pveum.1-synopsis.adoc

   1 *pveum* `<COMMAND> [ARGS] [OPTIONS]`
   2
   3 *pveum acl delete* `<path> --roles <string>` `[OPTIONS]`
   4
   5 Update Access Control List (add or remove permissions).
   6
   7 `<path>`: `<string>` ::
   8
   9 Access control path
  10
  11 `--groups` `<string>` ::
  12
  13 List of groups.
  14
  15 `--propagate` `<boolean>` ('default =' `1`)::
  16
  17 Allow to propagate (inherit) permissions.
  18
  19 `--roles` `<string>` ::
  20
  21 List of roles.
  22
  23 `--tokens` `<string>` ::
  24
  25 List of API tokens.
  26
  27 `--users` `<string>` ::
  28
  29 List of users.
  30
  31 *pveum acl list* `[FORMAT_OPTIONS]`
  32
  33 Get Access Control List (ACLs).
  34
  35 *pveum acl modify* `<path> --roles <string>` `[OPTIONS]`
  36
  37 Update Access Control List (add or remove permissions).
  38
  39 `<path>`: `<string>` ::
  40
  41 Access control path
  42
  43 `--groups` `<string>` ::
  44
  45 List of groups.
  46
  47 `--propagate` `<boolean>` ('default =' `1`)::
  48
  49 Allow to propagate (inherit) permissions.
  50
  51 `--roles` `<string>` ::
  52
  53 List of roles.
  54
  55 `--tokens` `<string>` ::
  56
  57 List of API tokens.
  58
  59 `--users` `<string>` ::
  60
  61 List of users.
  62
  63 *pveum acldel*
  64
  65 An alias for 'pveum acl delete'.
  66
  67 *pveum aclmod*
  68
  69 An alias for 'pveum acl modify'.
  70
  71 *pveum group add* `<groupid>` `[OPTIONS]`
  72
  73 Create new group.
  74
  75 `<groupid>`: `<string>` ::
  76
  77 no description available
  78
  79 `--comment` `<string>` ::
  80
  81 no description available
  82
  83 *pveum group delete* `<groupid>`
  84
  85 Delete group.
  86
  87 `<groupid>`: `<string>` ::
  88
  89 no description available
  90
  91 *pveum group list* `[FORMAT_OPTIONS]`
  92
  93 Group index.
  94
  95 *pveum group modify* `<groupid>` `[OPTIONS]`
  96
  97 Update group data.
  98
  99 `<groupid>`: `<string>` ::
 100
 101 no description available
 102
 103 `--comment` `<string>` ::
 104
 105 no description available
 106
 107 *pveum groupadd*
 108
 109 An alias for 'pveum group add'.
 110
 111 *pveum groupdel*
 112
 113 An alias for 'pveum group delete'.
 114
 115 *pveum groupmod*
 116
 117 An alias for 'pveum group modify'.
 118
 119 *pveum help* `[OPTIONS]`
 120
 121 Get help about specified command.
 122
 123 `--extra-args` `<array>` ::
 124
 125 Shows help for a specific command
 126
 127 `--verbose` `<boolean>` ::
 128
 129 Verbose output format.
 130
 131 *pveum passwd* `<userid>`
 132
 133 Change user password.
 134
 135 `<userid>`: `<string>` ::
 136
 137 User ID
 138
 139 *pveum pool add* `<poolid>` `[OPTIONS]`
 140
 141 Create new pool.
 142
 143 `<poolid>`: `<string>` ::
 144
 145 no description available
 146
 147 `--comment` `<string>` ::
 148
 149 no description available
 150
 151 *pveum pool delete* `<poolid>`
 152
 153 Delete pool.
 154
 155 `<poolid>`: `<string>` ::
 156
 157 no description available
 158
 159 *pveum pool list* `[FORMAT_OPTIONS]`
 160
 161 Pool index.
 162
 163 *pveum pool modify* `<poolid>` `[OPTIONS]`
 164
 165 Update pool data.
 166
 167 `<poolid>`: `<string>` ::
 168
 169 no description available
 170
 171 `--comment` `<string>` ::
 172
 173 no description available
 174
 175 `--delete` `<boolean>` ::
 176
 177 Remove vms/storage (instead of adding it).
 178
 179 `--storage` `<string>` ::
 180
 181 List of storage IDs.
 182
 183 `--vms` `<string>` ::
