Reboot Permissions Error

[neilcolyn-jpg]

Get the following error when trying to reboot a Proxmox Node via Proxcenter

[adminsyspro]

Hi Neil,

The error is coming from Proxmox itself: the API user (or token) that ProxCenter uses to connect to your cluster does not have the Sys.PowerMgmt privilege on the node path.

To fix this, in the Proxmox web UI:

1. Go to Datacenter > Permissions
2. Add a permission entry:
   • Path: /nodes/ld6-pve-node01 (or /nodes to cover all nodes)
   • User/Token: the one configured in your ProxCenter connection
   • Role: a role that includes Sys.PowerMgmt (e.g. PVEAdmin, or a custom role with that privilege added)
3. Click Add, then retry the reboot from ProxCenter.

If you are using an API token, make sure the token itself inherits the permission (tokens with Privilege Separation enabled need their own ACL entry, not just the parent user's).

Let us know if that resolves it!

[neilcolyn-jpg]

Good Day,

Thank you for the response.

So, we created the Proxcenter user and API token using the script provided when adding a new PVE connection. (Very useful, thank you).

Create a dedicated user

pveum user add proxcenter@pve
--comment "ProxCenter service account"

Create an API token (privsep=0 inherits user permissions)

pveum user token add proxcenter@pve proxcenter-token
--privsep=0

Grant PVEAdmin role on the entire cluster

pveum aclmod / -user proxcenter@pve -role PVEAdmin

Add the Sys.Modify privilege required by Rolling Update (apt package refresh)

pveum role add ProxCenter -privs "Sys.Modify"
pveum aclmod / -user proxcenter@pve -role ProxCenter

I noticed the API token role "ProxCenter" only has "Sys.Modify". Should we add "Sys.PowerMgmt" as well?

This is what the permissions look like for Proxcenter from PVE.

The top Proxcenter is the API token that connection is using.
The bottom Proxcenter is the SSH account and is using the PVEAdmin role.

Both accounts have propagation enabled from / level

Kind Regards,
Neil

[adminsyspro]

Hi Neil,

Yes, please add Sys.PowerMgmt. That is exactly the missing piece.

The reason node reboot fails even with PVEAdmin: in Proxmox, PVEAdmin grants VM.PowerMgmt (power operations on guests) but not Sys.PowerMgmt (reboot/shutdown of the node itself). Node power actions are gated on Sys.PowerMgmt at the /nodes path, and our custom ProxCenter role currently only carries Sys.Modify (which we add for Rolling Update). So neither role covers node power management, which is why the reboot is rejected even though the token has PVEAdmin.

Since your ProxCenter role is already assigned to proxcenter@pve at / with propagation, and your token is privsep=0 (it inherits the user's privileges), you only need to add the privilege to that role. One command on any cluster node:

pveum role modify ProxCenter -privs "Sys.Modify,Sys.PowerMgmt"

It takes effect immediately, no new token or re-login needed. Retry the node reboot from ProxCenter and it should go through.

Thanks for the detailed report and the screenshots. We will also update the setup script shown in the connection dialog to include Sys.PowerMgmt by default, so new installs get node reboot working out of the box.

Kind regards,
The ProxCenter team