Permit active directory domain users to run elevated commands

[Diyaa]

Hello everyone,

I am trying to set up active directory authentication on proxmox to allow domain users in a domain local security group to run elevated commands on proxmox. The domain joining worked on the WebUI, but I get an error when I click the shell button in the top right of the WebUI.






so I am not sure if my thinking is correct here, but I am thinking that this is due to PAM authentication.
Can anyone guide me to a way to resolve this issue??
Thank you in advance,

 

[Diyaa]

I think I found the solution in another forum referring to the security risks and how the shell can only be accessed by the root user.

https://forum.proxmox.com/threads/c...n-node-shell-with-activedirectory-user.69370/

I apologize for making a duplicate post, but I would still be wondering about setting up authentication for domain users if that is possible!

Thank you!

 

[fabian]

the host shell is restricted to users existing on the local system (the PAM realm in PVE). if you really need to give LDAP users access to the host shell, you could configure PAM on the PVE host to authenticate against LDAP/AD, and then write a script that adds the user entries in the PAM realm (via pveum or the API).

the reasoning here is that we only want to give shell access to users that (likely) could login on the shell (local, or via SSH) anyway.

 

[Diyaa]

the host shell is restricted to users existing on the local system (the PAM realm in PVE). if you really need to give LDAP users access to the host shell, you could configure PAM on the PVE host to authenticate against LDAP/AD, and then write a script that adds the user entries in the PAM realm (via pveum or the API).

the reasoning here is that we only want to give shell access to users that (likely) could login on the shell (local, or via SSH) anyway.

Thank you very much for providing this many details!

I do see the point behind your reasoning.