diff --git a/management/backup.py b/management/backup.py
index 0539e7fc..346ce48e 100755
--- a/management/backup.py
+++ b/management/backup.py
@@ -69,8 +69,9 @@ def backup_status(env):
 		"--archive-dir", backup_cache_dir,
 		"--gpg-options", "'--cipher-algo=AES256'",
 		"--log-fd", "1",
-		get_duplicity_target_url(config),
-		] + get_duplicity_additional_args(env),
+		] + get_duplicity_additional_args(env) + [
+		get_duplicity_target_url(config)
+		],
 		get_duplicity_env_vars(env),
 		trap=True)
 	if code != 0:
@@ -237,8 +238,8 @@ def get_duplicity_additional_args(env):
 			port = 22
 						
 		return [
-			f"--ssh-options= -i /root/.ssh/id_rsa_miab -p {port}",
-			f"--rsync-options= -e \"/usr/bin/ssh -oStrictHostKeyChecking=no -oBatchMode=yes -p {port} -i /root/.ssh/id_rsa_miab\"",
+			f"--ssh-options='-i /root/.ssh/id_rsa_miab -p {port}'",
+			f"--rsync-options='-e \"/usr/bin/ssh -oStrictHostKeyChecking=no -oBatchMode=yes -p {port} -i /root/.ssh/id_rsa_miab\"'",
 		]
 	elif get_target_type(config) == 's3':
 		# See note about hostname in get_duplicity_target_url.
@@ -350,10 +351,11 @@ def perform_backup(full_backup):
 			"--exclude", backup_root,
 			"--volsize", "250",
 			"--gpg-options", "'--cipher-algo=AES256'",
+			"--allow-source-mismatch"
+			] + get_duplicity_additional_args(env) + [
 			env["STORAGE_ROOT"],
 			get_duplicity_target_url(config),
-			"--allow-source-mismatch"
-			] + get_duplicity_additional_args(env),
+			],
 			get_duplicity_env_vars(env))
 	finally:
 		# Start services again.
@@ -373,8 +375,9 @@ def perform_backup(full_backup):
 		"--verbosity", "error",
 		"--archive-dir", backup_cache_dir,
 		"--force",
+		] + get_duplicity_additional_args(env) + [
 		get_duplicity_target_url(config)
-		] + get_duplicity_additional_args(env),
+		],
 		get_duplicity_env_vars(env))
 
 	# From duplicity's manual:
@@ -388,8 +391,9 @@ def perform_backup(full_backup):
 		"--verbosity", "error",
 		"--archive-dir", backup_cache_dir,
 		"--force",
+		] + get_duplicity_additional_args(env) + [
 		get_duplicity_target_url(config)
-		] + get_duplicity_additional_args(env),
+		],
 		get_duplicity_env_vars(env))
 
 	# Change ownership of backups to the user-data user, so that the after-bcakup
@@ -426,9 +430,10 @@ def run_duplicity_verification():
 		"--compare-data",
 		"--archive-dir", backup_cache_dir,
 		"--exclude", backup_root,
+		] + get_duplicity_additional_args(env) + [
 		get_duplicity_target_url(config),
 		env["STORAGE_ROOT"],
-	] + get_duplicity_additional_args(env), get_duplicity_env_vars(env))
+	], get_duplicity_env_vars(env))
 
 def run_duplicity_restore(args):
 	env = load_environment()
@@ -438,9 +443,23 @@ def run_duplicity_restore(args):
 		"/usr/bin/duplicity",
 		"restore",
 		"--archive-dir", backup_cache_dir,
-		get_duplicity_target_url(config),
-		] + get_duplicity_additional_args(env) + args,
-	get_duplicity_env_vars(env))
+		] + get_duplicity_additional_args(env) + [
+		get_duplicity_target_url(config)
+		] + args,
+		get_duplicity_env_vars(env))
+
+def print_duplicity_command():
+	import shlex
+	env = load_environment()
+	config = get_backup_config(env)
+	backup_cache_dir = os.path.join(env["STORAGE_ROOT"], 'backup', 'cache')
+	for k, v in get_duplicity_env_vars(env).items():
+		print(f"export {k}={shlex.quote(v)}")
+	print("duplicity", "{command}", shlex.join([
+		"--archive-dir", backup_cache_dir,
+		] + get_duplicity_additional_args(env) + [
+		get_duplicity_target_url(config)
+		]))
 
 def list_target_files(config):
 	import urllib.parse
@@ -648,6 +667,9 @@ if __name__ == "__main__":
 		# to duplicity. The restore path should be specified.
 		run_duplicity_restore(sys.argv[2:])
 
+	elif sys.argv[-1] == "--duplicity-command":
+		print_duplicity_command()
+
 	else:
 		# Perform a backup. Add --full to force a full backup rather than
 		# possibly performing an incremental backup.
diff --git a/tests/runner.sh b/tests/runner.sh
index 4ac434a3..e225289d 100755
--- a/tests/runner.sh
+++ b/tests/runner.sh
@@ -30,6 +30,7 @@ default_suites=(
 	mail-aliases
 	mail-access
 	management-users
+	management
 	z-push
 	roundcube     # browser tests
 )
diff --git a/tests/suites/management.sh b/tests/suites/management.sh
new file mode 100644
index 00000000..5741b00b
--- /dev/null
+++ b/tests/suites/management.sh
@@ -0,0 +1,33 @@
+# -*- indent-tabs-mode: t; tab-width: 4; -*-
+#	
+
+test_perform_backup() {
+	# make sure backups work
+	#
+	test_start "perform_backup"
+	record "[create custom.yaml]"
+	cat >$STORAGE_ROOT/backup/custom.yaml <<EOF
+min_age_in_days: 1
+target: local
+EOF
+	record "[run management/backup.py]"
+	pushd "$MIAB_DIR" >/dev/null 2>>$TEST_OF \
+		|| test_failure "could not change directory to miab root"
+	local output code
+	output=$(management/backup.py 2>&1)
+	code=$?
+	echo "$output" >> $TEST_OF
+	if [ $code -ne 0 ]; then
+		test_failure $(python_error "$output")
+		test_failure "backup failed"
+	fi
+	popd >/dev/null 2>>$TEST_OF
+	rm -f $STORAGE_ROOT/backup/custom.yaml
+	test_end
+}
+
+suite_start "management"
+
+test_perform_backup
+
+suite_end