{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/",
        "slug": "verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry",
        "url": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/"
        },
        "title": "Verify Proxmox Backup trust before accepting a PVE storage entry",
        "summary": "Keep self-signed certificate fingerprint verification, credential entry and storage status separate when integrating PBS with Proxmox VE.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "advisory",
            "name": "Advisory"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-29T17:41:00+00:00",
        "modified_at": "2026-10-29T17:41:38+00:00",
        "reviewed_on": "2026-10-29",
        "reading_minutes": 3,
        "word_count": 526,
        "potentially_affected": "Proxmox VE administrators adding Proxmox Backup Server storage through the documented integration.",
        "dse_recommendation": "Verify the intended server fingerprint through an approved channel, protect credentials and require recovery evidence beyond storage status.",
        "primary_source": {
            "name": "Proxmox — Proxmox VE Integration",
            "url": "https://pbs.proxmox.com/docs/pve-integration.html",
            "published_on": null,
            "authority": "pbs.proxmox.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p><strong>Bottom line:</strong> Confirm which backup server the PVE node is meant to trust before saving a fingerprint. Keep credential handling and the storage-status check distinct from a later demonstration that the intended backup can actually be recovered.</p>\n<h2>Source fact: what the authority says</h2>\n<p>The <a href=\"https://pbs.proxmox.com/docs/pve-integration.html\" target=\"_blank\" rel=\"noopener noreferrer\">Proxmox VE integration guide</a> adds PBS as storage of type <code>pbs</code> in Proxmox VE. Supplying <code>--password</code> without an argument causes the program to prompt, rather than placing the password in a literal argument. For a self-signed backup-server certificate, the guide requires the fingerprint in the configuration and obtains it on the backup server through <code>proxmox-backup-manager cert info</code>. The guide then checks the added storage with <code>pvesm status --storage</code> and says VM and container backups use the integrated storage.</p>\n<h2>What the source does not establish</h2>\n<p>The source’s storage-status example is not a completed restore test or a statement that an arbitrary supplied fingerprint is trustworthy. This article does not establish encryption-key recovery, retention protection or permission completeness for an existing deployment.</p>\n<h2>Applicability questions</h2>\n<ul>\n<li>What server and datastore are approved, and how is their identity independently established?</li>\n<li>Who can obtain the certificate fingerprint through trusted server access?</li>\n<li>Which credential and entry method are approved without exposing a password?</li>\n<li>What separate backup and recovery observations are needed before operational acceptance?</li>\n</ul>\n<h2>DSE recommendation: controlled next steps</h2>\n<p><em>The following steps are DSE recommendations based on the cited source.</em></p>\n<p>DSE recommends recording the intended server, datastore, PVE storage identifier and account as separate references. Obtain the expected fingerprint through an approved administrative channel and compare it with the value being configured. Do not accept a value copied from an unexplained connection warning as its own identity proof.</p>\n<p>Choose the documented password prompt when using the command-line workflow, and follow the organization’s credential-handling procedure. Keep the password out of tickets, example commands and screenshots. Have the account owner review its intended use without broadening permissions merely to obtain a successful status response.</p>\n<p>Preserve the storage configuration and the source of the fingerprint comparison. If the certificate changes later, investigate the reason and repeat the trust decision rather than automatically replacing the saved value. Keep that review separate from a routine datastore capacity check.</p>\n<p>Prepare a proposed small backup and isolated restore with harmless marker data once the integration is accepted. State which VM or container is involved and where the recovery copy may run. Do not attach a production network or retire the prior recovery route merely because the storage appears active.</p>\n<h2>Verification and evidence</h2>\n<p>Proposed verification: inspect the configured endpoint, datastore, account reference and fingerprint against the approved record, then run the documented storage-status check. Preserve the actual output and time without reporting the example’s numbers as local capacity evidence.</p>\n<p>Perform the separately authorized backup and isolated recovery exercise, inspect the marker data and record the result. Retain trust verification, connection status and recovery evidence as three named observations. Keep any unresolved permission, certificate or restore failure visible until its owner accepts the specific correction.</p>\n<h2>Official references</h2>\n<ul>\n<li><a href=\"https://pbs.proxmox.com/docs/pve-integration.html\" target=\"_blank\" rel=\"noopener noreferrer\">Proxmox — Proxmox VE Integration</a> — official product documentation; confirm the installed release and configuration.</li>\n</ul>\n<p>Source review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.</p>\n",
