gienginali - 線上書籍

:::

新聞載入中，請稍後...

2-2-5-1 proxmox ve 使用者權限管理功能

2-2-5-3 Root 的密碼安全性 next

Proxmox VE 4.x 中文初階學習手冊
=======================

[https://pve.proxmox.com/wiki/User\_Management](https://pve.proxmox.com/wiki/User_Management)

<div class="mw-cookiewarning-container"><div class="mw-cookiewarning-text">[<span></span>](https://pve.proxmox.com/wiki/User_Management)[<span>Cookies help us deliver our services. By using our services, you agree to our use of cookies.</span>](https://pve.proxmox.com/wiki/User_Management) [More information](https://www.proxmox.com/en/privacy-policy) <form method="POST"> </form> </div> </div><div class="noprint" id="mw-page-base"> </div><div class="noprint" id="mw-head-base"> </div><div class="mw-body" id="content" role="main"><a id="top"></a><div class="mw-indicators mw-body-content"> </div>[User Management](https://pve.proxmox.com/wiki/User_Management)
===============================================================

<div class="mw-body-content" id="bodyContent"><div id="contentSub"> </div> </div> </div><div class="mw-body" id="content" role="main"><div class="mw-body-content" id="bodyContent"><div class="mw-content-ltr" dir="ltr" id="mw-content-text" lang="en"><div class="toc" id="toc" style="display: table;"><div id="toctitle">[Contents](https://pve.proxmox.com/wiki/User_Management)
--------------------------------------------------------

</div>- [<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management#pveum_users)[<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management)[<span class="toctext">Users</span>](https://pve.proxmox.com/wiki/User_Management)
- [<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management#pveum_authentication_realms)[<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management)[<span class="toctext">Authentication Realms</span>](https://pve.proxmox.com/wiki/User_Management)
- [<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management#_two_factor_authentication)[<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management)[<span class="toctext">Two factor authentication</span>](https://pve.proxmox.com/wiki/User_Management)
- [<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management#pveum_permission_management)[<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management)[<span class="toctext">Permission Management</span>](https://pve.proxmox.com/wiki/User_Management)
- [<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management#_command_line_tool)[<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management)[<span class="toctext">Command Line Tool</span>](https://pve.proxmox.com/wiki/User_Management)
- [<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management#_real_world_examples)[<span class="toctext"></span>](https://pve.proxmox.com/wiki/User_Management)[<span class="toctext">Real World Examples</span>](https://pve.proxmox.com/wiki/User_Management)
 
</div><div id="asciidoccontent"><div id="preamble"><div class="sectionbody"><div class="paragraph" id="chapter_user_management">[Proxmox VE supports multiple authentication sources, e.g. Linux PAM, an integrated Proxmox VE authentication server, LDAP, Microsoft Active Directory.](https://pve.proxmox.com/wiki/User_Management)

</div><div class="paragraph">[By using the role based user- and permission management for all objects (VMs, storages, nodes, etc.) granular access can be defined.](https://pve.proxmox.com/wiki/User_Management)

</div> </div> </div><div class="sect1">[Users](https://pve.proxmox.com/wiki/User_Management)
-----------------------------------------------------

<div class="sectionbody"><div class="paragraph">[Proxmox VE stores user attributes in ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">/etc/pve/user.cfg</span></tt>](https://pve.proxmox.com/wiki/User_Management). Passwords are not stored here, users are instead associated with [authentication realms](https://pve.proxmox.com/wiki/User_Management#pveum_authentication_realms)[ described below. Therefore a user is internally often identified by its name and realm in the form ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced"><userid>@<realm></span></tt>](https://pve.proxmox.com/wiki/User_Management).

</div><div class="paragraph">[Each user entry in this file contains the following information:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="ulist">- [First name](https://pve.proxmox.com/wiki/User_Management)
- [Last name](https://pve.proxmox.com/wiki/User_Management)
- [E-mail address](https://pve.proxmox.com/wiki/User_Management)
- [Group memberships](https://pve.proxmox.com/wiki/User_Management)
- [An optional Expiration date](https://pve.proxmox.com/wiki/User_Management)
- [A comment or note about this user](https://pve.proxmox.com/wiki/User_Management)
- [Whether this user is enabled or disabled](https://pve.proxmox.com/wiki/User_Management)
- [Optional two factor authentication keys](https://pve.proxmox.com/wiki/User_Management)
 
</div><div class="sect2">### [System administrator](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[The system’s root user can always log in via the Linux PAM realm and is an unconfined administrator. This user cannot be deleted, but attributes can still be changed and system mails will be sent to the email address assigned to this user.](https://pve.proxmox.com/wiki/User_Management)

</div> </div><div class="sect2">### [Groups](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[Each user can be member of several groups. Groups are the preferred way to organize access permissions. You should always grant permission to groups instead of using individual users. That way you will get a much shorter access control list which is easier to handle.](https://pve.proxmox.com/wiki/User_Management)

</div> </div> </div> </div><div class="sect1">[Authentication Realms](https://pve.proxmox.com/wiki/User_Management)
---------------------------------------------------------------------

<div class="sectionbody"><div class="paragraph">[As Proxmox VE users are just counterparts for users existing on some external realm, the realms have to be configured in ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">/etc/pve/domains.cfg</span></tt>](https://pve.proxmox.com/wiki/User_Management). The following realms (authentication methods) are available:

</div><div class="dlist"> <dl><dt class="hdlist1">[Linux PAM standard authentication](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[In this case a system user has to exist (e.g. created via the ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">adduser</span></tt>](https://pve.proxmox.com/wiki/User_Management) command) on all nodes the user is allowed to login, and the user authenticates with their usual system password.

<div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>useradd heinz
passwd heinz
groupadd watchman
usermod -a -G watchman heinz</tt></a>
```

</div> </div> </dd> <dt class="hdlist1">[Proxmox VE authentication server](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[This is a unix like password store (](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">/etc/pve/priv/shadow.cfg</span></tt>](https://pve.proxmox.com/wiki/User_Management)). Password are encrypted using the SHA-256 hash method. This is the most convenient method for small (or even medium) installations where users do not need access to anything outside of Proxmox VE. In this case users are fully managed by Proxmox VE and are able to change their own passwords via the GUI.

</dd> <dt class="hdlist1">[LDAP](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[It is possible to authenticate users via an LDAP server (e.g. openldap). The server and an optional fallback server can be configured and the connection can be encrypted via SSL.](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[Users are searched under a ](https://pve.proxmox.com/wiki/User_Management)[*Base Domain Name*](https://pve.proxmox.com/wiki/User_Management) ([<tt><span class="monospaced">base\_dn</span></tt>](https://pve.proxmox.com/wiki/User_Management)), with the user name found in the attribute specified in the [*User Attribute Name*](https://pve.proxmox.com/wiki/User_Management) ([<tt><span class="monospaced">user\_attr</span></tt>](https://pve.proxmox.com/wiki/User_Management)) field.

</div><div class="paragraph">[For instance, if a user is represented via the following ldif dataset:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content monospaced"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt># user1 of People at ldap-test.com
dn: uid=user1,ou=People,dc=ldap-test,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: user1
cn: Test User 1
sn: Testers
description: This is the first test user.</tt></a>
```

</div> </div><div class="paragraph">[The ](https://pve.proxmox.com/wiki/User_Management)[*Base Domain Name*](https://pve.proxmox.com/wiki/User_Management) would be [<tt><span class="monospaced">ou=People,dc=ldap-test,dc=com</span></tt>](https://pve.proxmox.com/wiki/User_Management) and the user attribute would be [<tt><span class="monospaced">uid</span></tt>](https://pve.proxmox.com/wiki/User_Management).

</div><div class="paragraph">[If Proxmox VE needs to authenticate (bind) to the ldap server before being able to query and authenticate users, a bind domain name can be configured via the ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">bind\_dn</span></tt>](https://pve.proxmox.com/wiki/User_Management) property in [<tt><span class="monospaced">/etc/pve/domains.cfg</span></tt>](https://pve.proxmox.com/wiki/User_Management). Its password then has to be stored in [<tt><span class="monospaced">/etc/pve/priv/ldap/<realmname>.pw</span></tt>](https://pve.proxmox.com/wiki/User_Management) (e.g. [<tt><span class="monospaced">/etc/pve/priv/ldap/my-ldap.pw</span></tt>](https://pve.proxmox.com/wiki/User_Management)). This file should contain a single line containing the raw password.

</div> </dd> <dt class="hdlist1">[Microsoft Active Directory](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[A server and authentication domain need to be specified. Like with ldap an optional fallback server, optional port, and SSL encryption can be configured.](https://pve.proxmox.com/wiki/User_Management)

</dd> </dl></div> </div> </div><div class="sect1">[Two factor authentication](https://pve.proxmox.com/wiki/User_Management)
-------------------------------------------------------------------------

<div class="sectionbody"><div class="paragraph">[Each realm can optionally be secured additionally by two factor authentication. This can be done by selecting one of the available methods via the ](https://pve.proxmox.com/wiki/User_Management)[*TFA*](https://pve.proxmox.com/wiki/User_Management) dropdown box when adding or editing an Authentication Realm. When a realm has TFA enabled it becomes a requirement and only users with configured TFA will be able to login.

</div><div class="paragraph">[Currently there are two methods available:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="dlist"> <dl><dt class="hdlist1">[Time based OATH (TOTP)](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[This uses the standard HMAC-SHA1 algorithm where the current time is hashed with the user’s configured key. The time step and password length parameters are configured.](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[A user can have multiple keys configured (separated by spaces), and the keys can be specified in Base32 (RFC3548) or hexadecimal notation.](https://pve.proxmox.com/wiki/User_Management)

</div><div class="paragraph">[Proxmox VE provides a key generation tool (](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">oathkeygen</span></tt>](https://pve.proxmox.com/wiki/User_Management)) which prints out a random key in Base32 notation which can be used directly with various OTP tools, such as the [<tt><span class="monospaced">oathtool</span></tt>](https://pve.proxmox.com/wiki/User_Management) command line tool, the Google authenticator or FreeOTP Android apps.

</div> </dd> <dt class="hdlist1">[YubiKey OTP](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[For authenticating via a YubiKey a Yubico API ID, API KEY and validation server URL must be configured, and users must have a YubiKey available. In order to get the key ID from a YubiKey, you can trigger the YubiKey once after connecting it to USB and copy the first 12 characters of the typed password into the user’s ](https://pve.proxmox.com/wiki/User_Management)[*Key IDs*](https://pve.proxmox.com/wiki/User_Management) field.

<div class="paragraph">[Please refer to the ](https://pve.proxmox.com/wiki/User_Management)[YubiKey OTP](https://developers.yubico.com/OTP/)[ documentation for how to use the ](https://pve.proxmox.com/wiki/User_Management)[YubiCloud](https://www.yubico.com/products/services-software/yubicloud/)[ or ](https://pve.proxmox.com/wiki/User_Management)[ host your own verification server](https://developers.yubico.com/Software_Projects/YubiKey_OTP/YubiCloud_Validation_Servers/)[.](https://pve.proxmox.com/wiki/User_Management)

</div> </dd> </dl></div> </div> </div><div class="sect1">[Permission Management](https://pve.proxmox.com/wiki/User_Management)
---------------------------------------------------------------------

<div class="sectionbody"><div class="paragraph">[In order for a user to perform an action (such as listing, modifying or deleting a parts of a VM configuration), the user needs to have the appropriate permissions.](https://pve.proxmox.com/wiki/User_Management)

</div><div class="paragraph">[Proxmox VE uses a role and path based permission management system. An entry in the permissions table allows a user or group to take on a specific role when accessing an ](https://pve.proxmox.com/wiki/User_Management)[*object*](https://pve.proxmox.com/wiki/User_Management) or [*path*](https://pve.proxmox.com/wiki/User_Management). This means an such an access rule can be represented as a triple of [*(path, user, role)*](https://pve.proxmox.com/wiki/User_Management) or [*(path, group, role)*](https://pve.proxmox.com/wiki/User_Management), with the role containing a set of allowed actions, and the path representing the target of these actions.

</div><div class="sect2">### [Roles](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[A role is simply a list of privileges. Proxmox VE comes with a number of predefined roles which satisfies most needs.](https://pve.proxmox.com/wiki/User_Management)

</div><div class="ulist">- [<tt><span class="monospaced">Administrator</span></tt>](https://pve.proxmox.com/wiki/User_Management): 擁有所有特權
- [<tt><span class="monospaced">NoAccess</span></tt>](https://pve.proxmox.com/wiki/User_Management): 沒有特權 (used to forbid access)
- [<tt><span class="monospaced">PVEAdmin</span></tt>](https://pve.proxmox.com/wiki/User_Management): can do most things, but miss rights to modify system settings ([<tt><span class="monospaced">Sys.PowerMgmt</span></tt>](https://pve.proxmox.com/wiki/User_Management), [<tt><span class="monospaced">Sys.Modify</span></tt>](https://pve.proxmox.com/wiki/User_Management), [<tt><span class="monospaced">Realm.Allocate</span></tt>](https://pve.proxmox.com/wiki/User_Management)).
- [<tt><span class="monospaced">PVEAuditor</span></tt>](https://pve.proxmox.com/wiki/User_Management): read only access
- [<tt><span class="monospaced">PVEDatastoreAdmin</span></tt>](https://pve.proxmox.com/wiki/User_Management): create and allocate backup space and templates
- [<tt><span class="monospaced">PVEDatastoreUser</span></tt>](https://pve.proxmox.com/wiki/User_Management): allocate backup space and view storage
- [<tt><span class="monospaced">PVEPoolAdmin</span></tt>](https://pve.proxmox.com/wiki/User_Management): allocate pools
- [<tt><span class="monospaced">PVESysAdmin</span></tt>](https://pve.proxmox.com/wiki/User_Management): User ACLs, audit, system console and system logs
- [<tt><span class="monospaced">PVETemplateUser</span></tt>](https://pve.proxmox.com/wiki/User_Management): view and clone templates
- [<tt><span class="monospaced">PVEUserAdmin</span></tt>](https://pve.proxmox.com/wiki/User_Management): user administration
- [<tt><span class="monospaced">PVEVMAdmin</span></tt>](https://pve.proxmox.com/wiki/User_Management): 完全管理 VM
- [<tt><span class="monospaced">PVEVMUser</span></tt>](https://pve.proxmox.com/wiki/User_Management): view, backup, config CDROM, VM console, VM power management
 
