pveum.1-synopsis.adoc

   1 *pveum* `<COMMAND> [ARGS] [OPTIONS]`
   2
   3 *pveum acl delete* `<path> --roles <string>` `[OPTIONS]`
   4
   5 Update Access Control List (add or remove permissions).
   6
   7 `<path>`: `<string>` ::
   8
   9 Access control path
  10
  11 `--groups` `<string>` ::
  12
  13 List of groups.
  14
  15 `--propagate` `<boolean>` ('default =' `1`)::
  16
  17 Allow to propagate (inherit) permissions.
  18
  19 `--roles` `<string>` ::
  20
  21 List of roles.
  22
  23 `--tokens` `<string>` ::
  24
  25 List of API tokens.
  26
  27 `--users` `<string>` ::
  28
  29 List of users.
  30
  31 *pveum acl list* `[FORMAT_OPTIONS]`
  32
  33 Get Access Control List (ACLs).
  34
  35 *pveum acl modify* `<path> --roles <string>` `[OPTIONS]`
  36
  37 Update Access Control List (add or remove permissions).
  38
  39 `<path>`: `<string>` ::
  40
  41 Access control path
  42
  43 `--groups` `<string>` ::
  44
  45 List of groups.
  46
  47 `--propagate` `<boolean>` ('default =' `1`)::
  48
  49 Allow to propagate (inherit) permissions.
  50
  51 `--roles` `<string>` ::
  52
  53 List of roles.
  54
  55 `--tokens` `<string>` ::
  56
  57 List of API tokens.
  58
  59 `--users` `<string>` ::
  60
  61 List of users.
  62
  63 *pveum acldel*
  64
  65 An alias for 'pveum acl delete'.
  66
  67 *pveum aclmod*
  68
  69 An alias for 'pveum acl modify'.
  70
  71 *pveum group add* `<groupid>` `[OPTIONS]`
  72
  73 Create new group.
  74
  75 `<groupid>`: `<string>` ::
  76
  77 no description available
  78
  79 `--comment` `<string>` ::
  80
  81 no description available
  82
  83 *pveum group delete* `<groupid>`
  84
  85 Delete group.
  86
  87 `<groupid>`: `<string>` ::
  88
  89 no description available
  90
  91 *pveum group list* `[FORMAT_OPTIONS]`
  92
  93 Group index.
  94
  95 *pveum group modify* `<groupid>` `[OPTIONS]`
  96
  97 Update group data.
  98
  99 `<groupid>`: `<string>` ::
 100
 101 no description available
 102
 103 `--comment` `<string>` ::
 104
 105 no description available
 106
 107 *pveum groupadd*
 108
 109 An alias for 'pveum group add'.
 110
 111 *pveum groupdel*
 112
 113 An alias for 'pveum group delete'.
 114
 115 *pveum groupmod*
 116
 117 An alias for 'pveum group modify'.
 118
 119 *pveum help* `[OPTIONS]`
 120
 121 Get help about specified command.
 122
 123 `--extra-args` `<array>` ::
 124
 125 Shows help for a specific command
 126
 127 `--verbose` `<boolean>` ::
 128
 129 Verbose output format.
 130
 131 *pveum passwd* `<userid>`
 132
 133 Change user password.
 134
 135 `<userid>`: `<string>` ::
 136
 137 User ID
 138
 139 *pveum realm add* `<realm> --type <string>` `[OPTIONS]`
 140
 141 Add an authentication server.
 142
 143 `<realm>`: `<string>` ::
 144
 145 Authentication domain ID
 146
 147 `--base_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 148
 149 LDAP base domain name
 150
 151 `--bind_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 152
 153 LDAP bind domain name
 154
 155 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 156
 157 Path to the CA certificate store
 158
 159 `--cert` `<string>` ::
 160
 161 Path to the client certificate
 162
 163 `--certkey` `<string>` ::
 164
 165 Path to the client certificate key
 166
 167 `--comment` `<string>` ::
 168
 169 Description.
 170
 171 `--default` `<boolean>` ::
 172
 173 Use this as default realm
 174
 175 `--domain` `\S+` ::
 176
 177 AD domain name
 178
 179 `--filter` `<string>` ::
