how to restrict the user permission to deleting the VMs from external application

[powersupport]

Hi,

We have an external application linked with the Proxmox cluster. We have created a user under it and assigned the Administrator role in proxmox (user under PVE authentication).

If the user get terminated from the application, May I know if there is an option to remove the permission to delete the VM from the Proxmox for that user? May I know if there is an option to restrict the permissions to remove and manage the VMs from the Proxmox cluster for the user( which has administrator privileges)?

Looking forward to your reply.

 

[fabian]

if you give a user Administrator role they can basically do almost everything by definition.. maybe you should take a step back and figure out what you actually want them to be able to do, and then give them the required privileges for that..

 

[powersupport]

Hi,

While is the best role to user to restrict the privileges for the VM deletion ?

Thank you

 

[fabian]

any role that doesn't have VM.Allocate - but again, you are approaching this from the wrong end..

 

[powersupport]

Hi,


Actually, we want to create a user which has permissions for console access, manage the VM(only stop and start VM-didn't required permission to delete the VM), and also permission to view the resources, and boot the server. If so, what should be the recommended role for the user?


Also, May I know can we custom the permissions of the user? This means, can we create a user with only the permissions which we wish to?


Looking forward to your reply.


Regards,

 

[powersupport]

Hi @d

if you give a user Administrator role they can basically do almost everything by definition.. maybe you should take a step back and figure out what you actually want them to be able to do, and then give them the required privileges for that..

How we can give the required privilege? , there is no customer option I can find from Proxmox, only the predefined role available

Thank you.

 

[fabian]

this is all documented: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pveum_permission_management