Hi, I am rather new to proxmox, I only use it for a couple vms, but I would like to disable the root login on the webgui only, as I'd still like to use root on the nodes themselves. Is this possible?
Thanks!
Thanks!
Remove root WebGui Login only
- Thread starter happyhourxd
- Start date
USE AT YOUR OWN RISK
THIS MAY DISABLE THE ROOT USER PERMANENTLY AND THUS CANNOT BE UNDONE.
It can be done but if you need to login as root for any reason, it is going to be a real pain in the **s to reactivate the root login. (And impossible if you have no other users with the correct permissions to change users.)
Disabling root is done the same way as disabling any other user.
Go to datacenter -> Permissions -> Users -> root@pam and uncheck the enabled box.
Now you should not be able to login with root via the GUI. (Via SSH is still possible as the cannot be disabled without big problems.)
NOTE:
If I remember correctly this also disables the root user from using the commands in the terminal.
This means that you cannot do anything with the root user even if you login via SSH and use the commands as the root user is disabled and not allowed to talk to the API that it needs for the commands.
THIS MAY DISABLE THE ROOT USER PERMANENTLY AND THUS CANNOT BE UNDONE.
It can be done but if you need to login as root for any reason, it is going to be a real pain in the **s to reactivate the root login. (And impossible if you have no other users with the correct permissions to change users.)
Disabling root is done the same way as disabling any other user.
Go to datacenter -> Permissions -> Users -> root@pam and uncheck the enabled box.
Now you should not be able to login with root via the GUI. (Via SSH is still possible as the cannot be disabled without big problems.)
NOTE:
If I remember correctly this also disables the root user from using the commands in the terminal.
This means that you cannot do anything with the root user even if you login via SSH and use the commands as the root user is disabled and not allowed to talk to the API that it needs for the commands.
This is done for good reasons.
Everything is run through root.
This is why you cannot disable root without big issues.
I always just add a TFA method to at least the root user to stop bots and guessers dead in there tracks. (And use fail@ban to get them blocked after 5 failed attempts.)
Then just create a couple of users with different permissions so that I normally do not need root for day to day and standard maintenance stuff.
It is good practice to use users with the least amount of privileges you can get away with to do the thinks you need to do.
And just let the root user be.
Disabling root in any way is not supported (even the way I suggested) and can and will cause big issues sooner or later.
Everything is run through root.
This is why you cannot disable root without big issues.
I always just add a TFA method to at least the root user to stop bots and guessers dead in there tracks. (And use fail@ban to get them blocked after 5 failed attempts.)
Then just create a couple of users with different permissions so that I normally do not need root for day to day and standard maintenance stuff.
It is good practice to use users with the least amount of privileges you can get away with to do the thinks you need to do.
And just let the root user be.
Disabling root in any way is not supported (even the way I suggested) and can and will cause big issues sooner or later.