        "content_text": "Bottom line: Confirm which backup server the PVE node is meant to trust before saving a fingerprint. Keep credential handling and the storage-status check distinct from a later demonstration that the intended backup can actually be recovered.\nSource fact: what the authority says\nThe Proxmox VE integration guide adds PBS as storage of type pbs in Proxmox VE. Supplying --password without an argument causes the program to prompt, rather than placing the password in a literal argument. For a self-signed backup-server certificate, the guide requires the fingerprint in the configuration and obtains it on the backup server through proxmox-backup-manager cert info. The guide then checks the added storage with pvesm status --storage and says VM and container backups use the integrated storage.\nWhat the source does not establish\nThe source’s storage-status example is not a completed restore test or a statement that an arbitrary supplied fingerprint is trustworthy. This article does not establish encryption-key recovery, retention protection or permission completeness for an existing deployment.\nApplicability questions\n\nWhat server and datastore are approved, and how is their identity independently established?\nWho can obtain the certificate fingerprint through trusted server access?\nWhich credential and entry method are approved without exposing a password?\nWhat separate backup and recovery observations are needed before operational acceptance?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends recording the intended server, datastore, PVE storage identifier and account as separate references. Obtain the expected fingerprint through an approved administrative channel and compare it with the value being configured. Do not accept a value copied from an unexplained connection warning as its own identity proof.\nChoose the documented password prompt when using the command-line workflow, and follow the organization’s credential-handling procedure. Keep the password out of tickets, example commands and screenshots. Have the account owner review its intended use without broadening permissions merely to obtain a successful status response.\nPreserve the storage configuration and the source of the fingerprint comparison. If the certificate changes later, investigate the reason and repeat the trust decision rather than automatically replacing the saved value. Keep that review separate from a routine datastore capacity check.\nPrepare a proposed small backup and isolated restore with harmless marker data once the integration is accepted. State which VM or container is involved and where the recovery copy may run. Do not attach a production network or retire the prior recovery route merely because the storage appears active.\nVerification and evidence\nProposed verification: inspect the configured endpoint, datastore, account reference and fingerprint against the approved record, then run the documented storage-status check. Preserve the actual output and time without reporting the example’s numbers as local capacity evidence.\nPerform the separately authorized backup and isolated recovery exercise, inspect the marker data and record the result. Retain trust verification, connection status and recovery evidence as three named observations. Keep any unresolved permission, certificate or restore failure visible until its owner accepts the specific correction.\nOfficial references\n\nProxmox — Proxmox VE Integration — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.",
        "content_markdown": "Bottom line: Confirm which backup server the PVE node is meant to trust before saving a fingerprint. Keep credential handling and the storage-status check distinct from a later demonstration that the intended backup can actually be recovered.\n\n## Source fact: what the authority says\n\nThe [Proxmox VE integration guide](https://pbs.proxmox.com/docs/pve-integration.html) adds PBS as storage of type pbs in Proxmox VE. Supplying --password without an argument causes the program to prompt, rather than placing the password in a literal argument. For a self-signed backup-server certificate, the guide requires the fingerprint in the configuration and obtains it on the backup server through proxmox-backup-manager cert info. The guide then checks the added storage with pvesm status --storage and says VM and container backups use the integrated storage.\n\n## What the source does not establish\n\nThe source’s storage-status example is not a completed restore test or a statement that an arbitrary supplied fingerprint is trustworthy. This article does not establish encryption-key recovery, retention protection or permission completeness for an existing deployment.\n\n## Applicability questions\n\n- What server and datastore are approved, and how is their identity independently established?\n\n- Who can obtain the certificate fingerprint through trusted server access?\n\n- Which credential and entry method are approved without exposing a password?\n\n- What separate backup and recovery observations are needed before operational acceptance?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends recording the intended server, datastore, PVE storage identifier and account as separate references. Obtain the expected fingerprint through an approved administrative channel and compare it with the value being configured. Do not accept a value copied from an unexplained connection warning as its own identity proof.\n\nChoose the documented password prompt when using the command-line workflow, and follow the organization’s credential-handling procedure. Keep the password out of tickets, example commands and screenshots. Have the account owner review its intended use without broadening permissions merely to obtain a successful status response.\n\nPreserve the storage configuration and the source of the fingerprint comparison. If the certificate changes later, investigate the reason and repeat the trust decision rather than automatically replacing the saved value. Keep that review separate from a routine datastore capacity check.\n\nPrepare a proposed small backup and isolated restore with harmless marker data once the integration is accepted. State which VM or container is involved and where the recovery copy may run. Do not attach a production network or retire the prior recovery route merely because the storage appears active.\n\n## Verification and evidence\n\nProposed verification: inspect the configured endpoint, datastore, account reference and fingerprint against the approved record, then run the documented storage-status check. Preserve the actual output and time without reporting the example’s numbers as local capacity evidence.\n\nPerform the separately authorized backup and isolated recovery exercise, inspect the marker data and record the result. Retain trust verification, connection status and recovery evidence as three named observations. Keep any unresolved permission, certificate or restore failure visible until its owner accepts the specific correction.\n\n## Official references\n\n- [Proxmox — Proxmox VE Integration](https://pbs.proxmox.com/docs/pve-integration.html) — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/",
