Skip to main content
RunBook Academy

Proxmox VEXV · Security & HardeningAccess control

Auth realms, RBAC, TFA, and API tokens

Intermediate⏱ ~18 min

What you'll learn

  • Configure auth realms PAM, LDAP, AD, OIDC
  • Apply RBAC roles and ACLs for least privilege
  • Enable TFA MFA for admin accounts
  • Use API tokens safely

Prerequisites

Verified against Proxmox VE 9.2.4 · Proxmox Backup Server 4.2.5 · Ceph Squid / Tentacle · Debian 13 (Trixie) · Linux kernel 7.0 (PVE 9.2 default) · 2026-08-07

Not yet marked complete on this device.

Why this matters in production

Authentication is the front door. Authorisation is what users can do once inside. Both must be deliberate.

Auth realms

A realm is a source of authentication. Proxmox supports:

RealmUse
pamLocal Linux users (/etc/passwd)
pveProxmox-managed users (/etc/pve/user.cfg)
ldapLDAP directory
adActive Directory
openidOpenID Connect (OIDC)

Add an LDAP/AD realm:

pvesh create /access/domains --realm corp.example.com --type ad --server1 ad1.corp.example.com --server2 ad2.corp.example.com --base-dn 'DC=corp,DC=example,DC=com' --bind-dn 'CN=svc-proxmox,OU=Service,DC=corp,DC=example,DC=com' --bind-password '***' --secure 1 --port 636

RBAC

RBAC (Role-Based Access Control) assigns roles to users on paths.

Built-in roleWhat it grants
PVEAdminEverything except some administrative actions
PVEVMAdminVM administration, no cluster admin
PVEVMUserView and use own VMs
PVEAuditorRead-only access
PVESysAdminHost-level admin (firewall, networking)
pvesh create /access/acl --path /vms/100 --roles PVEVMUser --users alice@pve

TFA (Two-Factor Authentication)

TFA adds a second factor (TOTP, WebAuthn, recovery key) to authentication.

pvesh create /access/users/{userid}/tfa --type totp --id totp-id

Or via GUI: User → TFA → Add.

API tokens

API tokens allow scripts and tools to authenticate as a user without that user’s password.

pvesh create /access/users/{userid}/token/{tokenid} --privsep 1

Token format: user@realm!tokenid=secret.

Options:

OptionPurpose
--privsep 1Token has its own ACLs, separate from the user’s. Safer for automation.
--privsep 0Token inherits the user’s full permissions. Risky.

Production considerations

Common mistakes

  • Admin accounts without TFA.
  • API tokens with privilege separation disabled.
  • Single shared admin account for the team.

Key takeaways

  • Use AD/LDAP for humans; reserve local for service accounts.
  • RBAC with least privilege.
  • TFA mandatory for admins.
  • API tokens with privilege separation.

Knowledge check

Knowledge check · 3 questions

  1. Q1. Which option creates an API token that does NOT inherit the user's full permissions?

  2. Q2. Admin accounts may skip TFA for convenience.

  3. Q3. Which auth realm is best for production human accounts?

Passing score: 75%. Answers are checked in this browser.