 180
 181 LDAP filter for user sync.
 182
 183 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 184
 185 The objectclasses for groups.
 186
 187 `--group_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 188
 189 LDAP base domain name for group sync. If not set, the base_dn will be used.
 190
 191 `--group_filter` `<string>` ::
 192
 193 LDAP filter for group sync.
 194
 195 `--group_name_attr` `<string>` ::
 196
 197 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 198
 199 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 200
 201 LDAP protocol mode.
 202
 203 `--password` `<string>` ::
 204
 205 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 206
 207 `--port` `<integer> (1 - 65535)` ::
 208
 209 Server port.
 210
 211 `--secure` `<boolean>` ::
 212
 213 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 214
 215 `--server1` `<string>` ::
 216
 217 Server IP address (or DNS name)
 218
 219 `--server2` `<string>` ::
 220
 221 Fallback Server IP address (or DNS name)
 222
 223 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 224
 225 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 226
 227 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,scope=<users|groups|both>]` ::
 228
 229 The default options for behavior of synchronizations.
 230
 231 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 232
 233 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 234
 235 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 236
 237 Use Two-factor authentication.
 238
 239 `--type` `<ad | ldap | pam | pve>` ::
 240
 241 Realm type.
 242
 243 `--user_attr` `\S{2,}` ::
 244
 245 LDAP user attribute name
 246
 247 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 248
 249 The objectclasses for users.
 250
 251 `--verify` `<boolean>` ('default =' `0`)::
 252
 253 Verify the server's SSL certificate
 254
 255 *pveum realm delete* `<realm>`
 256
 257 Delete an authentication server.
 258
 259 `<realm>`: `<string>` ::
 260
 261 Authentication domain ID
 262
 263 *pveum realm list* `[FORMAT_OPTIONS]`
 264
 265 Authentication domain index.
 266
 267 *pveum realm modify* `<realm>` `[OPTIONS]`
 268
 269 Update authentication server settings.
 270
 271 `<realm>`: `<string>` ::
 272
 273 Authentication domain ID
 274
 275 `--base_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 276
 277 LDAP base domain name
 278
 279 `--bind_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 280
 281 LDAP bind domain name
 282
 283 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 284
 285 Path to the CA certificate store
 286
 287 `--cert` `<string>` ::
 288
 289 Path to the client certificate
 290
 291 `--certkey` `<string>` ::
 292
 293 Path to the client certificate key
 294
 295 `--comment` `<string>` ::
 296
 297 Description.
 298
 299 `--default` `<boolean>` ::
 300
 301 Use this as default realm
 302
 303 `--delete` `<string>` ::
 304
 305 A list of settings you want to delete.
 306
 307 `--digest` `<string>` ::
 308
 309 Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.
 310
 311 `--domain` `\S+` ::
 312
 313 AD domain name
 314
 315 `--filter` `<string>` ::
 316
 317 LDAP filter for user sync.
 318
 319 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 320
 321 The objectclasses for groups.
 322
 323 `--group_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 324
 325 LDAP base domain name for group sync. If not set, the base_dn will be used.
 326
 327 `--group_filter` `<string>` ::
 328
 329 LDAP filter for group sync.
 330
 331 `--group_name_attr` `<string>` ::
 332
 333 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 334
 335 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 336
 337 LDAP protocol mode.
 338
 339 `--password` `<string>` ::
 340
 341 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 342
 343 `--port` `<integer> (1 - 65535)` ::
 344
 345 Server port.
 346
 347 `--secure` `<boolean>` ::
 348
 349 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 350
 351 `--server1` `<string>` ::
 352
 353 Server IP address (or DNS name)
 354
 355 `--server2` `<string>` ::
 356
 357 Fallback Server IP address (or DNS name)
 358
 359 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 360
 361 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 362
 363 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,scope=<users|groups|both>]` ::
 364
 365 The default options for behavior of synchronizations.
 366
 367 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 368
 369 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 370
 371 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 372
 373 Use Two-factor authentication.
 374
 375 `--user_attr` `\S{2,}` ::
 376
 377 LDAP user attribute name
 378
 379 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 380
 381 The objectclasses for users.
 382
 383 `--verify` `<boolean>` ('default =' `0`)::
 384
 385 Verify the server's SSL certificate
 386
 387 *pveum realm sync* `<realm>` `[OPTIONS]`
 388
 389 Syncs users and/or groups from the configured LDAP to user.cfg. NOTE:
 390 Synced groups will have the name 'name-$realm', so make sure those groups
 391 do not exist to prevent overwriting.