 184
 185 List of virtual machines.
 186
 187 *pveum realm add* `<realm> --type <string>` `[OPTIONS]`
 188
 189 Add an authentication server.
 190
 191 `<realm>`: `<string>` ::
 192
 193 Authentication domain ID
 194
 195 `--base_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 196
 197 LDAP base domain name
 198
 199 `--bind_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 200
 201 LDAP bind domain name
 202
 203 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 204
 205 Path to the CA certificate store
 206
 207 `--case-sensitive` `<boolean>` ('default =' `1`)::
 208
 209 username is case-sensitive
 210
 211 `--cert` `<string>` ::
 212
 213 Path to the client certificate
 214
 215 `--certkey` `<string>` ::
 216
 217 Path to the client certificate key
 218
 219 `--comment` `<string>` ::
 220
 221 Description.
 222
 223 `--default` `<boolean>` ::
 224
 225 Use this as default realm
 226
 227 `--domain` `\S+` ::
 228
 229 AD domain name
 230
 231 `--filter` `<string>` ::
 232
 233 LDAP filter for user sync.
 234
 235 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 236
 237 The objectclasses for groups.
 238
 239 `--group_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 240
 241 LDAP base domain name for group sync. If not set, the base_dn will be used.
 242
 243 `--group_filter` `<string>` ::
 244
 245 LDAP filter for group sync.
 246
 247 `--group_name_attr` `<string>` ::
 248
 249 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 250
 251 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 252
 253 LDAP protocol mode.
 254
 255 `--password` `<string>` ::
 256
 257 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 258
 259 `--port` `<integer> (1 - 65535)` ::
 260
 261 Server port.
 262
 263 `--secure` `<boolean>` ::
 264
 265 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 266
 267 `--server1` `<string>` ::
 268
 269 Server IP address (or DNS name)
 270
 271 `--server2` `<string>` ::
 272
 273 Fallback Server IP address (or DNS name)
 274
 275 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 276
 277 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 278
 279 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,scope=<users|groups|both>]` ::
 280
 281 The default options for behavior of synchronizations.
 282
 283 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 284
 285 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 286
 287 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 288
 289 Use Two-factor authentication.
 290
 291 `--type` `<ad | ldap | pam | pve>` ::
 292
 293 Realm type.
 294
 295 `--user_attr` `\S{2,}` ::
 296
 297 LDAP user attribute name
 298
 299 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 300
 301 The objectclasses for users.
 302
 303 `--verify` `<boolean>` ('default =' `0`)::
 304
 305 Verify the server's SSL certificate
 306
 307 *pveum realm delete* `<realm>`
 308
 309 Delete an authentication server.
 310
 311 `<realm>`: `<string>` ::
 312
 313 Authentication domain ID
 314
 315 *pveum realm list* `[FORMAT_OPTIONS]`
 316
 317 Authentication domain index.
 318
 319 *pveum realm modify* `<realm>` `[OPTIONS]`
 320
 321 Update authentication server settings.
 322
 323 `<realm>`: `<string>` ::
 324
 325 Authentication domain ID
 326
 327 `--base_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 328
 329 LDAP base domain name
 330
 331 `--bind_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 332
 333 LDAP bind domain name
 334
 335 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 336
 337 Path to the CA certificate store
 338
 339 `--case-sensitive` `<boolean>` ('default =' `1`)::
 340
 341 username is case-sensitive
 342
 343 `--cert` `<string>` ::
 344
 345 Path to the client certificate
 346
 347 `--certkey` `<string>` ::
 348
 349 Path to the client certificate key
 350
 351 `--comment` `<string>` ::
 352
 353 Description.
 354
 355 `--default` `<boolean>` ::
 356
 357 Use this as default realm
 358
 359 `--delete` `<string>` ::
 360
 361 A list of settings you want to delete.
 362
 363 `--digest` `<string>` ::
 364
 365 Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.
 366
 367 `--domain` `\S+` ::
 368
 369 AD domain name
 370
 371 `--filter` `<string>` ::
 372
 373 LDAP filter for user sync.
 374
 375 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 376
 377 The objectclasses for groups.
 378
 379 `--group_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 380
 381 LDAP base domain name for group sync. If not set, the base_dn will be used.
 382
 383 `--group_filter` `<string>` ::
 384
 385 LDAP filter for group sync.
 386
 387 `--group_name_attr` `<string>` ::
 388
 389 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 390
 391 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 392
 393 LDAP protocol mode.
 394
 395 `--password` `<string>` ::
 396
 397 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 398
 399 `--port` `<integer> (1 - 65535)` ::
 400
 401 Server port.
 402
 403 `--secure` `<boolean>` ::
 404
 405 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 406
 407 `--server1` `<string>` ::
 408
 409 Server IP address (or DNS name)
 410
 411 `--server2` `<string>` ::
 412
 413 Fallback Server IP address (or DNS name)
 414
 415 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 416
 417 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 418
 419 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,scope=<users|groups|both>]` ::
 420
 421 The default options for behavior of synchronizations.
 422
 423 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 424
 425 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 426
 427 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 428
 429 Use Two-factor authentication.
 430
 431 `--user_attr` `\S{2,}` ::
 432
 433 LDAP user attribute name
 434
 435 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 436
 437 The objectclasses for users.
 438
 439 `--verify` `<boolean>` ('default =' `0`)::
 440
 441 Verify the server's SSL certificate
 442
 443 *pveum realm sync* `<realm>` `[OPTIONS]`
 444
 445 Syncs users and/or groups from the configured LDAP to user.cfg. NOTE:
 446 Synced groups will have the name 'name-$realm', so make sure those groups
 447 do not exist to prevent overwriting.
