Create administrator user
What it does
Creates a local Linux account for SSH access and a matching Proxmox VE account in the pve realm. The Proxmox account receives the built-in PVEAdmin role at /, which grants administrator access across the cluster.
Optionally, it downloads the public SSH keys published by a GitHub account and installs them for the new local account. It does not install packages or grant the local account passwordless sudo access.
Run this as root on any node in the cluster. Proxmox account and ACL changes are stored in the cluster configuration, while the Linux account and SSH keys are created only on the node where the script runs. Run it separately on each node where the user needs SSH access.
System: Proxmox Ve 9.2 x86_64
Download commands omit password values and prompt securely when run.
bash -c "$(curl -fsSL 'https://hero4hire.com/scripts/proxmox-9.2-x86_64/create-admin-user.sh')"Show script
Loading script…How it works
useradd and chpasswd create the node-local login. pveum user add creates the cluster-wide @pve account, and pveum acl modify / --role PVEAdmin assigns its administrator permissions. When a GitHub user is supplied, curl retrieves its public-key feed directly; no GitHub token, GitHub CLI, JSON parser, or additional package is used.
The password is passed to pveum because its command-line interface requires the password value. Since the generated script necessarily contains that password, run it from a trusted terminal and avoid saving or sharing the copied script afterward.
Commands Used
| Command | Argument | Description |
|---|---|---|
id | Checks that the script runs as root and whether the requested local account already exists. | |
-u | Prints the numeric ID of the current user. Root has ID 0. | |
| Account name | Checks whether that local account already exists. | |
pveum | Proxmox VE's user-management command; it checks for an existing account, creates the @pve account, and assigns its administrator ACL. | |
user list | Lists existing Proxmox VE accounts before creation. | |
user add name@pve | Creates the account in Proxmox's built-in pve realm. | |
--password | Sets the password for the @pve account. | |
acl modify / | Changes permissions at the cluster root path. | |
--user name@pve | Selects the account receiving the ACL. | |
--role PVEAdmin | Grants Proxmox VE's built-in administrator role. | |
useradd | Creates the local Linux account and its home directory on the node where the script runs. | |
--create-home | Creates /home/name for the new account. | |
--shell /bin/bash | Sets Bash as the account's login shell. | |
| Account name | Names the new local account. | |
chpasswd | Sets the local Linux account password from the name:password value supplied on standard input. It uses no arguments. | |
curl | Downloads public keys from github.com/USER.keys only when a GitHub user is supplied. | |
--fail | Treats HTTP error responses as failures. | |
--location | Follows redirects returned by GitHub. | |
--silent | Suppresses transfer progress output. | |
--show-error | Still displays an error if the transfer fails. | |
mktemp | Creates a securely named temporary file for downloaded SSH keys before any local account is changed. It uses no arguments. | |
install | Creates the optional .ssh directory and installs the downloaded key file with ownership and permissions suitable for OpenSSH. | |
-d | Creates a directory rather than copying a file. | |
-m 700 | Makes the .ssh directory accessible only to its owner. | |
-m 600 | Makes authorized_keys readable and writable only by its owner. | |
-o / -g | Sets the local account as the file or directory owner and group. | |
awk | Extracts account IDs from pveum user list output before the existence check. | |
grep | Searches those account IDs with -Fx for an exact, whole-line match. | |
-F | Treats the account ID as fixed text rather than a regular expression. | |
-x | Requires the entire line to match the account ID. | |
rm | Removes the temporary GitHub-key file at script exit. | |
-f | Lets cleanup succeed even when no temporary file was created. |
References
Proxmox documents user administration through pveum and its ACL model in the Proxmox VE Administration Guide. GitHub’s public SSH keys API describes the public-key data associated with a GitHub user.