pveum.1-synopsis.adoc

   1 *pveum* `<COMMAND> [ARGS] [OPTIONS]`
   2
   3 *pveum acl delete* `<path> --roles <string>` `[OPTIONS]`
   4
   5 Update Access Control List (add or remove permissions).
   6
   7 `<path>`: `<string>` ::
   8
   9 Access control path
  10
  11 `--groups` `<string>` ::
  12
  13 List of groups.
  14
  15 `--propagate` `<boolean>` ('default =' `1`)::
  16
  17 Allow to propagate (inherit) permissions.
  18
  19 `--roles` `<string>` ::
  20
  21 List of roles.
  22
  23 `--tokens` `<string>` ::
  24
  25 List of API tokens.
  26
  27 `--users` `<string>` ::
  28
  29 List of users.
  30
  31 *pveum acl list* `[FORMAT_OPTIONS]`
  32
  33 Get Access Control List (ACLs).
  34
  35 *pveum acl modify* `<path> --roles <string>` `[OPTIONS]`
  36
  37 Update Access Control List (add or remove permissions).
  38
  39 `<path>`: `<string>` ::
  40
  41 Access control path
  42
  43 `--groups` `<string>` ::
  44
  45 List of groups.
  46
  47 `--propagate` `<boolean>` ('default =' `1`)::
  48
  49 Allow to propagate (inherit) permissions.
  50
  51 `--roles` `<string>` ::
  52
  53 List of roles.
  54
  55 `--tokens` `<string>` ::
  56
  57 List of API tokens.
  58
  59 `--users` `<string>` ::
  60
  61 List of users.
  62
  63 *pveum acldel*
  64
  65 An alias for 'pveum acl delete'.
  66
  67 *pveum aclmod*
  68
  69 An alias for 'pveum acl modify'.
  70
  71 *pveum group add* `<groupid>` `[OPTIONS]`
  72
  73 Create new group.
  74
  75 `<groupid>`: `<string>` ::
  76
  77 no description available
  78
  79 `--comment` `<string>` ::
  80
  81 no description available
  82
  83 *pveum group delete* `<groupid>`
  84
  85 Delete group.
  86
  87 `<groupid>`: `<string>` ::
  88
  89 no description available
  90
  91 *pveum group list* `[FORMAT_OPTIONS]`
  92
  93 Group index.
  94
  95 *pveum group modify* `<groupid>` `[OPTIONS]`
  96
  97 Update group data.
  98
  99 `<groupid>`: `<string>` ::
 100
 101 no description available
 102
 103 `--comment` `<string>` ::
 104
 105 no description available
 106
 107 *pveum groupadd*
 108
 109 An alias for 'pveum group add'.
 110
 111 *pveum groupdel*
 112
 113 An alias for 'pveum group delete'.
 114
 115 *pveum groupmod*
 116
 117 An alias for 'pveum group modify'.
 118
 119 *pveum help* `[OPTIONS]`
 120
 121 Get help about specified command.
 122
 123 `--extra-args` `<array>` ::
 124
 125 Shows help for a specific command
 126
 127 `--verbose` `<boolean>` ::
 128
 129 Verbose output format.
 130
 131 *pveum passwd* `<userid>`
 132
 133 Change user password.
 134
 135 `<userid>`: `<string>` ::
 136
 137 User ID
 138
 139 *pveum pool add* `<poolid>` `[OPTIONS]`
 140
 141 Create new pool.
 142
 143 `<poolid>`: `<string>` ::
 144
 145 no description available
 146
 147 `--comment` `<string>` ::
 148
 149 no description available
 150
 151 *pveum pool delete* `<poolid>`
 152
 153 Delete pool.
 154
 155 `<poolid>`: `<string>` ::