 392
 393 `<realm>`: `<string>` ::
 394
 395 Authentication domain ID
 396
 397 `--dry-run` `<boolean>` ('default =' `0`)::
 398
 399 If set, does not write anything.
 400
 401 `--enable-new` `<boolean>` ('default =' `1`)::
 402
 403 Enable newly synced users immediately.
 404
 405 `--full` `<boolean>` ::
 406
 407 If set, uses the LDAP Directory as source of truth, deleting users or groups not returned from the sync. Otherwise only syncs information which is not already present, and does not deletes or modifies anything else.
 408
 409 `--purge` `<boolean>` ::
 410
 411 Remove ACLs for users or groups which were removed from the config during a sync.
 412
 413 `--scope` `<both | groups | users>` ::
 414
 415 Select what to sync.
 416
 417 *pveum role add* `<roleid>` `[OPTIONS]`
 418
 419 Create new role.
 420
 421 `<roleid>`: `<string>` ::
 422
 423 no description available
 424
 425 `--privs` `<string>` ::
 426
 427 no description available
 428
 429 *pveum role delete* `<roleid>`
 430
 431 Delete role.
 432
 433 `<roleid>`: `<string>` ::
 434
 435 no description available
 436
 437 *pveum role list* `[FORMAT_OPTIONS]`
 438
 439 Role index.
 440
 441 *pveum role modify* `<roleid>` `[OPTIONS]`
 442
 443 Update an existing role.
 444
 445 `<roleid>`: `<string>` ::
 446
 447 no description available
 448
 449 `--append` `<boolean>` ::
 450
 451 no description available
 452 +
 453 NOTE: Requires option(s): `privs`
 454
 455 `--privs` `<string>` ::
 456
 457 no description available
 458
 459 *pveum roleadd*
 460
 461 An alias for 'pveum role add'.
 462
 463 *pveum roledel*
 464
 465 An alias for 'pveum role delete'.
 466
 467 *pveum rolemod*
 468
 469 An alias for 'pveum role modify'.
 470
 471 *pveum ticket* `<username>` `[OPTIONS]`
 472
 473 Create or verify authentication ticket.
 474
 475 `<username>`: `<string>` ::
 476
 477 User name
 478
 479 `--otp` `<string>` ::
 480
 481 One-time password for Two-factor authentication.
 482
 483 `--path` `<string>` ::
 484
 485 Verify ticket, and check if user have access 'privs' on 'path'
 486 +
 487 NOTE: Requires option(s): `privs`
 488
 489 `--privs` `<string>` ::
 490
 491 Verify ticket, and check if user have access 'privs' on 'path'
 492 +
 493 NOTE: Requires option(s): `path`
 494
 495 `--realm` `<string>` ::
 496
 497 You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>@<relam>.
 498
 499 *pveum user add* `<userid>` `[OPTIONS]`
 500
 501 Create new user.
 502
 503 `<userid>`: `<string>` ::
 504
 505 User ID
 506
 507 `--comment` `<string>` ::
 508
 509 no description available
 510
 511 `--email` `<string>` ::
 512
 513 no description available
 514
 515 `--enable` `<boolean>` ('default =' `1`)::
 516
 517 Enable the account (default). You can set this to '0' to disable the account
 518
 519 `--expire` `<integer> (0 - N)` ::
 520
 521 Account expiration date (seconds since epoch). '0' means no expiration date.
 522
 523 `--firstname` `<string>` ::
 524
 525 no description available
 526
 527 `--groups` `<string>` ::
 528
 529 no description available
 530
 531 `--keys` `<string>` ::
 532
 533 Keys for two factor auth (yubico).
 534
 535 `--lastname` `<string>` ::
 536
 537 no description available
 538
 539 `--password` `<string>` ::
