allow user to only access one vm's console/terminal

[randyqx]

i often create vms for a particular user. i would like them to be able access the serial (or vga would be ok) console for their vm and only that. i am definitely not seeing a built-in role for this. but i would guess this is a common need and my search fu is just not up to the task. i guess i could give them an ssh config limited to `qm terminal 42`.

randy

 

[UdoB]

The Permission Management -concept should allow this, I believe. See this chapter: https://pve.proxmox.com/pve-docs/chapter-pveum.html#_objects_and_paths

/vms/{vmid}: Access to specific VMs

Unfortunately this whole concept needs some learning effort first as the dependencies and the actual required rights are not obvious at first...

 

[randyqx]

thanks, but i do not see how to connect the dots. i know how to put users in group foo, which has role bar. but when i create a role bar, with privileges VM.Console, VM.PowerMgmt. how do i say *which* vmid?

perhaps i should be using the cli and not the gooey?

 

[Kingneutron]

End-users shouldn't need access to the proxmox webui at all.

Why not just setup remote desktop access in-vm with the usual tools, RDP and/or Nomachine NX? As the admin of the proxmox box you don't want them changing cpu/ram allocation, etc or dinking around with stuff they shouldn't

 

[randyqx]

in this case, user is a sysadmin doing cold installs etc. so, i guess, as i said in original post i guess "i could give them an ssh config limited to `qm terminal 42`."