 156
 157 no description available
 158
 159 *pveum pool list* `[FORMAT_OPTIONS]`
 160
 161 Pool index.
 162
 163 *pveum pool modify* `<poolid>` `[OPTIONS]`
 164
 165 Update pool data.
 166
 167 `<poolid>`: `<string>` ::
 168
 169 no description available
 170
 171 `--comment` `<string>` ::
 172
 173 no description available
 174
 175 `--delete` `<boolean>` ::
 176
 177 Remove vms/storage (instead of adding it).
 178
 179 `--storage` `<string>` ::
 180
 181 List of storage IDs.
 182
 183 `--vms` `<string>` ::
 184
 185 List of virtual machines.
 186
 187 *pveum realm add* `<realm> --type <string>` `[OPTIONS]`
 188
 189 Add an authentication server.
 190
 191 `<realm>`: `<string>` ::
 192
 193 Authentication domain ID
 194
 195 `--acr-values` `<string>` ::
 196
 197 Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
 198
 199 `--autocreate` `<boolean>` ('default =' `0`)::
 200
 201 Automatically create users if they do not exist.
 202
 203 `--base_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 204
 205 LDAP base domain name
 206
 207 `--bind_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 208
 209 LDAP bind domain name
 210
 211 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 212
 213 Path to the CA certificate store
 214
 215 `--case-sensitive` `<boolean>` ('default =' `1`)::
 216
 217 username is case-sensitive
 218
 219 `--cert` `<string>` ::
 220
 221 Path to the client certificate
 222
 223 `--certkey` `<string>` ::
 224
 225 Path to the client certificate key
 226
 227 `--client-id` `<string>` ::
 228
 229 OpenID Client ID
 230
 231 `--client-key` `<string>` ::
 232
 233 OpenID Client Key
 234
 235 `--comment` `<string>` ::
 236
 237 Description.
 238
 239 `--default` `<boolean>` ::
 240
 241 Use this as default realm
 242
 243 `--domain` `\S+` ::
 244
 245 AD domain name
 246
 247 `--filter` `<string>` ::
 248
 249 LDAP filter for user sync.
 250
 251 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 252
 253 The objectclasses for groups.
 254
 255 `--group_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 256
 257 LDAP base domain name for group sync. If not set, the base_dn will be used.
 258
 259 `--group_filter` `<string>` ::
 260
 261 LDAP filter for group sync.
 262
 263 `--group_name_attr` `<string>` ::
 264
 265 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 266
 267 `--issuer-url` `<string>` ::
 268
 269 OpenID Issuer Url
 270
 271 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 272
 273 LDAP protocol mode.
 274
 275 `--password` `<string>` ::
 276
 277 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 278
 279 `--port` `<integer> (1 - 65535)` ::
 280
 281 Server port.
 282
 283 `--prompt` `(?:none|login|consent|select_account|\S+)` ::
 284
 285 Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
 286
 287 `--scopes` `<string>` ('default =' `email profile`)::
 288
 289 Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
 290
 291 `--secure` `<boolean>` ::
 292
 293 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 294
 295 `--server1` `<string>` ::
 296
 297 Server IP address (or DNS name)
 298
 299 `--server2` `<string>` ::
 300
 301 Fallback Server IP address (or DNS name)
 302
 303 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 304
 305 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 306
 307 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,scope=<users|groups|both>]` ::
 308
 309 The default options for behavior of synchronizations.
 310
 311 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 312
 313 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 314
 315 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 316
 317 Use Two-factor authentication.
 318
 319 `--type` `<ad | ldap | openid | pam | pve>` ::
 320
 321 Realm type.
 322
 323 `--user_attr` `\S{2,}` ::
 324
 325 LDAP user attribute name
 326
 327 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 328
 329 The objectclasses for users.
 330
 331 `--username-claim` `<string>` ::
 332
 333 OpenID claim used to generate the unique username.
 334
 335 `--verify` `<boolean>` ('default =' `0`)::
 336
 337 Verify the server's SSL certificate
 338
 339 *pveum realm delete* `<realm>`
 340
 341 Delete an authentication server.
 342
 343 `<realm>`: `<string>` ::
