Proxmox PBS Tape Out: Cold Storage for Long-Term Backups

Many people consider tape a relic. Anyone who has dealt with a ransomware incident in the past few years sees it differently. A tape that is physically removed from the drive after the backup run and placed in a cabinet is the most honest air-gap that exists — no network protocol, no API, no credentials for an attacker to steal.

Proxmox Backup Server supports tape natively via the proxmox-tape toolset. This article shows how a tape-based cold-storage tier can realistically be built in an SMB context — from hardware selection to rotation schemes to restore tests.

Why tape — and why now

Three arguments make the case for a tape tier alongside disk-based PBS:

1. True air-gap. A tape in a cabinet cannot be encrypted — no ransomware variant can attack a medium that is physically not in the system.
2. Long-term retention at low cost per TB. LTO-9 cartridges run around EUR 90–130 (18 TB native) — about EUR 5–7 per TB of cartridge capacity. Disk storage is cheaper for daily backups, but for 10-year archives tape becomes unbeatable per TB.
3. Compliance. GoBD, KRITIS, ISO 27001 — many requirements are easier to document with a physically separated backup copy than with online-only replicas.

If you have one of these reasons, evaluate tape. If you have all three, plan for it.

LTO-9 — the current mainstream standard

LTO-9 has been on the market since late 2021 and is now broadly available. LTO-10 is on the roadmap, but as of 2026 its market penetration is low — for a current investment decision, LTO-9 is the obvious choice.

Property	LTO-9 (per LTO consortium / IBM / Quantum)
Native capacity	18 TB
Compressed (2.5:1 marketed)	45 TB
Native transfer rate	up to 400 MB/s
Hardware encryption	AES-256 (mandatory in LTO-9 drive firmware)
WORM variant	yes (Write-Once-Read-Many cartridges available)
Media lifetime	up to 30 years under proper storage conditions

Important: The “45 TB compressed” figure is a consortium claim assuming 2.5:1. In reality, the compression ratio depends heavily on content — VM backups from PBS are already deduplicated and compressed, so tape-side compression adds little. Plan conservatively with 18 TB usable per LTO-9 cartridge for PBS tape output.

LTO drive vs. tape library

Two hardware classes are relevant:

Standalone LTO drive (single drive):

• One drive (internal or external via SAS) with one loaded tape
• Manual cartridge change
• Investment: approximately EUR 4,500–7,000 for an LTO-9 SAS drive (HP/IBM/Quantum, list prices vary)
• Fits: SMBs with < 100 TB backup volume, weekly rotation, IT staff swapping tapes manually

Tape library (autoloader or library):

• Multiple slots (8 to several hundred) with robotic changer
• Fully automatic backup runs across multiple tapes
• Investment: from around EUR 8,000 (e.g. HPE MSL2024 or Quantum Scalar i3 with 1 drive and 24 slots), open at the top
• Fits: SMBs with > 100 TB backup volume, nightly full backups across several cartridges, no manual intervention desired

For classic SMB setups up to roughly 200 TB of backup data, a single drive plus disciplined weekly rotation is often enough — cost-effective and manageable.

Tape encryption: AES-256 hardware

LTO-9 drives include AES-256 hardware encryption — encryption runs in the drive controller, not in the PBS server CPU. No performance hit, no software dependency.

PBS manages keys through tape encryption keys held in PBS. proxmox-tape encryption-key create creates a key that can then be activated per tape pool.

Caution — key management:

• Back up the key in multiple places. A lost tape encryption key renders every tape written with it useless. Export the key to a USB stick, print it in the safe, store it in at least two physically separated locations.
• Rotate keys carefully. New keys for new backup generations can make sense, but old keys must remain accessible as long as old tapes need to be readable.
• Separate keys from tapes physically. Storing both in the same safe is not real defense in depth.

Air-gap protection against ransomware

All current ransomware protection strategies for 2026 emphasise one component: at least one backup copy must be offline or immutable. Tape satisfies the offline criterion by definition — once the cartridge is ejected, it is unreachable for any attacker on the network.

Concrete air-gap practice with PBS and tape:

1. Nightly disk backup from PVE to PBS (warm tier)
2. Weekly or monthly tape-out: proxmox-tape backup --pool weekly --drive lto9-drive --snapshot 'vm/100/2026-07-06T22:00:00Z'
3. Eject tape physically, label, place in tape cabinet
4. On incident: tape out of cabinet, restore via proxmox-tape restore

Important: as long as the tape is in the drive, it is in principle reachable. Real air-gap only exists after physical ejection and locking away.

