Cannot grant Shell/CLI permissions with @pbs, LDAP or other non pam accounts

[BloodyIron]

Hi Folks,

I've recently tried in Proxmox Backup Server to create a new account for a new admin with full admin permissions, but there's some existing shortcomings that are noteworthy that I want the general public to be aware of. (I'm currently using v2.4-3 and these issues appear to exist even in the latest v3.2 versions too).

This user was created in the @PBS realm, and granted the "Admin" role with full permissions to full scope.

1. Sys.Console being granted doesn't work and in the webGUI produces HTTP 400 error. Even in incognito and all cookies/cache cleared/refreshed.
2. The user has no capability to log into the Shell/CLI at all, and in-turn cannot do sudo/elevated functions in similar vein to the root@pam account
3. Only the root@pam account really is capable of doing actual Shell/CLI functions without completely undocumented and extreme steps taken.

This also is the case when using any other realm such as LDAP, OIDC, etc, so far as I can tell.

I have opened a bug report on the matter for Proxmox Backup Server: https://bugzilla.proxmox.com/show_bug.cgi?id=6052

And I also have already opened one for Proxmox VE as it has generally an identical/similar matter: https://bugzilla.proxmox.com/show_bug.cgi?id=5791

To date I'm not really seeing traction from the Proxmox devs on addressing this problem, and I really hope we can get traction here.

The core of the problem here is when there are more than 1 (>1) admins in the environment that _require_ full access, including elevated Shell/CLI access, to be able to do their job. The reason you do NOT want to use root@pam accounts for this is because you _cannot prove who did what and when_. So in environments where you need to audit operations, or review previous malicious actions (intentional or not) you _literally cannot prove who did what when the root@pam account is used_.

This issue is important in Proxmox Backup Server yes, and even more important for the Proxmox VE environment when dealing with clusters as in that case you can be dealing with possibly a whole team of admins that need this.

So if you are someone that cares about this stuff, please step into the above bug reports and lend your thoughts. I really want the Proxmox devs to get these added to some roadmap so they can get corrected soon-ish.

If there's anything more I can do to help on this greater topic, please let me know and I'll do my best to help!

 

[tscret]

Why don't you simply create Linux native Users? These would be authenticated over PAM. Or what about Key-Login for your admins over SSH when realy needing a shell.

In my opinion it's deginetly not a bug, it's just how things work.

I remeber some debian posts where you could sync/link LDAP/Kerberos/NTLM to PAM...
something like this... https://wiki.debian.org/LDAP/PAM

 

[BloodyIron]

Why don't you simply create Linux native Users? These would be authenticated over PAM. Or what about Key-Login for your admins over SSH when realy needing a shell.

In my opinion it's deginetly not a bug, it's just how things work.

I remeber some debian posts where you could sync/link LDAP/Kerberos/NTLM to PAM...
something like this... https://wiki.debian.org/LDAP/PAM

Bug is the only real class of report that can be made, regardless of if the term is fully accurate or not.

And this is a scaling problem, plus that's the whole point of the webGUI for Proxmox in general. So you can manage how the system operates _without_ having to go to the CLI. You literally can already do this just not to a sufficient degree, which is where the problem lies.

 

[UdoB]

And this is a scaling problem

You can connect to AD (and others) - and PAM does also work for these.

Disclaimer: I have no "Howto" available...