</div><div class="paragraph">[You can see the whole set of predefined roles on the GUI.](https://pve.proxmox.com/wiki/User_Management)

</div><div class="paragraph">[Adding new roles can be done via both GUI and the command line, like this:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum roleadd PVE_Power-only -privs <span style="color: #FF0000">"VM.PowerMgmt VM.Console"</span>
pveum roleadd Sys_Power-only -privs <span style="color: #FF0000">"Sys.PowerMgmt Sys.Console"</span></tt></a>
```

</div> </div> </div><div class="sect2">### [Privileges](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[A privilege is the right to perform a specific action. To simplify management, lists of privileges are grouped into roles, which can then be used in the permission table. Note that privileges cannot directly be assigned to users and paths without being part of a role.](https://pve.proxmox.com/wiki/User_Management)

</div><div class="paragraph">[We currently use the following privileges:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="dlist"> <dl><dt class="hdlist1">[Node / System related privileges](https://pve.proxmox.com/wiki/User_Management)</dt> <dd><div class="ulist">- [<tt><span class="monospaced">Permissions.Modify</span></tt>](https://pve.proxmox.com/wiki/User_Management): modify access permissions
- [<tt><span class="monospaced">Sys.PowerMgmt</span></tt>](https://pve.proxmox.com/wiki/User_Management): Node power management (start, stop, reset, shutdown, …)
- [<tt><span class="monospaced">Sys.Console</span></tt>](https://pve.proxmox.com/wiki/User_Management): console access to Node
- [<tt><span class="monospaced">Sys.Syslog</span></tt>](https://pve.proxmox.com/wiki/User_Management): view Syslog
- [<tt><span class="monospaced">Sys.Audit</span></tt>](https://pve.proxmox.com/wiki/User_Management): view node status/config, Corosync cluster config and HA config
- [<tt><span class="monospaced">Sys.Modify</span></tt>](https://pve.proxmox.com/wiki/User_Management): create/remove/modify node network parameters
- [<tt><span class="monospaced">Group.Allocate</span></tt>](https://pve.proxmox.com/wiki/User_Management): create/remove/modify groups
- [<tt><span class="monospaced">Pool.Allocate</span></tt>](https://pve.proxmox.com/wiki/User_Management): create/remove/modify a pool
- [<tt><span class="monospaced">Realm.Allocate</span></tt>](https://pve.proxmox.com/wiki/User_Management): create/remove/modify authentication realms
- [<tt><span class="monospaced">Realm.AllocateUser</span></tt>](https://pve.proxmox.com/wiki/User_Management): assign user to a realm
- [<tt><span class="monospaced">User.Modify</span></tt>](https://pve.proxmox.com/wiki/User_Management): create/remove/modify user access and details.
 
</div> </dd> <dt class="hdlist1">[Virtual machine related privileges](https://pve.proxmox.com/wiki/User_Management)</dt> <dd><div class="ulist">- [<tt><span class="monospaced">VM.Allocate</span></tt>](https://pve.proxmox.com/wiki/User_Management): create/remove new VM to server inventory
- [<tt><span class="monospaced">VM.Migrate</span></tt>](https://pve.proxmox.com/wiki/User_Management): migrate VM to alternate server on cluster
- [<tt><span class="monospaced">VM.PowerMgmt</span></tt>](https://pve.proxmox.com/wiki/User_Management): power management (start, stop, reset, shutdown, …)
- [<tt><span class="monospaced">VM.Console</span></tt>](https://pve.proxmox.com/wiki/User_Management): console access to VM
- [<tt><span class="monospaced">VM.Monitor</span></tt>](https://pve.proxmox.com/wiki/User_Management): access to VM monitor (kvm)
- [<tt><span class="monospaced">VM.Backup</span></tt>](https://pve.proxmox.com/wiki/User_Management): backup/restore VMs
- [<tt><span class="monospaced">VM.Audit</span></tt>](https://pve.proxmox.com/wiki/User_Management): view VM config
- [<tt><span class="monospaced">VM.Clone</span></tt>](https://pve.proxmox.com/wiki/User_Management): clone/copy a VM
- [<tt><span class="monospaced">VM.Config.Disk</span></tt>](https://pve.proxmox.com/wiki/User_Management): add/modify/delete Disks
- [<tt><span class="monospaced">VM.Config.CDROM</span></tt>](https://pve.proxmox.com/wiki/User_Management): eject/change CDROM
- [<tt><span class="monospaced">VM.Config.CPU</span></tt>](https://pve.proxmox.com/wiki/User_Management): modify CPU settings
- [<tt><span class="monospaced">VM.Config.Memory</span></tt>](https://pve.proxmox.com/wiki/User_Management): modify Memory settings
- [<tt><span class="monospaced">VM.Config.Network</span></tt>](https://pve.proxmox.com/wiki/User_Management): add/modify/delete Network devices
- [<tt><span class="monospaced">VM.Config.HWType</span></tt>](https://pve.proxmox.com/wiki/User_Management): modify emulated HW type
- [<tt><span class="monospaced">VM.Config.Options</span></tt>](https://pve.proxmox.com/wiki/User_Management): modify any other VM configuration
- [<tt><span class="monospaced">VM.Snapshot</span></tt>](https://pve.proxmox.com/wiki/User_Management): create/remove VM snapshots
 
</div> </dd> <dt class="hdlist1">[Storage related privileges](https://pve.proxmox.com/wiki/User_Management)</dt> <dd><div class="ulist">- [<tt><span class="monospaced">Datastore.Allocate</span></tt>](https://pve.proxmox.com/wiki/User_Management): create/remove/modify a data store, delete volumes
- [<tt><span class="monospaced">Datastore.AllocateSpace</span></tt>](https://pve.proxmox.com/wiki/User_Management): allocate space on a datastore
- [<tt><span class="monospaced">Datastore.AllocateTemplate</span></tt>](https://pve.proxmox.com/wiki/User_Management): allocate/upload templates and iso images
- [<tt><span class="monospaced">Datastore.Audit</span></tt>](https://pve.proxmox.com/wiki/User_Management): view/browse a datastore
 
</div> </dd> </dl></div> </div><div class="sect2">### [Objects and Paths](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[Access permissions are assigned to objects, such as a virtual machines, storages or pools of resources. We use file system like paths to address these objects. These paths form a natural tree, and permissions of higher levels (shorter path) can optionally be propagated down within this hierarchy.](https://pve.proxmox.com/wiki/User_Management)

</div><div class="paragraph" id="pveum_templated_paths">[Paths can be templated. When an API call requires permissions on a templated path, the path may contain references to parameters of the API call. These references are specified in curly braces. Some parameters are implicitly taken from the API call’s URI. For instance the permission path ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">/nodes/{node}</span></tt>](https://pve.proxmox.com/wiki/User_Management) when calling [*/nodes/mynode/status*](https://pve.proxmox.com/wiki/User_Management) requires permissions on [<tt><span class="monospaced">/nodes/mynode</span></tt>](https://pve.proxmox.com/wiki/User_Management), while the path [<tt><span class="monospaced">{path}</span></tt>](https://pve.proxmox.com/wiki/User_Management) in a PUT request to [<tt><span class="monospaced">/access/acl</span></tt>](https://pve.proxmox.com/wiki/User_Management) refers to the method’s [<tt><span class="monospaced">path</span></tt>](https://pve.proxmox.com/wiki/User_Management) parameter.

</div><div class="paragraph">[Some examples are:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="ulist">- [<tt><span class="monospaced">/nodes/{node}</span></tt>](https://pve.proxmox.com/wiki/User_Management): Access to Proxmox VE server machines
- [<tt><span class="monospaced">/vms</span></tt>](https://pve.proxmox.com/wiki/User_Management): Covers all VMs
- [<tt><span class="monospaced">/vms/{vmid}</span></tt>](https://pve.proxmox.com/wiki/User_Management): Access to specific VMs
- [<tt><span class="monospaced">/storage/{storeid}</span></tt>](https://pve.proxmox.com/wiki/User_Management): Access to a storages
- [<tt><span class="monospaced">/pool/{poolname}</span></tt>](https://pve.proxmox.com/wiki/User_Management): Access to VMs part of a [pool](https://pve.proxmox.com/wiki/User_Management#pveum_pools)
- [<tt><span class="monospaced">/access/groups</span></tt>](https://pve.proxmox.com/wiki/User_Management): Group administration
- [<tt><span class="monospaced">/access/realms/{realmid}</span></tt>](https://pve.proxmox.com/wiki/User_Management): Administrative access to realms
 