 540
 541 Initial password.
 542
 543 *pveum user delete* `<userid>`
 544
 545 Delete user.
 546
 547 `<userid>`: `<string>` ::
 548
 549 User ID
 550
 551 *pveum user list* `[OPTIONS]` `[FORMAT_OPTIONS]`
 552
 553 User index.
 554
 555 `--enabled` `<boolean>` ::
 556
 557 Optional filter for enable property.
 558
 559 `--full` `<boolean>` ('default =' `0`)::
 560
 561 Include group and token information.
 562
 563 *pveum user modify* `<userid>` `[OPTIONS]`
 564
 565 Update user configuration.
 566
 567 `<userid>`: `<string>` ::
 568
 569 User ID
 570
 571 `--append` `<boolean>` ::
 572
 573 no description available
 574 +
 575 NOTE: Requires option(s): `groups`
 576
 577 `--comment` `<string>` ::
 578
 579 no description available
 580
 581 `--email` `<string>` ::
 582
 583 no description available
 584
 585 `--enable` `<boolean>` ('default =' `1`)::
 586
 587 Enable the account (default). You can set this to '0' to disable the account
 588
 589 `--expire` `<integer> (0 - N)` ::
 590
 591 Account expiration date (seconds since epoch). '0' means no expiration date.
 592
 593 `--firstname` `<string>` ::
 594
 595 no description available
 596
 597 `--groups` `<string>` ::
 598
 599 no description available
 600
 601 `--keys` `<string>` ::
 602
 603 Keys for two factor auth (yubico).
 604
 605 `--lastname` `<string>` ::
 606
 607 no description available
 608
 609 *pveum user permissions* `[<userid>]` `[OPTIONS]` `[FORMAT_OPTIONS]`
 610
 611 Retrieve effective permissions of given user/token.
 612
 613 `<userid>`: `(?^:^(?^:[^\s:/]+)\@(?^:[A-Za-z][A-Za-z0-9\.\-_]+)(?:!(?^:[A-Za-z][A-Za-z0-9\.\-_]+))?$)` ::
 614
 615 User ID or full API token ID
 616
 617 `--path` `<string>` ::
 618
 619 Only dump this specific path, not the whole tree.
 620
 621 *pveum user token add* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 622
 623 Generate a new API token for a specific user. NOTE: returns API token
 624 value, which needs to be stored as it cannot be retrieved afterwards!
 625
 626 `<userid>`: `<string>` ::
 627
 628 User ID
 629
 630 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 631
 632 User-specific token identifier.
 633
 634 `--comment` `<string>` ::
 635
 636 no description available
 637
 638 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 639
 640 API token expiration date (seconds since epoch). '0' means no expiration date.
 641
 642 `--privsep` `<boolean>` ('default =' `1`)::
 643
 644 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 645
 646 *pveum user token list* `<userid>` `[FORMAT_OPTIONS]`
 647
 648 Get user API tokens.
 649
 650 `<userid>`: `<string>` ::
 651
 652 User ID
 653
 654 *pveum user token modify* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 655
 656 Update API token for a specific user.
 657
 658 `<userid>`: `<string>` ::
 659
 660 User ID
 661
 662 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 663
 664 User-specific token identifier.
 665
 666 `--comment` `<string>` ::
 667
 668 no description available
 669
 670 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 671
 672 API token expiration date (seconds since epoch). '0' means no expiration date.
 673
 674 `--privsep` `<boolean>` ('default =' `1`)::
 675
 676 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 677
 678 *pveum user token permissions* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 679
 680 Retrieve effective permissions of given token.
 681
 682 `<userid>`: `<string>` ::
 683
 684 User ID
 685
 686 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 687
 688 User-specific token identifier.
 689
 690 `--path` `<string>` ::
 691
 692 Only dump this specific path, not the whole tree.
 693
 694 *pveum user token remove* `<userid> <tokenid>` `[FORMAT_OPTIONS]`
 695
 696 Remove API token for a specific user.
 697
 698 `<userid>`: `<string>` ::
 699
 700 User ID
 701
 702 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 703
 704 User-specific token identifier.
 705
 706 *pveum useradd*
 707
 708 An alias for 'pveum user add'.
 709
 710 *pveum userdel*
 711
 712 An alias for 'pveum user delete'.
 713
 714 *pveum usermod*
 715
 716 An alias for 'pveum user modify'.
 717
 718