From 1fd55b23fc00781fcca550ebf7cc9c0ca6283909 Mon Sep 17 00:00:00 2001 From: Michal Fox Date: Fri, 2 Oct 2026 17:00:58 +0200 Subject: [PATCH] fix #5371: user management: document the PAM service of the PAM realm Since pve-access-control commit 01f191c ("fix #1670: change PAM service name to project specific name"), the PAM realm authenticates with the PAM service name 'proxmox-ve-auth'. This allows changing the PAM configuration for logins to Proxmox VE only, for example to not allow logins of users with an empty password, which the default 'nullok' option of pam_unix in common-auth does. But this is only mentioned in the commit message. Document the service name, the fallback to the 'other' service if no such configuration exists, and that this configuration is local to each node, like the system users. Signed-off-by: Michal Fox --- pveum.adoc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pveum.adoc b/pveum.adoc index d089cb6..49cfd68 100644 --- a/pveum.adoc +++ b/pveum.adoc @@ -184,6 +184,14 @@ endpoint only apply to the local node and not cluster-wide. Even though {pve} has a multi-master design, using different passwords for different nodes can still offer a security benefit. +{pve} uses the PAM service name `proxmox-ve-auth` to authenticate users of this +realm. This allows changing the PAM configuration only for logins to {pve}, +without affecting other services like the login on the console or via SSH, by +creating the file `/etc/pam.d/proxmox-ve-auth`. If this file does not exist, +PAM uses the configuration of the `other` service, so a copy of +`/etc/pam.d/other` is a good starting point. Like the system users, this +configuration is local to each node. + In terms of configurability, an administrator can choose to require two-factor authentication with logins from the realm and to set the realm as the default authentication realm.