 448
 449 `<realm>`: `<string>` ::
 450
 451 Authentication domain ID
 452
 453 `--dry-run` `<boolean>` ('default =' `0`)::
 454
 455 If set, does not write anything.
 456
 457 `--enable-new` `<boolean>` ('default =' `1`)::
 458
 459 Enable newly synced users immediately.
 460
 461 `--full` `<boolean>` ::
 462
 463 If set, uses the LDAP Directory as source of truth, deleting users or groups not returned from the sync. Otherwise only syncs information which is not already present, and does not deletes or modifies anything else.
 464
 465 `--purge` `<boolean>` ::
 466
 467 Remove ACLs for users or groups which were removed from the config during a sync.
 468
 469 `--scope` `<both | groups | users>` ::
 470
 471 Select what to sync.
 472
 473 *pveum role add* `<roleid>` `[OPTIONS]`
 474
 475 Create new role.
 476
 477 `<roleid>`: `<string>` ::
 478
 479 no description available
 480
 481 `--privs` `<string>` ::
 482
 483 no description available
 484
 485 *pveum role delete* `<roleid>`
 486
 487 Delete role.
 488
 489 `<roleid>`: `<string>` ::
 490
 491 no description available
 492
 493 *pveum role list* `[FORMAT_OPTIONS]`
 494
 495 Role index.
 496
 497 *pveum role modify* `<roleid>` `[OPTIONS]`
 498
 499 Update an existing role.
 500
 501 `<roleid>`: `<string>` ::
 502
 503 no description available
 504
 505 `--append` `<boolean>` ::
 506
 507 no description available
 508 +
 509 NOTE: Requires option(s): `privs`
 510
 511 `--privs` `<string>` ::
 512
 513 no description available
 514
 515 *pveum roleadd*
 516
 517 An alias for 'pveum role add'.
 518
 519 *pveum roledel*
 520
 521 An alias for 'pveum role delete'.
 522
 523 *pveum rolemod*
 524
 525 An alias for 'pveum role modify'.
 526
 527 *pveum ticket* `<username>` `[OPTIONS]`
 528
 529 Create or verify authentication ticket.
 530
 531 `<username>`: `<string>` ::
 532
 533 User name
 534
 535 `--otp` `<string>` ::
 536
 537 One-time password for Two-factor authentication.
 538
 539 `--path` `<string>` ::
 540
 541 Verify ticket, and check if user have access 'privs' on 'path'
 542 +
 543 NOTE: Requires option(s): `privs`
 544
 545 `--privs` `<string>` ::
 546
 547 Verify ticket, and check if user have access 'privs' on 'path'
 548 +
 549 NOTE: Requires option(s): `path`
 550
 551 `--realm` `<string>` ::
 552
 553 You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>@<relam>.
 554
 555 *pveum user add* `<userid>` `[OPTIONS]`
 556
 557 Create new user.
 558
 559 `<userid>`: `<string>` ::
 560
 561 User ID
 562
 563 `--comment` `<string>` ::
 564
 565 no description available
 566
 567 `--email` `<string>` ::
 568
 569 no description available
 570
 571 `--enable` `<boolean>` ('default =' `1`)::
 572
 573 Enable the account (default). You can set this to '0' to disable the account
 574
 575 `--expire` `<integer> (0 - N)` ::
 576
 577 Account expiration date (seconds since epoch). '0' means no expiration date.
 578
 579 `--firstname` `<string>` ::
 580
 581 no description available
 582
 583 `--groups` `<string>` ::
 584
 585 no description available
 586
 587 `--keys` `<string>` ::
 588
 589 Keys for two factor auth (yubico).
 590
 591 `--lastname` `<string>` ::
 592
 593 no description available
 594
 595 `--password` `<string>` ::
 596
 597 Initial password.
 598
 599 *pveum user delete* `<userid>`
 600
 601 Delete user.
 602
 603 `<userid>`: `<string>` ::