</div><div class="sect3">#### [Inheritance](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[As mentioned earlier, object paths form a file system like tree, and permissions can be inherited down that tree (the propagate flag is set by default). We use the following inheritance rules:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="ulist">- [Permissions for individual users always replace group permissions.](https://pve.proxmox.com/wiki/User_Management)
- [Permissions for groups apply when the user is member of that group.](https://pve.proxmox.com/wiki/User_Management)
- [Permissions replace the ones inherited from an upper level.](https://pve.proxmox.com/wiki/User_Management)
 
</div> </div> </div><div class="sect2">### [Pools](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[Pools can be used to group a set of virtual machines and data stores. You can then simply set permissions on pools (](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">/pool/{poolid}</span></tt>](https://pve.proxmox.com/wiki/User_Management)), which are inherited to all pool members. This is a great way simplify access control.

</div> </div><div class="sect2">### [What permission do I need?](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[The required API permissions are documented for each individual method, and can be found at ](https://pve.proxmox.com/wiki/User_Management)<http://pve.proxmox.com/pve-docs/api-viewer/>

</div><div class="paragraph">[The permissions are specified as a list which can be interpreted as a tree of logic and access-check functions:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="dlist"> <dl><dt class="hdlist1">[<tt><span class="monospaced">\["and", <subtests>...\]</span></tt>](https://pve.proxmox.com/wiki/User_Management) and [<tt><span class="monospaced">\["or", <subtests>...\]</span></tt>](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[Each(](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">and</span></tt>](https://pve.proxmox.com/wiki/User_Management)) or any([<tt><span class="monospaced">or</span></tt>](https://pve.proxmox.com/wiki/User_Management)) further element in the current list has to be true.

</dd> <dt class="hdlist1">[<tt><span class="monospaced">\["perm", <path>, \[ <privileges>... \], <options>...\]</span></tt>](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[The ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">path</span></tt>](https://pve.proxmox.com/wiki/User_Management) is a templated parameter (see [Objects and Paths](https://pve.proxmox.com/wiki/User_Management#pveum_templated_paths)[). All (or , if the ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">any</span></tt>](https://pve.proxmox.com/wiki/User_Management) option is used, any) of the listed privileges must be allowed on the specified path. If a [<tt><span class="monospaced">require-param</span></tt>](https://pve.proxmox.com/wiki/User_Management) option is specified, then its specified parameter is required even if the API call’s schema otherwise lists it as being optional.

</dd> <dt class="hdlist1">[<tt><span class="monospaced">\["userid-group", \[ <privileges>... \], <options>...\]</span></tt>](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[The caller must have any of the listed privileges on ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">/access/groups</span></tt>](https://pve.proxmox.com/wiki/User_Management). In addition there are two possible checks depending on whether the [<tt><span class="monospaced">groups\_param</span></tt>](https://pve.proxmox.com/wiki/User_Management) option is set:

<div class="ulist">- [<tt><span class="monospaced">groups\_param</span></tt>](https://pve.proxmox.com/wiki/User_Management) is set: The API call has a non-optional [<tt><span class="monospaced">groups</span></tt>](https://pve.proxmox.com/wiki/User_Management) parameter and the caller must have any of the listed privileges on all of the listed groups.
- [<tt><span class="monospaced">groups\_param</span></tt>](https://pve.proxmox.com/wiki/User_Management) is not set: The user passed via the [<tt><span class="monospaced">userid</span></tt>](https://pve.proxmox.com/wiki/User_Management) parameter must exist and be part of a group on which the caller has any of the listed privileges (via the [<tt><span class="monospaced">/access/groups/<group></span></tt>](https://pve.proxmox.com/wiki/User_Management) path).
 
</div> </dd> <dt class="hdlist1">[<tt><span class="monospaced">\["userid-param", "self"\]</span></tt>](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[The value provided for the API call’s ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">userid</span></tt>](https://pve.proxmox.com/wiki/User_Management) parameter must refer to the user performing the action. (Usually in conjunction with [<tt><span class="monospaced">or</span></tt>](https://pve.proxmox.com/wiki/User_Management), to allow users to perform an action on themselves even if they don’t have elevated privileges.)

</dd> <dt class="hdlist1">[<tt><span class="monospaced">\["userid-param", "Realm.AllocateUser"\]</span></tt>](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[The user needs ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">Realm.AllocateUser</span></tt>](https://pve.proxmox.com/wiki/User_Management) access to [<tt><span class="monospaced">/access/realm/<realm></span></tt>](https://pve.proxmox.com/wiki/User_Management), with [<tt><span class="monospaced"><realm></span></tt>](https://pve.proxmox.com/wiki/User_Management) referring to the realm of the user passed via the [<tt><span class="monospaced">userid</span></tt>](https://pve.proxmox.com/wiki/User_Management) parameter. Note that the user does not need to exist in order to be associated with a realm, since user IDs are passed in the form of [<tt><span class="monospaced"><username>@<realm></span></tt>](https://pve.proxmox.com/wiki/User_Management).

</dd> <dt class="hdlist1">[<tt><span class="monospaced">\["perm-modify", <path>\]</span></tt>](https://pve.proxmox.com/wiki/User_Management)</dt> <dd>[The ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">path</span></tt>](https://pve.proxmox.com/wiki/User_Management) is a templated parameter (see [Objects and Paths](https://pve.proxmox.com/wiki/User_Management#pveum_templated_paths)[). The user needs either the ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">Permissions.Modify</span></tt>](https://pve.proxmox.com/wiki/User_Management) privilege, or, depending on the path, the following privileges as a possible substitute:

<div class="ulist">- [<tt><span class="monospaced">/storage/...</span></tt>](https://pve.proxmox.com/wiki/User_Management): additionally requires 'Datastore.Allocate`
- [<tt><span class="monospaced">/vms/...</span></tt>](https://pve.proxmox.com/wiki/User_Management): additionally requires 'VM.Allocate`
- [<tt><span class="monospaced">/pool/...</span></tt>](https://pve.proxmox.com/wiki/User_Management): additionally requires 'Pool.Allocate`
  
  <div class="paragraph">[If the path is empty, ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">Permission.Modify</span></tt>](https://pve.proxmox.com/wiki/User_Management) on [<tt><span class="monospaced">/access</span></tt>](https://pve.proxmox.com/wiki/User_Management) is required.
  
   </div>
 
</div> </dd> </dl></div> </div> </div> </div><div class="sect1">[Command Line Tool](https://pve.proxmox.com/wiki/User_Management)
-----------------------------------------------------------------

<div class="sectionbody"><div class="paragraph">[Most users will simply use the GUI to manage users. But there is also a full featured command line tool called ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">pveum</span></tt>](https://pve.proxmox.com/wiki/User_Management) (short for “[**P**](https://pve.proxmox.com/wiki/User_Management)roxmox [**VE**](https://pve.proxmox.com/wiki/User_Management) [**U**](https://pve.proxmox.com/wiki/User_Management)ser [**M**](https://pve.proxmox.com/wiki/User_Management)anager”). Please note that all Proxmox VE command line tools are wrappers around the API, so you can also access those function through the REST API.

</div><div class="paragraph">[Here are some simple usage examples. To show help type:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum</tt></a>
```

