PVE Role privileges

[jbender81]

Moin,
Is there a list of required Proxmox privileges for "veeam@pam" for the API-Connection
There is already a very nice list for sudo here https://www.veeam.com/kb4701 for the user "veeam" for the SSH-connection.

Cheers
Jörg

[rovshan.pashayev]

Hi Jörg,

As written in the same KB, administrator role is needed.

"Add the Administrator role for the root path ( Path: / ) to that user."

[jbender81]

Hi,
Thank you.
I had hoped for a little bit more granular privileges, like it is provided for sudo.
This is pretty much the equivalent to "veeam ALL=(ALL:ALL) ALL" for sudo.

Cheers
Jörg

[rovshan.pashayev]

Hello,

Have you ever faced any security issues or is this general concern?

[jbender81]

Moin,
No immediate concern, but just a proponent of "least privileges".
For example, I'm pretty positive, that the veeam@pam does not need to have access to the clusters realm, role and user configuration, especially no write access.

To clarify: This is no show stopper but just an inquiry.

Cheers
Jörg

[XxPatrickxX]

Agreed, it's overly permissive currently. With Sudoers access, I'm not sure how much it matters though. Beyond what's mentioned I'd like to see the service account loose sudo, cluster-wide write access, non-vm specific host configuration access.

While it works, the concern is if ever the account gets compromised beyond breaking the vm's it can break the hosts as well.