GFS rotation for SMBs (Grandfather-Father-Son)

The classic grandfather-father-son scheme is still a good starting point in SMB contexts:

Generation	Frequency	Retention	Example with 8 tapes
Son (day)	Mon–Thu daily	1 week	4 tapes (Mon, Tue, Wed, Thu)
Father (week)	Fridays	1 month	3 tapes (Fri W1, W2, W3)
Grandfather (month)	last Friday of month	12 months	1 rotating tape, monthly rewritten — better: 12 tapes for a full-year archive

Pragmatic LTO-9 variant for SMBs:

• 5 weekday tapes (daily, one-week hold)
• 4 week tapes (every Friday, one-month hold)
• 12 monthly tapes (last Friday, one-year hold)
• 5 yearly tapes (December backup, five-year hold)
• Total: 26 cartridges, around EUR 2,500–3,500 one-time media cost

At 18 TB per cartridge, that covers most SMB data inventories — if you need more, span multiple cartridges or move to a small library.

PBS configuration in practice

The most important commands in day-to-day tape operations:

# Register drive
proxmox-tape drive create lto9-drive --path /dev/nst0

# Create encryption key
proxmox-tape encryption-key create --hint "DATAZONE tape pool 2026"

# Define tape pool
proxmox-tape pool create weekly --drive lto9-drive --allocation continue \
  --encrypt 1 --retention 28d

# Inventory tapes (read barcodes)
proxmox-tape inventory --drive lto9-drive

# Write backup snapshot to tape
proxmox-tape backup --pool weekly --drive lto9-drive \
  --snapshot 'vm/100/2026-07-06T22:00:00Z'

# Restore from tape
proxmox-tape restore --media-set <UUID> --store backup-store --drive lto9-drive

The PBS Wiki tape documentation covers edge cases — label strategies, media-set management and handling of damaged tapes.

Offsite storage

A tape stored in a cabinet inside the same building protects against ransomware but not against fire or water damage. For a real 3-2-1 strategy (see 3-2-1 backup rule), at least one tape generation belongs offsite.

Practical options:

• Bank safe deposit box. Robust, cost-effective, climatically stable. Change rhythm: monthly. Practice: the IT lead drives to the bank and swaps the tape in the box.
• Second location (branch, private address, external DC). Change via courier or staff. Important: transport insurance and a logged handover.
• Iron-Mountain-style providers. Pickup, climate-controlled storage, documented return on demand. Higher running cost, but audited.

Climatic requirements for LTO storage (per LTO consortium):

• Temperature: 16–25 °C for long-term storage
• Relative humidity: 20–50 %
• Magnetic-field-free (no storage next to large transformers or unshielded speakers)

Restore tests — mandatory

A tape that has never been restored is, in case of doubt, not a backup copy. Tapes can be defective, the drive can be misconfigured, the encryption key can be lost — none of this surfaces until you try to restore.

Recommended restore-test cadence:

• Quarterly: Random sample restore from a tape — one VM, one file. Document the result.
• Half-yearly: Full restore of a small snapshot into a test environment. Boot check of the VM.
• Yearly: Full recovery of a critical system onto spare hardware. Loop in leadership — that doubles as a BCM exercise.

Retain restore-test logs. For audits (ISO 27001, insurers, KRITIS inspections), they are the most important evidence that the backup strategy actually works.

When tape does not pay off

Honesty matters:

• Very small data sets (< 5 TB). Cloud object storage with immutability is often cheaper and simpler here.
• Frequent restore needs. Tape is sequential — if you restore individual files every other day, disk is the better fit.
• Pure home office / solo self-employed. A second external disk plus cloud sync usually suffices.

Tape pays off when capacity, compliance and real air-gap protection meet. For most SMBs with > 20 TB of backup volume and a compliance angle, it remains the most cost-effective and most honest cold-storage solution.

DATAZONE recommendation

Tape is not a replacement for disk-based PBS — it is the third tier in a thought-through 3-2-1 strategy:

1. Production VMs on TrueNAS iSCSI / NVMe-oF or Proxmox-internal storage
2. Daily disk backup to PBS (warm tier, fast restore)
3. Weekly / monthly tape-out + offsite cartridge (cold tier, disaster recovery and compliance archive)

We help with hardware sizing — from a single LTO-9 drive for the classic mid-market customer to an HPE MSL library for regulated industries. More under our backup strategy consulting.

Sources and further reading

• PBS tape backup — official documentation
• LTO Consortium — LTO-9 specifications
• Proxmox Backup Server 4.0 — what’s new
• 3-2-1 backup rule for SMBs
• Ransomware protection measures 2026
• Backup strategy with Proxmox and TrueNAS