</div> </div><div class="paragraph">[or (to show detailed help about a specific command)](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum <span style="font-weight: bold"><span style="color: #0000FF">help</span></span> useradd</tt></a>
```

</div> </div><div class="paragraph">[Create a new user:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum useradd testuser@pve -comment <span style="color: #FF0000">"Just a test"</span></tt></a>
```

</div> </div><div class="paragraph">[Set or Change the password (not all realms support that):](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum passwd testuser@pve</tt></a>
```

</div> </div><div class="paragraph">[Disable a user:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum usermod testuser@pve -enable <span style="color: #993399">0</span></tt></a>
```

</div> </div><div class="paragraph">[Create a new group:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum groupadd testgroup</tt></a>
```

</div> </div><div class="paragraph">[Create a new role:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum roleadd PVE_Power-only -privs <span style="color: #FF0000">"VM.PowerMgmt VM.Console"</span></tt></a>
```

</div> </div> </div> </div><div class="sect1">[Real World Examples](https://pve.proxmox.com/wiki/User_Management)
-------------------------------------------------------------------

<div class="sectionbody"><div class="sect2">### [Administrator Group](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[One of the most wanted features was the ability to define a group of users with full administrator rights (without using the root account).](https://pve.proxmox.com/wiki/User_Management)

</div><div class="paragraph">[Define the group:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum groupadd admin -comment <span style="color: #FF0000">"System Administrators"</span></tt></a>
```

</div> </div><div class="paragraph">[Then add the permission:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum aclmod <span style="color: #990000">/</span> -group admin -role Administrator</tt></a>
```

</div> </div><div class="paragraph">[You can finally add users to the new ](https://pve.proxmox.com/wiki/User_Management)[*admin*](https://pve.proxmox.com/wiki/User_Management) group:

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum usermod testuser@pve -group admin</tt></a>
```

</div> </div> </div><div class="sect2">### [Auditors](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[You can give read only access to users by assigning the ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">PVEAuditor</span></tt>](https://pve.proxmox.com/wiki/User_Management) role to users or groups.

</div><div class="paragraph">[Example1: Allow user ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">joe@pve</span></tt>](https://pve.proxmox.com/wiki/User_Management) to see everything

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum aclmod <span style="color: #990000">/</span> -user joe@pve -role PVEAuditor</tt></a>
```

</div> </div><div class="paragraph">[Example1: Allow user ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">joe@pve</span></tt>](https://pve.proxmox.com/wiki/User_Management) to see all virtual machines

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum aclmod /vms -user joe@pve -role PVEAuditor</tt></a>
```

</div> </div> </div><div class="sect2">### [Delegate User Management](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[If you want to delegate user management to user ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">joe@pve</span></tt>](https://pve.proxmox.com/wiki/User_Management) you can do that with:

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum aclmod /access -user joe@pve -role PVEUserAdmin</tt></a>
```

</div> </div><div class="paragraph">[User ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">joe@pve</span></tt>](https://pve.proxmox.com/wiki/User_Management) can now add and remove users, change passwords and other user attributes. This is a very powerful role, and you most likely want to limit that to selected realms and groups. The following example allows [<tt><span class="monospaced">joe@pve</span></tt>](https://pve.proxmox.com/wiki/User_Management) to modify users within realm [<tt><span class="monospaced">pve</span></tt>](https://pve.proxmox.com/wiki/User_Management) if they are members of group [<tt><span class="monospaced">customers</span></tt>](https://pve.proxmox.com/wiki/User_Management):

