Proxmox users and permissions let each admin, customer or script have only the access they need. Logging in as root@pam for everything works, but one leaked password then controls every VM.
Before you start
- Access as
root@pamor another admin. - Know the two main realms: Linux PAM (system users on the node) and Proxmox VE authentication server (
@pve, users stored by Proxmox, shared across a cluster).
Create a group and user
- Datacenter → Permissions → Groups → Create, for example
adminsorcustomer-a. - Datacenter → Permissions → Users → Add: choose realm Proxmox VE authentication server, a username, password and the group.
Assign roles with Proxmox permissions
Permissions combine a path, a user or group, and a role.
| Path | Role | Result |
|---|---|---|
/ | Administrator | Full control of everything |
/vms/105 | PVEVMUser | Console, power and backups of VM 105 only |
/pool/customer-a | PVEVMAdmin | Manage all VMs in the resource pool |
/ | PVEAuditor | Read-only view |
- Datacenter → Permissions → Add → Group Permission.
- Pick the path, the group and the role, keep Propagate ticked to include child objects.
Tip: Resource pools (Datacenter → Permissions → Pools) group VMs and storage for one team or customer, so one permission on the pool covers all of them.
Create an API token
- Datacenter → Permissions → API Tokens → Add, select the user and a token ID such as
automation. - Untick Privilege Separation only if the token should have all the user's rights; otherwise give the token its own permissions.
- Copy the secret now; it is shown once.
Use it with a header like Authorization: PVEAPIToken=user@pve!automation=SECRET.
Turn on two-factor authentication
- Log in as the user and open Datacenter → Permissions → Two Factor (or the user menu → TFA).
- Add a TOTP entry, scan the QR code with an authenticator app and confirm with a code.
- Add Recovery Keys and store them safely.
Troubleshooting
- User sees an empty tree: no permission has been assigned on any path.
- Login failed for a @pve user: make sure the correct realm is selected on the login screen.
- API token gets 403: privilege separation is on and the token has no permissions of its own.
Frequently asked questions
Should I disable root login?
Keep root@pam for emergencies with a strong password and 2FA, and use personal admin accounts day to day.
Can customers get their own VM access?
Yes, with PVEVMUser on their VMs, though a panel like Virtualizor or VirtFusion suits commercial hosting better.
Do @pve users work on all cluster nodes?
Yes, they are stored in the cluster configuration.