 344
 345 Authentication domain ID
 346
 347 *pveum realm list* `[FORMAT_OPTIONS]`
 348
 349 Authentication domain index.
 350
 351 *pveum realm modify* `<realm>` `[OPTIONS]`
 352
 353 Update authentication server settings.
 354
 355 `<realm>`: `<string>` ::
 356
 357 Authentication domain ID
 358
 359 `--acr-values` `<string>` ::
 360
 361 Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
 362
 363 `--autocreate` `<boolean>` ('default =' `0`)::
 364
 365 Automatically create users if they do not exist.
 366
 367 `--base_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 368
 369 LDAP base domain name
 370
 371 `--bind_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 372
 373 LDAP bind domain name
 374
 375 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 376
 377 Path to the CA certificate store
 378
 379 `--case-sensitive` `<boolean>` ('default =' `1`)::
 380
 381 username is case-sensitive
 382
 383 `--cert` `<string>` ::
 384
 385 Path to the client certificate
 386
 387 `--certkey` `<string>` ::
 388
 389 Path to the client certificate key
 390
 391 `--client-id` `<string>` ::
 392
 393 OpenID Client ID
 394
 395 `--client-key` `<string>` ::
 396
 397 OpenID Client Key
 398
 399 `--comment` `<string>` ::
 400
 401 Description.
 402
 403 `--default` `<boolean>` ::
 404
 405 Use this as default realm
 406
 407 `--delete` `<string>` ::
 408
 409 A list of settings you want to delete.
 410
 411 `--digest` `<string>` ::
 412
 413 Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.
 414
 415 `--domain` `\S+` ::
 416
 417 AD domain name
 418
 419 `--filter` `<string>` ::
 420
 421 LDAP filter for user sync.
 422
 423 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 424
 425 The objectclasses for groups.
 426
 427 `--group_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 428
 429 LDAP base domain name for group sync. If not set, the base_dn will be used.
 430
 431 `--group_filter` `<string>` ::
 432
 433 LDAP filter for group sync.
 434
 435 `--group_name_attr` `<string>` ::
 436
 437 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 438
 439 `--issuer-url` `<string>` ::
 440
 441 OpenID Issuer Url
 442
 443 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 444
 445 LDAP protocol mode.
 446
 447 `--password` `<string>` ::
 448
 449 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 450
 451 `--port` `<integer> (1 - 65535)` ::
 452
 453 Server port.
 454
 455 `--prompt` `(?:none|login|consent|select_account|\S+)` ::
 456
 457 Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
 458
 459 `--scopes` `<string>` ('default =' `email profile`)::
 460
 461 Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
 462
 463 `--secure` `<boolean>` ::
 464
 465 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 466
 467 `--server1` `<string>` ::
 468
 469 Server IP address (or DNS name)
 470
 471 `--server2` `<string>` ::
 472
 473 Fallback Server IP address (or DNS name)
 474
 475 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 476
 477 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 478
 479 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,scope=<users|groups|both>]` ::
 480
 481 The default options for behavior of synchronizations.
 482
 483 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 484
 485 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 486
 487 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 488
 489 Use Two-factor authentication.
 490
 491 `--user_attr` `\S{2,}` ::
 492
 493 LDAP user attribute name
 494
 495 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 496
 497 The objectclasses for users.
 498
 499 `--verify` `<boolean>` ('default =' `0`)::
 500
 501 Verify the server's SSL certificate
 502
 503 *pveum realm sync* `<realm>` `[OPTIONS]`
 504
 505 Syncs users and/or groups from the configured LDAP to user.cfg. NOTE:
 506 Synced groups will have the name 'name-$realm', so make sure those groups
 507 do not exist to prevent overwriting.
 508
 509 `<realm>`: `<string>` ::
 510
 511 Authentication domain ID
 512
 513 `--dry-run` `<boolean>` ('default =' `0`)::
 514
 515 If set, does not write anything.
 516
 517 `--enable-new` `<boolean>` ('default =' `1`)::
 518
 519 Enable newly synced users immediately.
 520
 521 `--full` `<boolean>` ::
 522
 523 If set, uses the LDAP Directory as source of truth, deleting users or groups not returned from the sync. Otherwise only syncs information which is not already present, and does not deletes or modifies anything else.