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum aclmod /access/realm/pve -user joe@pve -role PVEUserAdmin
pveum aclmod /access/groups/customers -user joe@pve -role PVEUserAdmin</tt></a>
```

</div> </div><div class="admonitionblock"> <table><tbody><tr><td class="icon">[![Note](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAJhUlEQVRoge2ZWWycVxXHf+fce7/vm/GaGCde4pI0aQlJC0kRtE1L00JbLIjY4QkeUB9YHhAIJFCExAsKUkE8IAFFPIDUIqhBRSDRBUqCCimFFBCBpCWx02IaZ3G2SdyxPZ7vHh6+mcnSZnFjKIge6Wj8zYzvPf9z/me5d8TM+F8WfbkNuFx5BcDLLf/fAEZGRmx4eNh6enqsp6fHhoeHbWRk5D9aFeSlVqHNmzfb6H33sHnT7ZQmD5GfOMax6Sm+Pl5h1Yc+xpYtW2SBbX1ReUkRGBkZsdH77mHLW95EOv4Ms3ueJh6YYPHUFF9aljJ63z3cf//9/5FIvKQIDA8P293L2yhVjjH7t51ocDiviFecF46n7XzBreChhx4qNhH5t0XjJUVgx44ddGUZ9b/vIpQDoRQIWSDJAiFL6B9axo4dO4gxAmANWVDLG+Ln82URMRGhVCqRHxonlAPqFXWKC4r6IhI6OMjMzBN4/4LlTUQQEZxzZ32QJAlpmrb+p16vU6vVOHXq1AWjN18AnDj0F971vrs4OnmYJVkoDA4FCPUO172ICgnt7SV++4vvsGhRJx3tJbIsRVVpsUnOBBABBVFEClKYwbKr7sTM7EIUnBcA7z21k7t49x1X8JXvbOWra7rw5QRtcN8PLCfvvZJvb9vJycpJpg4/hp/N0I4SMQs4Jw0A5zBXHGiCaIZIKABgpGlKjPEF0TpT5pUDRXiVt99+Le03r+WzuytM1gO6pB/3+o0cbxvk8yOPMjW6i2iR2lxOjJDHSDMFogmGwzQ7rRJAUpAENAGXIZq2AFzQpvkACCEQcahP+cRH3sKHn9zHXU+MM7rtGeD33NDXzaZynZU9gcezpUw9X6OzIyOakkfF4QEpPG6nDRNNEA2FSgKimETSNCXPc0II57VpXhEolUqoOrxPSLOMT330Dv5SqfKDNR388Y2L+caQsjITNv3pMBs3rOT56ZyZGaM+J0QUxDc0INrWUgggoRGBAOIRAt77hY1AmqaoeJxPcN645jVDbNn8Hj73o8fZ/af9mEE9j9y2YRXt5YzZWmRmzjj1/BwhTXAKzitOHEbeWlc0AVwDnCv8KoZzjotV33lTSL1HNKAuEtKM1169jM98/E6mTk3x4Nbd7Bk7TEdHRvAeVY+hmDqmZwx1kIkiqrhzS2zL+AbNMC6l/80LgHMOEY9oQvBCks5RKpXo7JhFxbhz42pet2aQet1YtLiDJAkIDq8BHwJmwlwOUaD0ojsrNKuUReIZyb9gABCHcwWFgg+0lTPyvIRToVzKWLpkMfV6REQplYvmZCj1uuBUSdJwTg8AXBdoCZMOsBkQBeGi/J83gBgjmABC8AlJGsjzFLMyaXDM1etEA0VR50iCx6mSZhkiijpPjEpQD+SF4WdJrTAewdCFB1CtVlFVVATnhMQnWJqC5aTBk+c5IIgWRoTgSZJAmiZAo1s7hwsppglI+fTiljeYnyHkLQotKIAYI4igzpFHISQOiwEnKTEG8hhRVZw6YjRQLfJGHcF7jleqTBw8znXr12MABnv37efYiSnesG4tiUsRUQwD7JIAzKsPqCqiRbVwweM04XdPjhJN+dvTBxgbn6G9q59yZx9/3HWEb33vN+zc/RzOJ+w/eJLtO8Z5ZNtT7PvHIUQTvvv9X/Lc/mN0d3by3fseRLQwvWh0Fy+h8wbQ2VFG1KM+xfuAqufo8So/fejPPD/rqJys8pvf7eLAoeNMHqnw2U9+kH3jVQ5MClMzKUla5obr13HliiEMmDx6gltvuY7Vr1nBQF8PJopQ9AFTt/AROFfMjCW9XTy19xB33Hodb924jr1j+/nDk3/nzTdei4jw3nfeyCOPbufa1y5jzeoVrcHM8HR3dfHlr/2Q+x94jFtuuh44/9B2PplXDryYLF3STXd3e+t5UXcHY89OsOH6NS2Qed7wpM1Rm50G4MGHH2P961Zy3bqreXrPP5mrzwLt5y6/cACq1eoLCKm+TN/SAebmfn8aUG83PYs7+cnPH+eqKwd5as8/edc7bi02847pmVkATk1VWbF8AOcca1Yv59DkqcYK0tCL02deACqVCldc0YdIwLmEPM9RV6NnUZlPf3wT6oqJcePN6wHhzTeu4/CRCrfctJ4sSxBRli7pYfHEMUSU97/7Th751RP8eec+Yp5zzTVXM9DfDyogBvHS6HTJACYmJnjVoq5GFw0454gCEOnoaMfiNGZFFRFxJGkbywZ6i1NWoy9kWYmbb1gHKCHApuGbisVFGyoYUswa5OR5ftF56JIBjI6OMtDfWwAQ35jnc8AVpRXBohVqUowECKqK4RBxoE0W6gvGCcEjaOEAwEQWdpgbGxujt7erOLO2mk3R8i0Wz9EiuUGz+qlKEQEUaJbI4lTHmTVePKgWzpDGJGpc8CDTlEsuo88++wxXDA0UIUbAOP23KGZKjI48KnkuhcbiPbPCOBoeBikOLk2VxjqNRilaAEqSZGEAbN261bZt+zW33XY7IAXXm6Ou0YhIMamaaUOl5WRrzg00viuKWWxpQUOHNAZFQRpD48Xlkig0MTHBB95zG+VSylz1KCbWyDOh2XyK+56IqjWMKigkUnzWnPPFFFRRLZ29SQRUELOGY4pZ6LKOlM07mZ07d/KOtw1TcB4sGkTDiDQ9K1IkrKeYmQC08d7pZLSiRBpE5s7aS0XAHFEKAGY51Wr18g80Zmb33nsvX/z8XdSmj2AWOXhwkrxe46+79jB55Dh/3T2GxUhHextdXW2sXN7PNWtWIQKDA71FFBoAjIgQkVg/a5+oHrU5zIznDhxk964xKpXKggAoTlWW8+OfPorlOQ//cjsDy1bS2dFOW+diVly1iL6+Pqanpzl5qsL4pPHwN3/G1InDlMsZ7Z1tDA30cfWqIa5dexV9fb2YnT7UTxw4xsHJo4yOjfOP8QOMjx/k4OQx7r777lY0zycXvJ02M4sxMjg4SL1eR0TYsGEDw8PD9PX10d7ejogUN3a1GqpKCIE8z5mdnUVVqVarbN++nba2Nvbu3csDDzyAqrJ8+atb+zjn6e/vZ/Xq1axatYq1a9fS29tLlmUMDQ1RKpXOm9EXvV6v1+tWr9eZnp5mZmaGWq1GjLHF62aiNZ+bnPfe45xrvTZzxMyYmZk56+LXzKjX661DvHOOJElIkoRSqYT3/vLvRlW15eHCa4VxzdvmpjZDfubzuXeb3vuzqCEixBhbo0NTkyS5PAr9L8j/96+U/w3yCoCXW14B8HLLvwDd67nwZIEPdgAAAABJRU5ErkJggg==)](https://pve.proxmox.com/wiki/User_Management)</td> <td class="content">[The user is able to add other users, but only if they are members of group ](https://pve.proxmox.com/wiki/User_Management)[<tt><span class="monospaced">customers</span></tt>](https://pve.proxmox.com/wiki/User_Management) and within realm [<tt><span class="monospaced">pve</span></tt>](https://pve.proxmox.com/wiki/User_Management).</td> </tr></tbody></table>

</div> </div><div class="sect2">### [Pools](https://pve.proxmox.com/wiki/User_Management)

<div class="paragraph">[An enterprise is usually structured into several smaller departments, and it is common that you want to assign resources to them and delegate management tasks. A pool is simply a set of virtual machines and data stores. You can create pools on the GUI. After that you can add resources to the pool (VMs, Storage).](https://pve.proxmox.com/wiki/User_Management)

</div><div class="paragraph">[You can also assign permissions to the pool. Those permissions are inherited to all pool members.](https://pve.proxmox.com/wiki/User_Management)

</div><div class="paragraph">[Lets assume you have a software development department, so we first create a group](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum groupadd developers -comment <span style="color: #FF0000">"Our software developers"</span></tt></a>
```

