Least privileges option between PDM & PVE/PBS

[Taledo]

Hi all,

First, I wanted to thank the Proxmox Team for their work on PDM, as this tool will certainly help us to manage our multiple clusters / PBS across datacentres.

Now, I'm playing with this in the lab, and was wondering what were the mandatory permissions in order for PDM to work?
As I'm sure you're aware, PDM will have a central place in the Proxmox Systems management, and as such a bad actor gaining access to it would be... bad (citation needed).

For the PBS remotes, the audit role (has sys.audit and datastore.audit) should do the trick nicely. But for PVEs, there's more, as we're dealing with migrations between clusters.

Best regards,


Taledo

 

[fabian]

that depends what kind of actions you want to do over PDM. you can give it audit access only, then it will only be able to see things but not change them. if you want to start/stop/.. guests, you need to give it power management privileges on those guests. for migration, you need to give it migration privileges, including "Sys.Incoming" for remote migrations. the documentation and setup of this should hopefully get better in the near future!