Create pve-lxc-system-admin.sh

[heinemannj]

Initial commit

Scripts which are clearly AI generated and not further revised by the Author of this PR (in terms of Coding Standards and Script Layout) may be closed without review.

✍️ Description

Based on the code of PVE LXC Updater I've created a bash script pve-lxc-system-admin.sh addressing the following:

• Create/Manage a System Admin User on PVE node (passwordless with sudo group membership and SSH access rights)
  • scapadm:x:1001:1001:SCAP Admin:/home/scapadm:/bin/bash
  • scapadm : scapadm sudo users
  • %sudo ALL=(ALL:ALL) NOPASSWD:ALL
  • PubkeyAuthentication yes
  • -rw------- 1 scapadm scapadm 99 Mar 26 11:11 /home/scapadm/.ssh/authorized_keys
  • ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLbWTQDKgkQAk+QusliGmXWAc3XXXXXXXXXXXXXXX scapadm@fritz.box

• Deploy node user(s) on selected LXC(s) with the same above permissions

[Info] User with group memberships already exists inside evcc: scapadm : scapadm sudo users
[Info] sudoers configuration inside evcc: %sudo ALL=(ALL:ALL) NOPASSWD:ALL
[Info] Copy authorized_keys inside evcc: -rw------- 1 scapadm scapadm 99 Mar 26 11:15 /home/scapadm/.ssh/authorized_keys
[Info] sshd configuration inside evcc: PubkeyAuthentication yes
[Info] --- Starting 136 
[Info] --- Waiting For 136 To Start 
[Info] User with group memberships already exists inside dockge: scapadm : scapadm sudo users
[Info] sudoers configuration inside dockge: %sudo       ALL=(ALL:ALL) NOPASSWD:ALL
[Info] Copy authorized_keys inside dockge: -rw------- 1 scapadm scapadm 99 Mar 26 11:15 /home/scapadm/.ssh/authorized_keys
[Info] sshd configuration inside dockge: PubkeyAuthentication yes
[Info] --- Shutting down 136 
[Info] User with group memberships already exists inside debian: scapadm : scapadm sudo users
[Info] sudoers configuration inside debian: %sudo       ALL=(ALL:ALL) NOPASSWD:ALL
[Info] Copy authorized_keys inside debian: -rw------- 1 scapadm scapadm 99 Mar 26 11:15 /home/scapadm/.ssh/authorized_keys
[Info] sshd configuration inside debian: PubkeyAuthentication yes

The process of Deploy UID and Public Key of User 'scapadm' is complete, and the containers have been successfully modified.

• Protect System Admin(s) Private Key(s)
  • with a strong passphrase for human interactive access
  • Distribute the private Keys for very limited use cases only

Goals and Improvements

• Limit the usage of root account to console access (on Node(s) and LXC(s))
• No password and SSH access for root users
• Additional System Admin(s) for remote SSH emergency access in case PROXMOX Web UI is not reachable
• Centrally managed maintenance over the complete PROXMOX environment (e.g. compliance checks, patching status checks, ...) can be easily implemented

🔗 Related PR / Issue

Link: #

✅ Prerequisites (X in brackets)

• Self-review completed – Code follows project standards.
• Tested thoroughly – Changes work as expected.
• No breaking changes – Existing functionality remains intact.
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.

---

🛠️ Type of Change (X in brackets)

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing functionality in a way that may require updates.
• 🆕 New script – A fully functional and tested script or script set.
• 🌍 Website update – Changes to website-related JSON files or metadata.
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, AppName.md, CONTRIBUTING.md, or other docs.

---

🔍 Code & Security Review (X in brackets)

• Follows Code_Audit.md & CONTRIBUTING.md guidelines
• Uses correct script structure (AppName.sh, AppName-install.sh, AppName.json)
• No hardcoded credentials

📋 Additional Information (optional)

---

📦 Application Requirements (for new scripts)

Required for 🆕 New script submissions.
Pull requests that do not meet these requirements may be closed without review.

• The application is at least 6 months old
• The application is actively maintained
• The application has 600+ GitHub stars
• Official release tarballs are published
• I understand that not all scripts will be accepted due to various reasons and criteria by the community-scripts ORG

🌐 Source

OpenSSH
PVE LXC Updater

[CrazyWolf13]

For quite some things we already have functions inplemented in core / build or tools.func, can you try to directly use those?

Also for header info, it should be possible to use it directly, without adding the full logo.

Sorry for the misbehaving bot!

[github-actions]

@heinemannj Closing stale PR due to inactivity (no commits for 7 days after stale label).

[heinemannj]

For quite some things we already have functions inplemented in core / build or tools.func, can you try to directly use those?

Also for header info, it should be possible to use it directly, without adding the full logo.

Actually I'm working on the redisign of step-ca-admin as an add-on:
https://raw.githubusercontent.com/heinemannj/step-admin/main/step-admin.sh

I'm using the following sources:

source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)

source <(curl -fsSL https://raw.githubusercontent.com/heinemannj/ProxmoxVE-Admin/main/misc/admin-core.func)
source <(curl -fsSL https://raw.githubusercontent.com/heinemannj/ProxmoxVE-Admin/main/misc/whiptail.func)

Can you please doublecheck if the last two sources created by myself can be included whin your library?
Quite useful staff which can be reused in pve-lxc-system-admin.sh and other existing add-ons.

[CrazyWolf13]

@heinemannj as far as I can tell, we already have those functions in admin-core located in our funcs, but there may be some additions that can be done / more standartisation with the env vars you used, so feel free to PR that.

about the whiptail, I think @MickLesk once built something, so I guess he knows best what we already have.