</div> </div><div class="paragraph">[Now we create a new user which is a member of that group](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum useradd developer1@pve -group developers -password</tt></a>
```

</div> </div><div class="admonitionblock"> <table><tbody><tr><td class="icon">[![Note](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAJhUlEQVRoge2ZWWycVxXHf+fce7/vm/GaGCde4pI0aQlJC0kRtE1L00JbLIjY4QkeUB9YHhAIJFCExAsKUkE8IAFFPIDUIqhBRSDRBUqCCimFFBCBpCWx02IaZ3G2SdyxPZ7vHh6+mcnSZnFjKIge6Wj8zYzvPf9z/me5d8TM+F8WfbkNuFx5BcDLLf/fAEZGRmx4eNh6enqsp6fHhoeHbWRk5D9aFeSlVqHNmzfb6H33sHnT7ZQmD5GfOMax6Sm+Pl5h1Yc+xpYtW2SBbX1ReUkRGBkZsdH77mHLW95EOv4Ms3ueJh6YYPHUFF9aljJ63z3cf//9/5FIvKQIDA8P293L2yhVjjH7t51ocDiviFecF46n7XzBreChhx4qNhH5t0XjJUVgx44ddGUZ9b/vIpQDoRQIWSDJAiFL6B9axo4dO4gxAmANWVDLG+Ln82URMRGhVCqRHxonlAPqFXWKC4r6IhI6OMjMzBN4/4LlTUQQEZxzZ32QJAlpmrb+p16vU6vVOHXq1AWjN18AnDj0F971vrs4OnmYJVkoDA4FCPUO172ICgnt7SV++4vvsGhRJx3tJbIsRVVpsUnOBBABBVFEClKYwbKr7sTM7EIUnBcA7z21k7t49x1X8JXvbOWra7rw5QRtcN8PLCfvvZJvb9vJycpJpg4/hp/N0I4SMQs4Jw0A5zBXHGiCaIZIKABgpGlKjPEF0TpT5pUDRXiVt99+Le03r+WzuytM1gO6pB/3+o0cbxvk8yOPMjW6i2iR2lxOjJDHSDMFogmGwzQ7rRJAUpAENAGXIZq2AFzQpvkACCEQcahP+cRH3sKHn9zHXU+MM7rtGeD33NDXzaZynZU9gcezpUw9X6OzIyOakkfF4QEpPG6nDRNNEA2FSgKimETSNCXPc0II57VpXhEolUqoOrxPSLOMT330Dv5SqfKDNR388Y2L+caQsjITNv3pMBs3rOT56ZyZGaM+J0QUxDc0INrWUgggoRGBAOIRAt77hY1AmqaoeJxPcN645jVDbNn8Hj73o8fZ/af9mEE9j9y2YRXt5YzZWmRmzjj1/BwhTXAKzitOHEbeWlc0AVwDnCv8KoZzjotV33lTSL1HNKAuEtKM1169jM98/E6mTk3x4Nbd7Bk7TEdHRvAeVY+hmDqmZwx1kIkiqrhzS2zL+AbNMC6l/80LgHMOEY9oQvBCks5RKpXo7JhFxbhz42pet2aQet1YtLiDJAkIDq8BHwJmwlwOUaD0ojsrNKuUReIZyb9gABCHcwWFgg+0lTPyvIRToVzKWLpkMfV6REQplYvmZCj1uuBUSdJwTg8AXBdoCZMOsBkQBeGi/J83gBgjmABC8AlJGsjzFLMyaXDM1etEA0VR50iCx6mSZhkiijpPjEpQD+SF4WdJrTAewdCFB1CtVlFVVATnhMQnWJqC5aTBk+c5IIgWRoTgSZJAmiZAo1s7hwsppglI+fTiljeYnyHkLQotKIAYI4igzpFHISQOiwEnKTEG8hhRVZw6YjRQLfJGHcF7jleqTBw8znXr12MABnv37efYiSnesG4tiUsRUQwD7JIAzKsPqCqiRbVwweM04XdPjhJN+dvTBxgbn6G9q59yZx9/3HWEb33vN+zc/RzOJ+w/eJLtO8Z5ZNtT7PvHIUQTvvv9X/Lc/mN0d3by3fseRLQwvWh0Fy+h8wbQ2VFG1KM+xfuAqufo8So/fejPPD/rqJys8pvf7eLAoeNMHqnw2U9+kH3jVQ5MClMzKUla5obr13HliiEMmDx6gltvuY7Vr1nBQF8PJopQ9AFTt/AROFfMjCW9XTy19xB33Hodb924jr1j+/nDk3/nzTdei4jw3nfeyCOPbufa1y5jzeoVrcHM8HR3dfHlr/2Q+x94jFtuuh44/9B2PplXDryYLF3STXd3e+t5UXcHY89OsOH6NS2Qed7wpM1Rm50G4MGHH2P961Zy3bqreXrPP5mrzwLt5y6/cACq1eoLCKm+TN/SAebmfn8aUG83PYs7+cnPH+eqKwd5as8/edc7bi02847pmVkATk1VWbF8AOcca1Yv59DkqcYK0tCL02deACqVCldc0YdIwLmEPM9RV6NnUZlPf3wT6oqJcePN6wHhzTeu4/CRCrfctJ4sSxBRli7pYfHEMUSU97/7Th751RP8eec+Yp5zzTVXM9DfDyogBvHS6HTJACYmJnjVoq5GFw0454gCEOnoaMfiNGZFFRFxJGkbywZ6i1NWoy9kWYmbb1gHKCHApuGbisVFGyoYUswa5OR5ftF56JIBjI6OMtDfWwAQ35jnc8AVpRXBohVqUowECKqK4RBxoE0W6gvGCcEjaOEAwEQWdpgbGxujt7erOLO2mk3R8i0Wz9EiuUGz+qlKEQEUaJbI4lTHmTVePKgWzpDGJGpc8CDTlEsuo88++wxXDA0UIUbAOP23KGZKjI48KnkuhcbiPbPCOBoeBikOLk2VxjqNRilaAEqSZGEAbN261bZt+zW33XY7IAXXm6Ou0YhIMamaaUOl5WRrzg00viuKWWxpQUOHNAZFQRpD48Xlkig0MTHBB95zG+VSylz1KCbWyDOh2XyK+56IqjWMKigkUnzWnPPFFFRRLZ29SQRUELOGY4pZ6LKOlM07mZ07d/KOtw1TcB4sGkTDiDQ9K1IkrKeYmQC08d7pZLSiRBpE5s7aS0XAHFEKAGY51Wr18g80Zmb33nsvX/z8XdSmj2AWOXhwkrxe46+79jB55Dh/3T2GxUhHextdXW2sXN7PNWtWIQKDA71FFBoAjIgQkVg/a5+oHrU5zIznDhxk964xKpXKggAoTlWW8+OfPorlOQ//cjsDy1bS2dFOW+diVly1iL6+Pqanpzl5qsL4pPHwN3/G1InDlMsZ7Z1tDA30cfWqIa5dexV9fb2YnT7UTxw4xsHJo4yOjfOP8QOMjx/k4OQx7r777lY0zycXvJ02M4sxMjg4SL1eR0TYsGEDw8PD9PX10d7ejogUN3a1GqpKCIE8z5mdnUVVqVarbN++nba2Nvbu3csDDzyAqrJ8+atb+zjn6e/vZ/Xq1axatYq1a9fS29tLlmUMDQ1RKpXOm9EXvV6v1+tWr9eZnp5mZmaGWq1GjLHF62aiNZ+bnPfe45xrvTZzxMyYmZk56+LXzKjX661DvHOOJElIkoRSqYT3/vLvRlW15eHCa4VxzdvmpjZDfubzuXeb3vuzqCEixBhbo0NTkyS5PAr9L8j/96+U/w3yCoCXW14B8HLLvwDd67nwZIEPdgAAAABJRU5ErkJggg==)](https://pve.proxmox.com/wiki/User_Management)</td> <td class="content">[The -password parameter will prompt you for a password](https://pve.proxmox.com/wiki/User_Management)</td> </tr></tbody></table>

</div><div class="paragraph">[I assume we already created a pool called “dev-pool” on the GUI. So we can now assign permission to that pool:](https://pve.proxmox.com/wiki/User_Management)

</div><div class="listingblock"><div class="content"> ```

<a href="https://pve.proxmox.com/wiki/User_Management" target="_blank"><tt>pveum aclmod /pool/dev-pool<span style="color: #990000">/</span> -group developers -role PVEAdmin</tt></a>
```

