Create admin who cannot create or restore backup

[brancott]

Hi guys, I'm trying to create a role with all admin permissions except manipulating backups. I excluded VM.Backup privilege and cannot restore backups now, but backup creation is still there. What else should I exclude?
I need only a couple admins to work with backups but all others still should have admin rights for everything except backups.

 

[LnxBil]

I need only a couple admins to work with backups but all others still should have admin rights for everything except backups.

Can you create a backup if the person does not have storage priviledges? It should not, so maybe that is a way to go?

 

[brancott]

Can you create a backup if the person does not have storage priviledges?

No, I cannot because I can't work with storege at all.)

 

[LnxBil]

No, I cannot because I can't work with storege at all.)

Then you have your desired restriction and your problem is solved.

 

[brancott]

Then you have your desired restriction and your problem is solved.

Not exactly cos I need all admins to be able to work with datastores and just some of them to be able to create backups and looks like I can't get both.

 

[LnxBil]

Not exactly cos I need all admins to be able to work with datastores and just some of them to be able to create backups and looks like I can't get both.

If your backup storage is disjunct from the other storage system, it is possible with the ACL. Just give those "not-so-much-admin"-Users the permission to administer some storages but not all.

 

[brancott]

If your backup storage is disjunct from the other storage system, it is possible with the ACL. Just give those "not-so-much-admin"-Users the permission to administer some storages but not all.

Сan you elaborate on how to do this exactly? There are acls in pbs but in proxmox itself?

 

[LnxBil]

I have to check with PBS, but without it - so normal storage, it is in the permission settings. >ou can set roles to a path in the permission tree, so you can set specific roles for paths, so that you have access to some storage systems and not to others.