Nimbus Backup 0.4.1: proxmox-backup-client-compatible encryption and signed binaries

Signed binaries

NimbusBackup.exe, the service and the NimbusBackup.msi installer are signed (Authenticode) through Azure Artifact Signing, with a certificate issued to RDEM SYSTEMS (Pontoise, FR). The executables are signed before the MSI packs them, then the MSI itself. The command-line tools, shipped separately in the nimbus-backup-cli archive, are not signed.

CI checks every shipped file, including the executables inside the MSI: status Valid, signer RDEM SYSTEMS, timestamp. Otherwise the build fails.

RDEM SYSTEMS shows as a verified publisher; the SmartScreen warning may remain until reputation is established. The certificate is new, and its reputation starts from zero. If SmartScreen still appears, check that the publisher is RDEM SYSTEMS, then click More info, then Run anyway.

Get-AuthenticodeSignature .\NimbusBackup.msi | Format-List Status, SignerCertificate

SHA-256 hashes, the provenance attestation and the VirusTotal reports are still published for every version; we detail them on the antivirus false positive page.

tizbac's encryption, compatible with proxmox-backup-client

This encryption was developed upstream by Tiziano Bacocco, in tizbac/proxmoxbackupclient_go. 0.4.1 brings it into our build, replacing our own implementation, which had never been released. Thank you, Tiziano.

Chunks are encrypted with AES-256-GCM on the machine being backed up, in the same format as the official proxmox-backup-client: the PBS server only receives encrypted data and never sees the key. In the GUI: PBS Configuration → Edit → Encryption key file, then create a key file or pick an existing one; its fingerprint is shown.

CI checks the compatibility on every build, against a real PBS:

• a folder encrypted by Nimbus Backup, with a key created by the official client, is restored by the official client with the same key, and refused without it;
• a disk backup encrypted by the official client is read back by Nimbus Backup;
• on every build, PBS itself verifies every chunk and every archive Nimbus Backup uploaded.

Proxmox VE uses the same key files: a key created by Proxmox VE or by proxmox-backup-client also works with Nimbus Backup. How to create the key, keep it off the system being backed up and recover it: the Proxmox Backup Server encryption key.

Paper key and QR code (a Nimbus Backup addition)

• Print the key in the proxmox-backup-client key paperkey format, with its QR code, optionally protected by a passphrase.
• Import a key from a scanned QR code, a paper copy or pasted text.

Other new features

• Several folders backed up in parallel (#6): a GUI setting, which also applies to scheduled backups, or -parallel N on the command line. There is no maximum; we recommend the number of CPUs divided by 4. It helps when reading dominates (fast disks, little new data); avoid it on a conventional hard drive.
• One VSS snapshot for a whole multi-folder backup, with one shadow copy per volume: all the folders of a volume are frozen at the same instant. Each folder used to get its own snapshot, at its own turn. If a volume refuses VSS, Nimbus Backup falls back to one snapshot per folder. Two different volumes (C: and D:) are not frozen at the same instant.
• Exclusions in the proxmoxbackup-directory command line (#4): -exclude "*.tmp" (repeatable), -exclude-from file, or "exclude" in the JSON configuration.
• Disk backups that restore in Proxmox VE as a matching VM: CPU count, memory, UEFI or BIOS, OS type, network cards with their MAC addresses, SMBIOS identity. In VM mode the form has its own "Proxmox VM ID" field. Whole-machine backup is still in beta.

Taken from tizbac's project:

• a "Running jobs" tab (progress, time left, cancel);
• a PBS server choice for each job;
• disks identified in a stable way;
• NTFS and POSIX ACL restore;
• an end-to-end test suite against a real PBS in CI;
• Linux package recipes (Debian, Fedora, Arch) in the sources. Our GitHub releases do not publish Linux packages: on Linux, use the official client, which we repackage in our unofficial proxmox-backup-client repository.

The README is translated into 13 languages, 11 of them by AI; each file says so at the top.

Fixes, and thanks to the reporters

• A busy VSS no longer deletes every shadow copy on the machine. In 0.4.0, when VSS reported that another shadow copy was being created, the client ran vssadmin delete shadows /all and restarted the VSS service, which destroyed Windows restore points and other tools' snapshots. It now waits and retries (30 s, 60 s, 120 s), then stops with a clear message.
• The startup cleanup no longer deletes the snapshot of another Nimbus backup in progress (for example a GUI started during a command-line backup).
• #9, thanks hgreen119-coder: disk backups all failed at the finalize step, and a scheduled job could show as successful with no snapshot on the PBS.
• #2, thanks Kofl: in service mode, the GUI stayed on "Starting backup..." while the backup was running.
• #1, thanks dead-plant: "Maximise" did not fill the screen.
• The service ignored the PBS server selected for a folder backup and always used the default server.
• Encrypted backups made by proxmox-backup-client (chunks compressed then encrypted, its default format) could not be restored. That is fixed, and our encrypted chunks are now compressed too.
• Error messages give the actual reason returned by PBS, instead of "authentication failed" for every refusal.

Thanks also to MTkatchouk (#3, #4, #6) and 346L3 (#5).

Upgrading

The MSI upgrades in place: same Windows service, configuration kept. On every build, CI installs the MSI on a Windows machine, as a fresh install and as an upgrade from the published 0.4.0, and checks the service and the signatures. If you come from 0.3.0, the configuration folder migration is described in the Windows client guide.

Encryption does not turn itself on: pick a key for each server. Once the key is set, the first encrypted backup uploads all the data again, with no deduplication against the unencrypted backups before it. Keep a copy of the key off the machine before you rely on those backups: without it, they cannot be restored.

Links

• Release 0.4.1 on GitHub (executable, MSI, command-line tools, SHA256SUMS.txt)
• CHANGELOG, 0.4.1 section
• PBS encryption key: create, back up, recover
• Back up Windows to Proxmox Backup Server
• Our Windows GUI joined tizbac's project
• The original project, tizbac/proxmoxbackupclient_go

Frequently asked questions