AD realms support the 'user_attr' option like LDAP realms, but it is
only documented for the latter. Describe it with its default and the
use case of logging in with the user principal name.
Signed-off-by: Michal Fox <me@dualfroz.com>
The certificate management chapter explains how to upload a custom
certificate, but not how to go back to the default one. This is
especially needed if a broken certificate made the web interface
unreachable, so that the 'Delete Custom Certificate' button cannot be
used anymore.
Add a section for it, with the button in the web interface and the
'pvenode cert delete --restart 1' command as fallback, which deletes the
custom certificate and key and restarts pveproxy, so that it uses the
default node certificate again.
Signed-off-by: Michal Fox <me@dualfroz.com>
The section about the external vote support already says that the vote
daemon runs on an independent server, but does not spell out that this
rules out running it on the cluster itself, for example on one of the
nodes or in a guest, which might look like an easy option for a cluster
with only two nodes.
Add a note that says so explicitly, and why: if the node running the
daemon fails, the cluster loses two votes at once, and a guest running
it cannot be started without quorum, as starting a guest requires a
quorate cluster.
Signed-off-by: Michal Fox <me@dualfroz.com>
Since pve-access-control commit 01f191c ("fix #1670: change PAM service
name to project specific name"), the PAM realm authenticates with the
PAM service name 'proxmox-ve-auth'. This allows changing the PAM
configuration for logins to Proxmox VE only, for example to not allow
logins of users with an empty password, which the default 'nullok'
option of pam_unix in common-auth does. But this is only mentioned in
the commit message.
Document the service name, the fallback to the 'other' service if no
such configuration exists, and that this configuration is local to each
node, like the system users.
Signed-off-by: Michal Fox <me@dualfroz.com>
The Sys.AccessNetwork privilege got added with pve-access-control
commit 36c1814 ("add Sys.AccessNetwork privilege") and is part of the
built-in Administrator role, but it is missing in the list of
privileges.
Document it with examples from the API calls that currently check for
it, which are downloading ISO images, templates and other images from a
URL to a storage and querying the metadata of such a URL, querying the
tags of and pulling OCI images, and creating or updating notification
targets.
Signed-off-by: Michal Fox <me@dualfroz.com>
The maximum number of network interfaces of a container was raised from
10 to 32 in 2020, with pve-container commit 6dd2d4c ("Bump maximum
number of container net interfaces from 10 to 32"), but the
documentation still mentions 10 and the options 'net0' to 'net9'.
While at it, fix the grammar of the sentence introducing the list of
settings.
Signed-off-by: Michal Fox <me@dualfroz.com>
The description was taken over from VM.PowerMgmt, but nodes cannot be
started, stopped or reset via the API. The privilege is only required
for rebooting and shutting down a node, and for waking up a node via
Wake-on-LAN.
Signed-off-by: Michal Fox <me@dualfroz.com>
dualfroz