Change logging in as root

[Lantizia]

Hey,

As a rule of thumb on any server, even if it's local only, even if there's no ports opened to it... I always make myself another user and add it to the sudoers and disable root like this...

passwd -d -l root

Unfortunately if you remove the password from root, or lock root, or both (like the above command) Proxmox won't let you log in as root any more because it relies on authenticating against the Unix user.

Could someone tell me which file (I'm guessing in... /usr/share/pve-manager/root/system) would need to be altered so it verifies access to the Proxmox web interface via checking the password for a different username (and when changing the password for the 'Administrator' in the web interface - changes it for that new username).

And I know it'll mean tweaking with the source, and thus unsupportable, and any update could revert it... but I'm just interested in the idea from a theoretical point of view at the moment and would welcome any discussion about the pros/cons of it and if perhaps Proxmox needs better user account administration support (like adding users, or restricting access to particular machines per user etc).

Thanks

 

[tom]

see http://pve.proxmox.com/wiki/Roadmap

 

[Lantizia]

This is great, so in the mean time is there a way I can tweak login.pl or this nrd/LOGIN thing to check against a different username? I've seen what to change for making the change of password work in system/admin.htm

 

[dietmar]

This is great, so in the mean time is there a way I can tweak login.pl or this nrd/LOGIN thing to check against a different username? I've seen what to change for making the change of password work in system/admin.htm

see /usr/share/perl5/PVE/Utils.pm (is_valid_user())

 

[rootkid]

OK. So i was searching for a way to change the gui login to anything else then root and found this thread. A little bit dusty, but seems to be somewhat up-to-date.
I spent about 3 hours trying to understand that function, unsuccessfully.

why can "testuser" login if it's in group "root", but not if i change "root" to "testuser's group" in "$groupname ne root" ?


to remember: This is the (apparently) interesting part:

    # fixme: what groups are allowed?
    if ($groupname ne 'rootkid') {
        syslog ('info', "auth failed: group '$groupname' is not in the list of allowed groups");
        return undef;
    }

Any hint is welcome!

 

[Lantizia]

I gave up on this a while back!

But would still be cool to know - unless the feature in the roadmap is about to be imminently added.

 

[kch]

Log into the host machine as root

run the command

adduser proxadmin --gid 0

and then answer the questions.

This will allow this user to log in at the proxmox login screen. I have not tested this too much, but it allows the users to start and stop machines.

--
KCH

 

[rootkid]

Problem is:
This user would be in system's "root" group, right?

 

[kch]

Problem is:
This user would be in system's "root" group, right?

Yes, this is correct. But just being in the root group is very slightly better than having them log in as root.

I am sure the code could be altered to look for something else, but if the proxmox team are looking at it already, why re-invent the wheel

--
KCH