 604
 605 User ID
 606
 607 *pveum user list* `[OPTIONS]` `[FORMAT_OPTIONS]`
 608
 609 User index.
 610
 611 `--enabled` `<boolean>` ::
 612
 613 Optional filter for enable property.
 614
 615 `--full` `<boolean>` ('default =' `0`)::
 616
 617 Include group and token information.
 618
 619 *pveum user modify* `<userid>` `[OPTIONS]`
 620
 621 Update user configuration.
 622
 623 `<userid>`: `<string>` ::
 624
 625 User ID
 626
 627 `--append` `<boolean>` ::
 628
 629 no description available
 630 +
 631 NOTE: Requires option(s): `groups`
 632
 633 `--comment` `<string>` ::
 634
 635 no description available
 636
 637 `--email` `<string>` ::
 638
 639 no description available
 640
 641 `--enable` `<boolean>` ('default =' `1`)::
 642
 643 Enable the account (default). You can set this to '0' to disable the account
 644
 645 `--expire` `<integer> (0 - N)` ::
 646
 647 Account expiration date (seconds since epoch). '0' means no expiration date.
 648
 649 `--firstname` `<string>` ::
 650
 651 no description available
 652
 653 `--groups` `<string>` ::
 654
 655 no description available
 656
 657 `--keys` `<string>` ::
 658
 659 Keys for two factor auth (yubico).
 660
 661 `--lastname` `<string>` ::
 662
 663 no description available
 664
 665 *pveum user permissions* `[<userid>]` `[OPTIONS]` `[FORMAT_OPTIONS]`
 666
 667 Retrieve effective permissions of given user/token.
 668
 669 `<userid>`: `(?^:^(?^:[^\s:/]+)\@(?^:[A-Za-z][A-Za-z0-9\.\-_]+)(?:!(?^:[A-Za-z][A-Za-z0-9\.\-_]+))?$)` ::
 670
 671 User ID or full API token ID
 672
 673 `--path` `<string>` ::
 674
 675 Only dump this specific path, not the whole tree.
 676
 677 *pveum user tfa delete* `<userid>` `[OPTIONS]`
 678
 679 Change user u2f authentication.
 680
 681 `<userid>`: `<string>` ::
 682
 683 User ID
 684
 685 `--config` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 686
 687 A TFA configuration. This must currently be of type TOTP of not set at all.
 688
 689 `--key` `<string>` ::
 690
 691 When adding TOTP, the shared secret value.
 692
 693 `--password` `<string>` ::
 694
 695 The current password.
 696
 697 `--response` `<string>` ::
 698
 699 Either the the response to the current u2f registration challenge, or, when adding TOTP, the currently valid TOTP value.
 700
 701 *pveum user token add* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 702
 703 Generate a new API token for a specific user. NOTE: returns API token
 704 value, which needs to be stored as it cannot be retrieved afterwards!
 705
 706 `<userid>`: `<string>` ::
 707
 708 User ID
 709
 710 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 711
 712 User-specific token identifier.
 713
 714 `--comment` `<string>` ::
 715
 716 no description available
 717
 718 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 719
 720 API token expiration date (seconds since epoch). '0' means no expiration date.
 721
 722 `--privsep` `<boolean>` ('default =' `1`)::
 723
 724 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 725
 726 *pveum user token list* `<userid>` `[FORMAT_OPTIONS]`
 727
 728 Get user API tokens.
 729
 730 `<userid>`: `<string>` ::
 731
 732 User ID
 733
 734 *pveum user token modify* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 735
 736 Update API token for a specific user.
 737
 738 `<userid>`: `<string>` ::
 739
 740 User ID
 741
 742 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 743
 744 User-specific token identifier.
 745
 746 `--comment` `<string>` ::
 747
 748 no description available
 749
 750 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 751
 752 API token expiration date (seconds since epoch). '0' means no expiration date.
 753
 754 `--privsep` `<boolean>` ('default =' `1`)::
 755
 756 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 757
 758 *pveum user token permissions* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 759
 760 Retrieve effective permissions of given token.
 761
 762 `<userid>`: `<string>` ::
 763
 764 User ID
 765
 766 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 767
 768 User-specific token identifier.
 769
 770 `--path` `<string>` ::
 771
 772 Only dump this specific path, not the whole tree.
 773
 774 *pveum user token remove* `<userid> <tokenid>` `[FORMAT_OPTIONS]`
 775
 776 Remove API token for a specific user.
 777
 778 `<userid>`: `<string>` ::
 779
 780 User ID
 781
 782 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 783
 784 User-specific token identifier.
 785
 786 *pveum useradd*
 787
 788 An alias for 'pveum user add'.
 789
 790 *pveum userdel*
 791
 792 An alias for 'pveum user delete'.
 793
 794 *pveum usermod*
 795
 796 An alias for 'pveum user modify'.
 797
 798