                "url": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-29"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Business Continuity",
                        "item": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Verify Proxmox Backup trust before accepting a PVE storage entry",
                        "item": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/#article",
                "identifier": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/",
                "url": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/",
                "headline": "Verify Proxmox Backup trust before accepting a PVE storage entry",
                "description": "Keep self-signed certificate fingerprint verification, credential entry and storage status separate when integrating PBS with Proxmox VE.",
                "abstract": "Keep self-signed certificate fingerprint verification, credential entry and storage status separate when integrating PBS with Proxmox VE.",
                "articleBody": "Bottom line: Confirm which backup server the PVE node is meant to trust before saving a fingerprint. Keep credential handling and the storage-status check distinct from a later demonstration that the intended backup can actually be recovered.\nSource fact: what the authority says\nThe Proxmox VE integration guide adds PBS as storage of type pbs in Proxmox VE. Supplying --password without an argument causes the program to prompt, rather than placing the password in a literal argument. For a self-signed backup-server certificate, the guide requires the fingerprint in the configuration and obtains it on the backup server through proxmox-backup-manager cert info. The guide then checks the added storage with pvesm status --storage and says VM and container backups use the integrated storage.\nWhat the source does not establish\nThe source’s storage-status example is not a completed restore test or a statement that an arbitrary supplied fingerprint is trustworthy. This article does not establish encryption-key recovery, retention protection or permission completeness for an existing deployment.\nApplicability questions\n\nWhat server and datastore are approved, and how is their identity independently established?\nWho can obtain the certificate fingerprint through trusted server access?\nWhich credential and entry method are approved without exposing a password?\nWhat separate backup and recovery observations are needed before operational acceptance?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends recording the intended server, datastore, PVE storage identifier and account as separate references. Obtain the expected fingerprint through an approved administrative channel and compare it with the value being configured. Do not accept a value copied from an unexplained connection warning as its own identity proof.\nChoose the documented password prompt when using the command-line workflow, and follow the organization’s credential-handling procedure. Keep the password out of tickets, example commands and screenshots. Have the account owner review its intended use without broadening permissions merely to obtain a successful status response.\nPreserve the storage configuration and the source of the fingerprint comparison. If the certificate changes later, investigate the reason and repeat the trust decision rather than automatically replacing the saved value. Keep that review separate from a routine datastore capacity check.\nPrepare a proposed small backup and isolated restore with harmless marker data once the integration is accepted. State which VM or container is involved and where the recovery copy may run. Do not attach a production network or retire the prior recovery route merely because the storage appears active.\nVerification and evidence\nProposed verification: inspect the configured endpoint, datastore, account reference and fingerprint against the approved record, then run the documented storage-status check. Preserve the actual output and time without reporting the example’s numbers as local capacity evidence.\nPerform the separately authorized backup and isolated recovery exercise, inspect the marker data and record the result. Retain trust verification, connection status and recovery evidence as three named observations. Keep any unresolved permission, certificate or restore failure visible until its owner accepts the specific correction.\nOfficial references\n\nProxmox — Proxmox VE Integration — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.",
                "datePublished": "2026-10-29T17:41:00+00:00",
                "dateModified": "2026-10-29T17:41:38+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/verify-proxmox-backup-trust-before-accepting-a-pve-storage-entry/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Verify Proxmox Backup trust before accepting a PVE storage entry"
                },
                "articleSection": [
                    "Business Continuity",
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Business Continuity",
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Advisory priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 526,
                "timeRequired": "PT3M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Proxmox — Proxmox VE Integration",
                    "url": "https://pbs.proxmox.com/docs/pve-integration.html"
                }
            }
        ]
    }
}