Unable to run shutdown/poweroff from console with user account.

Frozenstiff

Member
Feb 10, 2020
16
1
8
44
In an attempt to give employees an opportunity to shutdown the servers before the power goes out if I'm unreachable, I created a role with only Sys.Console and Sys.PowerMgmt permissions. I then made a "shutdown" group and a "shutdown" user and assigned the role to the group with the only user in it being "shutdown".

When I try using the "poweroff" command it says it can't be found(I'm assuming it is an alias that isn't accessible to this account). I was also unable to issue the command from the /sbin folder, "ssh -t shutdown@Node2-R610 '/sbin/shutdown' ", without getting:

1618138542981.png

I also added the Sys.Modify to the role with the same results. As you can see from the following the permissions seem to be granted to the user:

1618138730296.png

It doesn't show me the shutdown options in the web interface when on that account either, but the less the employees know about the server more secure I would feel so I'm just trying to get the console command working.

1618139128037.png


Am I missing a permission, or would it be easier if I changed the ownership of /sbin/shutdown to the "shutdown" group then add root to that group and see if it runs from there? I've read I could also add a "shutdown.allow" for access control, but it would need some ACL package. I didn't want to change that if there is a way to fix it without installing extra packages.

Edit: I was going to try editing the "sudoers" file(as per this thread), but it is non-existent and there is only a directory of /etc/sudoers.d with the file "zfs". Would I be able to add a file with an entry in here? Also, would there be a way to script it to shutdown multiple nodes with one remaining until the others are powered off, then shutting itself down? That way I can issue one command on one server and not have to worry about having someone login on each server to shut it down. It would also simplify the employees checking if the last VM host server has gone down so the NAS can be shutdown after everything accessing it is offline. A solution that works with a HA setup would be very helpful.

Any advice on the topic would be appreciated.

Thanks in Advance.
 
Last edited:
sudo is not installed by default. If there is no visudo command to edit the sudoers file, use apt-get install sudo to install it.

Right, but I'm trying to avoid doing it that way if there is a built-in way to let people execute commands from the console. It seems like my permissions are correct, but I'm unable to shutdown the system through the webpage or console from the "shutdown" user account.
 
I am having the same issue. I have a user assigned to a group that just has the Sys.PowerMgmt permission assigned, but the option to shutdown or reboot in the web gui is grayed out. If I add Sys.Audit, the user is able to reboot the node, but is also to see a bunch of things they do not need to see. All the user needs to do is reboot, I'd like to permit as little extra permissions as possible.
 
Last edited:
I am having the same issue. I have a user assigned to a group that just has the Sys.PowerMgmt permission assigned, but the option to shutdown or reboot in the web gui is grayed out. If I add Sys.Audit, the user is able to reboot the node, but is also to see a bunch of things they do not need to see. All the user needs to do is reboot, I'd like to permit as little extra permissions as possible.

If you look at the API for the "status" node [1], you'll see that the GET needs Sys.Audit, and the POST (which is used to shutdown/reboot) needs the Sys.PowerMgmt. Because the UI will always first GET the status of the node before you're allowed to send something back with a POST, it will need both permissions UNLESS you use the API to send the shutdown/reboot command with a token with just the Sys.PowerMgmt permission (but then even with the Audit permission, the user would not see anything since you're building it into API-requests through some mean).

[1] https://pve.proxmox.com/pve-docs/api-viewer/#/nodes/{node}/status
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!