questions about creating users in proxmox using Linux PAM Standard Authentication

whiggs

New Member
Dec 11, 2024
21
0
1
Hello everyone. So I am having some difficulty understanding how to create/manage users in proxmox using Linux PAM standard authentication. The documentation reads as follows:
Linux PAM is a framework for system-wide user authentication. These users are created on the host system with commands such as adduser. If PAM users exist on the Proxmox VE host system, corresponding entries can be added to Proxmox VE, to allow these users to log in via their system username and password.
There appears to be conflicting information based on my reading of the above quote. The user creation menu is only accessible at the datacenter level, which would indicate that the settings would apply to all nodes in the cluster, which supports the "Linux PAM is a framework for system-wide user authentication" portion of the documentation. However, someone has to manually access each node in the cluster and manually create and configure a user with the same username before it will work? How is that supposed to work? The proxmox user menu allows you to set the password for a user, so will doing so in the proxmox admin portal update that user's password on all of the nodes? Furthermore, how do you go about assigning permissions to the newly created user? When I click the "permissions" button in the proxmox user menu, there are no permissions assigned to the user, and I can't seem to find way to do so within the proxmox admin portal. Can someone help me understand just how this works. I like to think I am not an idiot, and yet I am unable to figure out how to go about performing what should be the simple task of creating a new user and assigning them permissions, which would seem to indicate that this process is overly-complicated. Can someone explain this to me. Like I am 5.
 
The user creation menu is only accessible at the datacenter level, which would indicate that the settings would apply to all nodes in the cluster
This is correct, the user and their permissions apply to all nodes in the cluster.
which supports the "Linux PAM is a framework for system-wide user authentication"
System-Wide refers to "Linux PAM" which is not PVE specific. Its a generic Linux concept. The "system" in this particular wording is the server/node.
However, someone has to manually access each node
Each system, correct.
How is that supposed to work?
The username and permissions are stored in clustered PVE filesystem, the authentication is offloaded to the system/node/server against which authentication is done at any particular time.
The proxmox user menu allows you to set the password for a user, so will doing so in the proxmox admin portal update that user's password on all of the nodes?
No. If you try to change a password on PAM user, you will see an alert: For the PAM realm, this applies only to the connected node.

how do you go about assigning permissions to the newly created user
Click the parent item of the "users" entry in your middle Tree view. Its called "Permissions". That will present an "Add" button.
Can someone explain this to me. Like I am 5.
Imagine you are a child (user), you are 5. You have parents (cluster) - they call you Jimmy. You live one week on a sea shore, another in the city. There you have permission (set globally by your parents to use play station). But there must be 2 of them, one at each house (backend Linux user with password).

If you want centralized user management, you have an option of PVE realm. If you insist on users having shell access, they need to exist in Linux. If you want centralized Linux user management - there are many ways to implement it: NIS, AD, etc. This is outside of PVE functionality as a hypervisor.

Hope this helps.


Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox
 
Last edited:
  • Like
Reactions: UdoB