 524
 525 `--purge` `<boolean>` ::
 526
 527 Remove ACLs for users or groups which were removed from the config during a sync.
 528
 529 `--scope` `<both | groups | users>` ::
 530
 531 Select what to sync.
 532
 533 *pveum role add* `<roleid>` `[OPTIONS]`
 534
 535 Create new role.
 536
 537 `<roleid>`: `<string>` ::
 538
 539 no description available
 540
 541 `--privs` `<string>` ::
 542
 543 no description available
 544
 545 *pveum role delete* `<roleid>`
 546
 547 Delete role.
 548
 549 `<roleid>`: `<string>` ::
 550
 551 no description available
 552
 553 *pveum role list* `[FORMAT_OPTIONS]`
 554
 555 Role index.
 556
 557 *pveum role modify* `<roleid>` `[OPTIONS]`
 558
 559 Update an existing role.
 560
 561 `<roleid>`: `<string>` ::
 562
 563 no description available
 564
 565 `--append` `<boolean>` ::
 566
 567 no description available
 568 +
 569 NOTE: Requires option(s): `privs`
 570
 571 `--privs` `<string>` ::
 572
 573 no description available
 574
 575 *pveum roleadd*
 576
 577 An alias for 'pveum role add'.
 578
 579 *pveum roledel*
 580
 581 An alias for 'pveum role delete'.
 582
 583 *pveum rolemod*
 584
 585 An alias for 'pveum role modify'.
 586
 587 *pveum ticket* `<username>` `[OPTIONS]`
 588
 589 Create or verify authentication ticket.
 590
 591 `<username>`: `<string>` ::
 592
 593 User name
 594
 595 `--new-format` `<boolean>` ('default =' `0`)::
 596
 597 With webauthn the format of half-authenticated tickts changed. New clients should pass 1 here and not worry about the old format. The old format is deprecated and will be retired with PVE-8.0
 598
 599 `--otp` `<string>` ::
 600
 601 One-time password for Two-factor authentication.
 602
 603 `--path` `<string>` ::
 604
 605 Verify ticket, and check if user have access 'privs' on 'path'
 606 +
 607 NOTE: Requires option(s): `privs`
 608
 609 `--privs` `<string>` ::
 610
 611 Verify ticket, and check if user have access 'privs' on 'path'
 612 +
 613 NOTE: Requires option(s): `path`
 614
 615 `--realm` `<string>` ::
 616
 617 You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>@<relam>.
 618
 619 `--tfa-challenge` `<string>` ::
 620
 621 The signed TFA challenge string the user wants to respond to.
 622
 623 *pveum user add* `<userid>` `[OPTIONS]`
 624
 625 Create new user.
 626
 627 `<userid>`: `<string>` ::
 628
 629 User ID
 630
 631 `--comment` `<string>` ::
 632
 633 no description available
 634
 635 `--email` `<string>` ::
 636
 637 no description available
 638
 639 `--enable` `<boolean>` ('default =' `1`)::
 640
 641 Enable the account (default). You can set this to '0' to disable the account
 642
 643 `--expire` `<integer> (0 - N)` ::
 644
 645 Account expiration date (seconds since epoch). '0' means no expiration date.
 646
 647 `--firstname` `<string>` ::
 648
 649 no description available
 650
 651 `--groups` `<string>` ::
 652
 653 no description available
 654
 655 `--keys` `<string>` ::
 656
 657 Keys for two factor auth (yubico).
 658
 659 `--lastname` `<string>` ::
 660
 661 no description available
 662
 663 `--password` `<string>` ::
 664
 665 Initial password.
 666
 667 *pveum user delete* `<userid>`
 668
 669 Delete user.
 670
 671 `<userid>`: `<string>` ::
 672
 673 User ID
 674
 675 *pveum user list* `[OPTIONS]` `[FORMAT_OPTIONS]`
 676
 677 User index.
 678
 679 `--enabled` `<boolean>` ::
 680
 681 Optional filter for enable property.
 682
 683 `--full` `<boolean>` ('default =' `0`)::
