[SOLVED] Is it safe to delete a user?

[Colin 't Hart]

Hi,

Our former system adminsitrator left our company; is it safe to delete his Proxmox accounts? These are in the PVE Authentication realm.
Don't all the permissions go via roles? And I understand it's not possible for such a user to "own" anything, correct?

Thanks,

Colin

 

[Alwin]

As long as you have root access, you can delete the user. But you need to take care of any script or program that uses this account.

 

[t.lamprecht]

Don't all the permissions go via roles? And I understand it's not possible for such a user to "own" anything, correct?

If you delete all the permissions from this user and its group then yes, he cannot do anything anymore.
The permissions add roles to object paths (e.g., '/' == whole cluster, /vms/100' == vm/ct 100, ...), and that either for groups or users.

As a simply way to ensure he cannot access anything without deleting it, you may give this user the NoAccess role on the root path '/' and check 'propagate'.
We always give deny permissions higher priorities than allow permissions so he should not be able to do anything anymore.

 

[guletz]

My 2 cent ideea: never delete a user (if you do not want to remember .... what user I delete a year ago). In this cases I change the password with a new strong and long password. And I also monitor any usage of this user for many month. After 3 month I modified the shell for this user(like /dev/null). And after another 3 month I remove any login access.
If you remove a user, it is difficult to find what this user make at xx.yy.zzzz date.

 

[Colin 't Hart]

My 2 cent ideea: never delete a user (if you do not want to remember .... what user I delete a year ago). In this cases I change the password with a new strong and long password. And I also monitor any usage of this user for many month. After 3 month I modified the shell for this user(like /dev/null). And after another 3 month I remove any login access.
If you remove a user, it is difficult to find what this user make at xx.yy.zzzz date.

This is a "Proxmox VE authentication server" realm account, not a Linux user, so the above doesn't apply.

 

[Colin 't Hart]

If you delete all the permissions from this user and its group then yes, he cannot do anything anymore.
The permissions add roles to object paths (e.g., '/' == whole cluster, /vms/100' == vm/ct 100, ...), and that either for groups or users.

As a simply way to ensure he cannot access anything without deleting it, you may give this user the NoAccess role on the root path '/' and check 'propagate'.
We always give deny permissions higher priorities than allow permissions so he should not be able to do anything anymore.

Thanks. You've confirmed my understanding that the user accounts don't "own" any objects that would be removed by deleting an account.