[pbs-devel] [PATCH proxmox-backup v2] fix #6398: api: allow non-pam users to access shell

[pbs-devel] [PATCH proxmox-backup v2] fix #6398: api: allow non-pam users to access shell

[Shan Shaji]

Remove the explicit restriction that only pam users can access the
shell. This is safe to do, as all users that are not root@pam will
be shown with a login shell. So they need to have some (PAM) login
credentials available.

This change is useful for setups where a host integrates with central
authentication systems (e.g. LDAP, Active Directory, or OIDC), either
as a PBS realm or as a PAM plugin. It also allows environments that
favor non-pam users for PBS by default, but still want to keep PAM
accounts available for admnistrators.

Reference: pve-manager commit 7914f5e7b ("node console: allow usage
for non-pam realms), which already applied the same change for PVE.

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
 changes since v1: Thanks @Thomas
 - Updated commit message with more details. 

 src/api2/node/mod.rs | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/api2/node/mod.rs b/src/api2/node/mod.rs
index e7c6213c..34d4fb77 100644
--- a/src/api2/node/mod.rs
+++ b/src/api2/node/mod.rs
@@ -92,7 +92,7 @@ pub const SHELL_CMD_SCHEMA: Schema = StringSchema::new("The command to run.")
         }
     },
     access: {
-        description: "Restricted to users on realm 'pam'",
+        description: "The user needs Sys.Console on /system.",
         permission: &Permission::Privilege(&["system"], PRIV_SYS_CONSOLE, false),
     }
 )]
@@ -110,10 +110,6 @@ async fn termproxy(cmd: Option<String>, rpcenv: &mut dyn RpcEnvironment) -> Resu
 
     let userid = auth_id.user();
 
-    if userid.realm() != "pam" {
-        bail!("only pam users can use the console");
-    }
-
     let path = "/system";
 
     // use port 0 and let the kernel decide which port is free
-- 
2.47.3



_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

[pbs-devel] applied: [PATCH proxmox-backup v2] fix #6398: api: allow non-pam users to access shell

[Thomas Lamprecht]

On Wed, 08 Oct 2025 12:47:11 +0200, Shan Shaji wrote:
> Remove the explicit restriction that only pam users can access the
> shell. This is safe to do, as all users that are not root@pam will
> be shown with a login shell. So they need to have some (PAM) login
> credentials available.
> 
> This change is useful for setups where a host integrates with central
> authentication systems (e.g. LDAP, Active Directory, or OIDC), either
> as a PBS realm or as a PAM plugin. It also allows environments that
> favor non-pam users for PBS by default, but still want to keep PAM
> accounts available for admnistrators.
> 
> [...]

Applied, thanks!

[1/1] fix #6398: api: allow non-pam users to access shell
      commit: c77dfaf31f3e97fa0dd52ce4b85afe768b867562


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel