Archived
Stage 1 base config/hardening toolset, applied and verified on pve1
Splits the repo into Stage 1 (base host config/hardening, applies to any node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC hardware can't support the assumed split-disk/multi-NIC layout). Adds the Stage 1 toolset: firewall deploy, named admin user creation, unattended security upgrades, subscription-nag removal (with an apt hook so the patch survives package updates), and a read-only audit script. Fixes switch-to-no-subscription-repo.sh, which only handled the legacy .list format and silently no-op'd against PVE 9's deb822 .sources files; it now removes enterprise sources outright rather than commenting them out. Shared logic (root check, idempotent file writes, backups) factored into scripts/lib/common.sh. Ran the full sequence against pve1 via scripts/bootstrap.sh + create-admin-user.sh; scripts/audit.sh confirms all checks pass.
This commit is contained in:
Executable
+100
@@ -0,0 +1,100 @@
|
||||
#!/bin/bash
|
||||
# Read-only Stage 1 base-hardening audit. Checks the current state of a PVE
|
||||
# host against the checklist in docs/04-security-hardening.md and prints
|
||||
# PASS/FAIL per item. Exits non-zero if anything fails, so it can gate CI or
|
||||
# be run periodically as a compliance check. Makes no changes.
|
||||
#
|
||||
# Usage: ./audit.sh (run as root on the PVE host)
|
||||
set -uo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
AUDIT_FAIL=0
|
||||
|
||||
# --- apt repos: no enabled enterprise source ---
|
||||
ENTERPRISE_ENABLED=0
|
||||
for f in /etc/apt/sources.list.d/*.sources /etc/apt/sources.list.d/*.list; do
|
||||
[ -f "$f" ] || continue
|
||||
grep -qi 'enterprise.proxmox.com' "$f" 2>/dev/null && ENTERPRISE_ENABLED=1
|
||||
done
|
||||
if [ "$ENTERPRISE_ENABLED" -eq 0 ]; then
|
||||
audit_pass "no enabled enterprise apt repo"
|
||||
else
|
||||
audit_fail "an enterprise apt repo is still enabled (needs a subscription to update)"
|
||||
fi
|
||||
|
||||
# --- SSH ---
|
||||
SSHD_T="$(sshd -T 2>/dev/null)"
|
||||
if echo "$SSHD_T" | grep -qiE '^permitrootlogin (prohibit-password|without-password)'; then
|
||||
audit_pass "sshd: PermitRootLogin prohibit-password (key-only)"
|
||||
else
|
||||
audit_fail "sshd: PermitRootLogin is not key-only (prohibit-password/without-password)"
|
||||
fi
|
||||
if echo "$SSHD_T" | grep -qi '^passwordauthentication no'; then
|
||||
audit_pass "sshd: PasswordAuthentication no"
|
||||
else
|
||||
audit_fail "sshd: PasswordAuthentication is not disabled"
|
||||
fi
|
||||
|
||||
# --- fail2ban ---
|
||||
if systemctl is-active --quiet fail2ban 2>/dev/null; then
|
||||
audit_pass "fail2ban is active"
|
||||
else
|
||||
audit_fail "fail2ban is not active"
|
||||
fi
|
||||
|
||||
# --- PVE firewall ---
|
||||
FW_STATUS="$(pve-firewall status 2>/dev/null || true)"
|
||||
if echo "$FW_STATUS" | grep -qi '^Status: enabled'; then
|
||||
audit_pass "pve-firewall is enabled"
|
||||
else
|
||||
audit_fail "pve-firewall is not enabled (status: ${FW_STATUS:-unknown})"
|
||||
fi
|
||||
if [ -f /etc/pve/firewall/cluster.fw ] && grep -qi '^policy_in:\s*DROP' /etc/pve/firewall/cluster.fw 2>/dev/null; then
|
||||
audit_pass "cluster.fw has default-deny inbound policy"
|
||||
else
|
||||
audit_fail "cluster.fw missing or does not default-deny inbound"
|
||||
fi
|
||||
|
||||
# --- unattended-upgrades ---
|
||||
if dpkg -s unattended-upgrades >/dev/null 2>&1 && systemctl is-enabled --quiet unattended-upgrades 2>/dev/null; then
|
||||
audit_pass "unattended-upgrades installed and enabled"
|
||||
else
|
||||
audit_fail "unattended-upgrades not installed/enabled"
|
||||
fi
|
||||
if [ -f /var/run/reboot-required ]; then
|
||||
audit_warn "a reboot is pending (/var/run/reboot-required) - schedule one"
|
||||
fi
|
||||
|
||||
# --- named admin user (not just root@pam) ---
|
||||
if pveum user list --output-format json 2>/dev/null | grep -q '"userid":"[^"]*@pve"'; then
|
||||
audit_pass "a named @pve admin user exists (root@pam is not the only account)"
|
||||
else
|
||||
audit_fail "no named @pve user found - root@pam is the only account"
|
||||
fi
|
||||
|
||||
# --- time sync ---
|
||||
if timedatectl show -p NTPSynchronized --value 2>/dev/null | grep -qx 'yes'; then
|
||||
audit_pass "clock is NTP-synchronized"
|
||||
else
|
||||
audit_fail "clock is not NTP-synchronized"
|
||||
fi
|
||||
|
||||
# --- subscription nag (cosmetic - warn only, never fails the audit) ---
|
||||
JS_FILE="/usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js"
|
||||
if [ -f "$JS_FILE" ] && ! grep -qF "data.status.toLowerCase() !== 'active'" "$JS_FILE"; then
|
||||
audit_pass "subscription nag patch applied"
|
||||
else
|
||||
audit_warn "subscription nag patch not applied (cosmetic only, see scripts/disable-subscription-nag.sh)"
|
||||
fi
|
||||
|
||||
echo
|
||||
if [ "$AUDIT_FAIL" -eq 0 ]; then
|
||||
echo "All Stage 1 base-hardening checks passed."
|
||||
else
|
||||
echo "One or more checks failed - see FAIL lines above."
|
||||
fi
|
||||
exit "$AUDIT_FAIL"
|
||||
Executable
+45
@@ -0,0 +1,45 @@
|
||||
#!/bin/bash
|
||||
# Stage 1 base config + hardening, end to end, for a single fresh PVE host.
|
||||
# Runs the individual scripts in order. Idempotent - safe to re-run.
|
||||
#
|
||||
# Does NOT create the named admin user (needs a username decision) - run
|
||||
# create-admin-user.sh separately afterwards. Run audit.sh at the end to
|
||||
# verify.
|
||||
#
|
||||
# Usage: MGMT_CIDR=192.168.2.0/24 ./bootstrap.sh
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
if [ -z "${MGMT_CIDR:-}" ]; then
|
||||
echo "MGMT_CIDR is not set. Example: MGMT_CIDR=192.168.2.0/24 $0" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "=== 1/5: remove enterprise repos, switch to no-subscription ==="
|
||||
"${SCRIPT_DIR}/switch-to-no-subscription-repo.sh"
|
||||
|
||||
echo
|
||||
echo "=== 2/5: SSH hardening (key-only root login + fail2ban) ==="
|
||||
"${SCRIPT_DIR}/harden-ssh.sh"
|
||||
|
||||
echo
|
||||
echo "=== 3/5: unattended security upgrades ==="
|
||||
"${SCRIPT_DIR}/setup-unattended-upgrades.sh"
|
||||
|
||||
echo
|
||||
echo "=== 4/5: PVE firewall (mgmt-only SSH/8006) ==="
|
||||
MGMT_CIDR="$MGMT_CIDR" "${SCRIPT_DIR}/deploy-firewall.sh"
|
||||
|
||||
echo
|
||||
echo "=== 5/5: disable subscription nag (cosmetic) ==="
|
||||
"${SCRIPT_DIR}/disable-subscription-nag.sh"
|
||||
|
||||
echo
|
||||
echo "=== Base hardening applied. Remaining manual/deliberate steps: ==="
|
||||
echo " - ${SCRIPT_DIR}/create-admin-user.sh <username>"
|
||||
echo " - Enable 2FA/TOTP for that user and root@pam via the web UI"
|
||||
echo " - ${SCRIPT_DIR}/audit.sh (verify everything above)"
|
||||
Executable
+43
@@ -0,0 +1,43 @@
|
||||
#!/bin/bash
|
||||
# Create a named PVE admin user (Administrator role) so root@pam can be
|
||||
# reserved for emergencies. Generates a random initial password, printed
|
||||
# once - change it and enable TOTP on first login (Datacenter -> Permissions
|
||||
# -> Two Factor, or the user icon menu in the top right).
|
||||
#
|
||||
# Idempotent - if the user already exists, does nothing (won't reset an
|
||||
# existing password). Run as root on the PVE host.
|
||||
#
|
||||
# Usage: ./create-admin-user.sh <username> (realm is always @pve)
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
USERNAME="${1:-}"
|
||||
if [ -z "$USERNAME" ]; then
|
||||
echo "Usage: $0 <username>" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
USERID="${USERNAME}@pve"
|
||||
|
||||
if pveum user list --output-format json 2>/dev/null | grep -q "\"${USERID}\""; then
|
||||
echo "${USERID} already exists - not touching password or role. Skipping."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
PASSWORD="$(openssl rand -base64 24)"
|
||||
|
||||
pveum user add "$USERID" --password "$PASSWORD" --comment "Named admin account, created by create-admin-user.sh"
|
||||
pveum acl modify / --users "$USERID" --roles Administrator
|
||||
|
||||
echo
|
||||
echo "Created ${USERID} with the Administrator role."
