User Management - Sync across two machine cluster

[fwoodbridge]

Hello.

Sorry, but I've searched around and I can't get my head around why a user can log on to the 01 machine but can't to the 02 machine.
I've changed the description on 01 and that got synchronized to 02, but not the passwords, apparently. Some help would be appreciated.

Thank you!

 

[shanreich]

Depends on which authentication realm you are using. From what it sounds like you are using 'Linux PAM Standard Authentication'. This uses the user information from the host system, so the user needs to exist as a user on the system you are trying to log in to. You need to create the user on each host system then, PVE provides no way of syncing that.

If you want simple central management of users, you could use 'Proxmox VE Authentication Server' instead, which is probably what you want.

You can read more about this on our Wiki [1]

[1] https://pve.proxmox.com/wiki/User_Management#pveum_authentication_realms

 

[fwoodbridge]

Thanks for the response. The realm is "pmg". What you're saying, please correct me, is that if I create a user, "A" on server1 and assign a password, create the same user, "A" on server2 and assign the same password, when "A" logs on to either server1 or server2, they can log on with the same password? Because if so, it's not working on server2.
How does one go about converting the users to using the PVE authentication server?
I should add that this is not a VE environment, it's for the mail firewall product.

 

[shanreich]

Sorry, I misread the sub-forum. Everything I said is not applicable for PMG.

In PMG clusters, users and their passwords should get synced after you create them. I just tried it, and it took awhile (1 - 2 minutes), so trying to log in immediately after creation does not work. You could check the configuration file on the nodes to see if the sync was successful (/etc/pmg/user.conf). If it is not in sync you could try running pmgcm sync and see if there are any problems with the sync itself.

 

[fwoodbridge]

I had created two identical accounts. How do I get back to a working configuration? Do I remove the system account on Server2 and let the synchronization process recreate the account from Server1 to Server2?
Edit: I did just that and ran the pmgcm sync command to synchronize across and that worked. Thanks, you may close this ticket.