[SOLVED] Shutdown the server via API

[fireon]

Hello all,

i would like to shutdown my servers with the API. What have i done?

• Add a new user to proxmox as PVE user
• Add a new role "shutdown"
• Add ACL Sys.PowerMgmt to the Usergroup

Now i found this CMD:

curl 'https://HOSTNAME:8006/api2/extjs/nodes/virtu02/status' -H 'Cookie: PVEAuthCookie=REPLACEMEWITHCORRECTCOOKIE' -H 'Content-Type: application/x-www-form-urlencoded' -H 'CSRFPreventionToken: REPLACEMEWITHCORRECTTOKEN' --data 'command=shutdown' --insecure

So where i get the PVEAuthCookie and the CSRFPreventionToken?

I'am using Proxmox 7.0.x

Very Thanks.

 

[try]

FYI
https://pve.proxmox.com/wiki/Proxmox_VE_API

 

[fireon]

FYI
https://pve.proxmox.com/wiki/Proxmox_VE_API

This helped a littel bit. So i see the the auth is working right:

curl -H 'Authorization: PVEAPIToken=myapiuser@pve!token=XXX-XXXX-XXXX-XXXX-XXXXX' https://pvehost1:8006/api2/json/nodes/pvehost2

{"data":[{"name":"aplinfo"},{"name":"apt"},{"name":"capabilities"},{"name":"ceph"},{"name":"certificates"},{"name":"config"},{"name":"disks"},{"name":"dns"},{"name":"firewall"},{"name":"hosts"},{"name":"journal"},{"name":"lxc"},{"name":"netstat"},{"name":"network"},{"name":"qemu"},{"name":"query-url-metadata"},{"name":"replication"},{"name":"report"},{"name":"rrd"},{"name":"rrddata"},{"name":"scan"},{"name":"services"},{"name":"spiceshell"},{"name":"startall"},{"name":"status"},{"name":"stopall"},{"name":"storage"},{"name":"subscription"},{"name":"syslog"},{"name":"tasks"},{"name":"termproxy"},{"name":"time"},{"name":"version"},{"name":"vncshell"},{"name":"vzdump"},{"name":"wakeonlan"}]}%

So now is the question how to i trigger an shutdown correctly?

curl 'https://pvehost1:8006/api2/json/nodes/pvehost22' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Authorization: PVEAPIToken=killbox@pve!token=XXX-XXXX-XXXX-XXXX-XXXXX' --data 'command=shutdown' --insecure

The only thing what i get back is: {"data":null}% The same if i use poweroff.

 

[fabian]

you need to POST to the status endpoint of the node:

https://pve.proxmox.com/pve-docs/api-viewer/#/nodes/{node}/status

 

[fireon]

you need to POST to the status endpoint of the node:

https://pve.proxmox.com/pve-docs/api-viewer/#/nodes/{node}/status

{"data":{"wait":0.000164823499244626,"uptime":1472415,"swap":{"total":0,"used":0,"free":0},"loadavg":["0.03","0.01","0.00"],"idle":0,"ksm":{"shared":0},"rootfs":{"total":218614071296,"avail":214829236224,"used":3784835072,"free":214829236224},"kversion":"Linux 5.11.22-4-pve #1 SMP PVE 5.11.22-8 (Fri, 27 Aug 2021 11:51:34 +0200)","memory":{"used":3514982400,"free":13162606592,"total":16677588992},"cpu":0.00758188096525277,"pveversion":"pve-manager/7.0-11/63d82f4e","cpuinfo":{"flags":"fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm cpuid_fault epb invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid xsaveopt dtherm arat pln pts flush_l1d","model":"Intel(R) Core(TM) i3-4170 CPU @ 3.70GHz","sockets":1,"mhz":"3700.000","cpus":4,"cores":2,"user_hz":100,"hvm":"1"}}}

 

[fabian]

you need to use POST, not GET..

 

[fireon]

curl -XPOST -H 'Authorization: PVEAPIToken=killbox@pve!tokenname22=XXXX-XXX-XXXX-XXXX' https://pvehost1:8006/api2/json/nodes/pvehost22/status --data 'command=shutdown' --insecure

Even when I type that in, I get the same output.

{"data":null}%

Now i have installed an virtual testproxmox, but i get the same result

curl -XPOST -H 'Authorization: PVEAPIToken=killbox@pve!bnvmhvvb=5300f436-a3d9-4eb2-9465-2347309f11ae' https://192.168.3.5:8006/api2/json/nodes/pvetest/status --data 'command=shutdown' --insecure

What i'am doing wrong? Here are my configs:

cat user.cfg

user:killbox@pve:1:0::::::
token:killbox@pve!bnvmhvvb:0:1::
user:root@pam:1:0:::bla@bla.blabla:::

group:killboxgroup:::


role:shutdown:Sys.PowerMgmt:

acl:1:/:@killboxgroup:shutdown:

 

[fabian]

check with the permissions button in the GUI - your token likely doesn't have the required permissions (for example, you have a group killboxgroup that has a certain role, but no members).

 

[fireon]

check with the permissions button in the GUI - your token likely doesn't have the required permissions (for example, you have a group killboxgroup that has a certain role, but no members).

You are right, i must have overlooked that. Thank you. I have corrected it now.

user:killbox@pve:1:0::::::
token:killbox@pve!bnvmhvvb:0:1::
user:root@pam:1:0:::bla@bla.blabla:::

group:killboxgroup:killbox@pve::

role:shutdown:Sys.PowerMgmt:

acl:1:/:@killboxgroup:shutdown:

The result is the same.

 

[fabian]

your token has the privilege separation feature enabled, so it's privileges are a separately defined subset of those of the user so either extend the ACL to also include the token, or remove the privilege separation.

 

[fireon]

your token has the privilege separation feature enabled, so it's privileges are a separately defined subset of those of the user so either extend the ACL to also include the token, or remove the privilege separation.

OMG, it is working! It's in the documentary....



The output is still the same with

{"data":null}%

but i works fine.