backup Server is a powerful solution that gives everyone running Proxmox VE incremental, deduplicated and encrypted backups for free. Install it on a seperate server, use redundant disks, connect with a dedicated backup user, schedule prune/GC/verify jobs and complete the 3-2-1 rule with an off-site copy. And don't skip restore tests. If you get stuck during setup, drop us a message, were happy to help.