</div> </div><div class="paragraph">[Our software developers can now administrate the resources assigned to that pool.](https://pve.proxmox.com/wiki/User_Management)

</div> </div> </div> </div> </div><div id="footnotes"> </div> </div><div class="catlinks" data-mw="interface" id="catlinks"><div class="mw-normal-catlinks" id="mw-normal-catlinks">[Categories](https://pve.proxmox.com/wiki/Special:Categories "Special:Categories")[:](https://pve.proxmox.com/wiki/User_Management)- [Reference Documentation](https://pve.proxmox.com/wiki/Category:Reference_Documentation "Category:Reference Documentation")
- [HOWTO](https://pve.proxmox.com/wiki/Category:HOWTO "Category:HOWTO")
 
</div> </div><div class="visualClear"> </div> </div> </div><div id="mw-navigation">[Navigation menu](https://pve.proxmox.com/wiki/User_Management)
---------------------------------------------------------------

<div id="mw-head"><div aria-labelledby="p-personal-label" id="p-personal" role="navigation">- [Log in](https://pve.proxmox.com/mediawiki/index.php?title=Special:UserLogin&returnto=User+Management "You are encouraged to log in; however, it is not mandatory [Alt+Shift+o]")
 
</div><div id="left-navigation"><div aria-labelledby="p-namespaces-label" class="vectorTabs" id="p-namespaces" role="navigation">- 
 
</div> </div> </div> </div><div id="mw-navigation"><div id="mw-head"><div id="left-navigation"><div aria-labelledby="p-namespaces-label" class="vectorTabs" id="p-namespaces" role="navigation">- [<span></span>](https://pve.proxmox.com/wiki/User_Management)[Page](https://pve.proxmox.com/wiki/User_Management "View the content page [Alt+Shift+c]")
- <span>[Discussion](https://pve.proxmox.com/mediawiki/index.php?title=Talk:User_Management&action=edit&redlink=1 "Discussion about the content page [Alt+Shift+t]")</span>
 
</div> </div><div id="right-navigation"><div aria-labelledby="p-views-label" class="vectorTabs" id="p-views" role="navigation">- <span>[Read](https://pve.proxmox.com/wiki/User_Management)</span>
- <span>[View source](https://pve.proxmox.com/mediawiki/index.php?title=User_Management&action=edit "This page is protected.
  You can view its source [Alt+Shift+e]")</span>
- <span>[View history](https://pve.proxmox.com/mediawiki/index.php?title=User_Management&action=history "Past revisions of this page [Alt+Shift+h]")</span>
 
</div><div id="p-search" role="search">### <label for="searchInput">Search</label>

<form action="/mediawiki/index.php" id="searchform"><div id="simpleSearch"><input accesskey="f" autocomplete="off" id="searchInput" name="search" placeholder="Search Proxmox VE" tabindex="1" title="Search Proxmox VE [Alt+Shift+f]" type="search"></input></div> </form> </div> </div> </div> </div><div id="mw-navigation"><div id="mw-panel"><div id="p-logo" role="banner"> </div><div aria-labelledby="p-navigation-label" class="portal" id="p-navigation" role="navigation"><div class="body">- [Proxmox VE Wiki](https://pve.proxmox.com/wiki/Main_Page)
- [Downloads](https://pve.proxmox.com/wiki/Downloads)
- [Installation](https://pve.proxmox.com/wiki/Installation)
- [Get support](https://pve.proxmox.com/wiki/Get_support)
- [](https://pve.proxmox.com/wiki/Special:RecentChanges "A list of recent changes in the wiki [Alt+
      ")

</div></div></div></div>

:::

展開 | 闔起

文章類別

書籍目錄

展開 | 闔起

線上使用者

7人線上 (6人在瀏覽線上書籍)

會員: 0

訪客: 7

更多…

MarkDown

文章類別

書籍目錄

線上使用者