 684
 685 Include group and token information.
 686
 687 *pveum user modify* `<userid>` `[OPTIONS]`
 688
 689 Update user configuration.
 690
 691 `<userid>`: `<string>` ::
 692
 693 User ID
 694
 695 `--append` `<boolean>` ::
 696
 697 no description available
 698 +
 699 NOTE: Requires option(s): `groups`
 700
 701 `--comment` `<string>` ::
 702
 703 no description available
 704
 705 `--email` `<string>` ::
 706
 707 no description available
 708
 709 `--enable` `<boolean>` ('default =' `1`)::
 710
 711 Enable the account (default). You can set this to '0' to disable the account
 712
 713 `--expire` `<integer> (0 - N)` ::
 714
 715 Account expiration date (seconds since epoch). '0' means no expiration date.
 716
 717 `--firstname` `<string>` ::
 718
 719 no description available
 720
 721 `--groups` `<string>` ::
 722
 723 no description available
 724
 725 `--keys` `<string>` ::
 726
 727 Keys for two factor auth (yubico).
 728
 729 `--lastname` `<string>` ::
 730
 731 no description available
 732
 733 *pveum user permissions* `[<userid>]` `[OPTIONS]` `[FORMAT_OPTIONS]`
 734
 735 Retrieve effective permissions of given user/token.
 736
 737 `<userid>`: `(?^:^(?^:[^\s:/]+)\@(?^:[A-Za-z][A-Za-z0-9\.\-_]+)(?:!(?^:[A-Za-z][A-Za-z0-9\.\-_]+))?$)` ::
 738
 739 User ID or full API token ID
 740
 741 `--path` `<string>` ::
 742
 743 Only dump this specific path, not the whole tree.
 744
 745 *pveum user tfa delete* `<userid>` `[OPTIONS]`
 746
 747 Delete TFA entries from a user.
 748
 749 `<userid>`: `<string>` ::
 750
 751 User ID
 752
 753 `--id` `<string>` ::
 754
 755 The TFA ID, if none provided, all TFA entries will be deleted.
 756
 757 *pveum user token add* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 758
 759 Generate a new API token for a specific user. NOTE: returns API token
 760 value, which needs to be stored as it cannot be retrieved afterwards!
 761
 762 `<userid>`: `<string>` ::
 763
 764 User ID
 765
 766 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 767
 768 User-specific token identifier.
 769
 770 `--comment` `<string>` ::
 771
 772 no description available
 773
 774 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 775
 776 API token expiration date (seconds since epoch). '0' means no expiration date.
 777
 778 `--privsep` `<boolean>` ('default =' `1`)::
 779
 780 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 781
 782 *pveum user token list* `<userid>` `[FORMAT_OPTIONS]`
 783
 784 Get user API tokens.
 785
 786 `<userid>`: `<string>` ::
 787
 788 User ID
 789
 790 *pveum user token modify* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 791
 792 Update API token for a specific user.
 793
 794 `<userid>`: `<string>` ::
 795
 796 User ID
 797
 798 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 799
 800 User-specific token identifier.
 801
 802 `--comment` `<string>` ::
 803
 804 no description available
 805
 806 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 807
 808 API token expiration date (seconds since epoch). '0' means no expiration date.
 809
 810 `--privsep` `<boolean>` ('default =' `1`)::
 811
 812 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 813
 814 *pveum user token permissions* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 815
 816 Retrieve effective permissions of given token.
 817
 818 `<userid>`: `<string>` ::
 819
 820 User ID
 821
 822 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 823
 824 User-specific token identifier.
 825
 826 `--path` `<string>` ::
 827
 828 Only dump this specific path, not the whole tree.
 829
 830 *pveum user token remove* `<userid> <tokenid>` `[FORMAT_OPTIONS]`
 831
 832 Remove API token for a specific user.
 833
 834 `<userid>`: `<string>` ::
 835
 836 User ID
 837
 838 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 839
 840 User-specific token identifier.
 841
 842 *pveum useradd*
 843
 844 An alias for 'pveum user add'.
 845
 846 *pveum userdel*
 847
 848 An alias for 'pveum user delete'.
 849
 850 *pveum usermod*
 851
 852 An alias for 'pveum user modify'.
 853
 854