|
||||
echo "Initial password (shown once - not logged anywhere): ${PASSWORD}"
|
||||
echo
|
||||
echo "Next steps (do these before relying on this account):"
|
||||
echo " 1. Log in as ${USERID} and change the password."
|
||||
echo " 2. Enable TOTP/2FA for ${USERID} (and for root@pam)."
|
||||
echo " 3. Reserve root@pam for emergencies only from here on."
|
||||
Executable
+48
@@ -0,0 +1,48 @@
|
||||
#!/bin/bash
|
||||
# Deploy the Proxmox datacenter-level firewall from
|
||||
# config/pve-firewall/cluster.fw.example, with the management CIDR filled
|
||||
# in, and enable it. Default-deny inbound; allow SSH/8006 from mgmt only.
|
||||
#
|
||||
# Idempotent - safe to re-run. Run as root on the PVE host.
|
||||
#
|
||||
# Usage: MGMT_CIDR=192.168.2.0/24 ./deploy-firewall.sh
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
if [ -z "${MGMT_CIDR:-}" ]; then
|
||||
echo "MGMT_CIDR is not set. Example: MGMT_CIDR=192.168.2.0/24 $0" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! [[ "$MGMT_CIDR" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$ ]]; then
|
||||
echo "MGMT_CIDR '${MGMT_CIDR}' doesn't look like a CIDR (e.g. 192.168.2.0/24)." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TEMPLATE="${SCRIPT_DIR}/../config/pve-firewall/cluster.fw.example"
|
||||
if [ ! -f "$TEMPLATE" ]; then
|
||||
echo "Template not found: $TEMPLATE" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Corosync/Ceph rules stay commented placeholders until Stage 2 (cluster);
|
||||
# only the mgmt IPSET is real for a single Stage 1 node.
|
||||
mkdir -p /etc/pve/firewall
|
||||
write_if_changed "/etc/pve/firewall/cluster.fw" "$(sed "s|<MGMT_CIDR>|${MGMT_CIDR}|" "$TEMPLATE")"
|
||||
|
||||
echo "Validating ruleset..."
|
||||
pve-firewall compile
|
||||
|
||||
echo "Restarting pve-firewall..."
|
||||
pve-firewall restart
|
||||
sleep 1
|
||||
pve-firewall status
|
||||
|
||||
echo
|
||||
echo "Firewall enabled. SSH (22) and the web UI (8006) are now only reachable"
|
||||
echo "from ${MGMT_CIDR}. If your current SSH session is NOT from that range,"
|
||||
echo "reconnect and verify access before closing this session."
|
||||
Executable
+24
@@ -0,0 +1,24 @@
|
||||
#!/bin/bash
|
||||
# Install the subscription-nag patch (lib/nag-patch.sh) as a persistent
|
||||
# standalone script under /usr/local/sbin, plus an apt Post-Invoke hook that
|
||||
# re-applies it after every dpkg run - a proxmox-widget-toolkit package
|
||||
# upgrade overwrites the patched file, so without the hook the patch would
|
||||
# silently revert on the next `apt upgrade`.
|
||||
#
|
||||
# Idempotent - safe to re-run. Run as root on the PVE host.
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
INSTALLED="/usr/local/sbin/pve-disable-subscription-nag.sh"
|
||||
write_if_changed "$INSTALLED" "$(cat "${SCRIPT_DIR}/lib/nag-patch.sh")"
|
||||
chmod +x "$INSTALLED"
|
||||
|
||||
HOOK="/etc/apt/apt.conf.d/85pve-nosubnag"
|
||||
write_if_changed "$HOOK" 'DPkg::Post-Invoke { "test -x /usr/local/sbin/pve-disable-subscription-nag.sh && /usr/local/sbin/pve-disable-subscription-nag.sh || true"; };'
|
||||
|
||||
"$INSTALLED"
|
||||
echo "Subscription nag patch installed; will reapply automatically after updates."
|
||||
+10
-18
@@ -3,20 +3,10 @@
|
||||
# + fail2ban. Idempotent - safe to re-run. Run as root on the PVE host.
|
||||
set -euo pipefail
|
||||
|
||||
DROPIN_DIR="/etc/ssh/sshd_config.d"
|
||||
DROPIN_FILE="${DROPIN_DIR}/99-hardening.conf"
|
||||
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "Must run as root." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "$DROPIN_DIR"
|
||||
cat > "$DROPIN_FILE" <<'EOF'
|
||||
PermitRootLogin prohibit-password
|
||||
PasswordAuthentication no
|
||||
EOF
|
||||
echo "Wrote $DROPIN_FILE"
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
if ! authorized_keys_present=$(find /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys -type f 2>/dev/null | head -n1); then
|
||||
authorized_keys_present=""
|
||||
@@ -26,6 +16,10 @@ if [ -z "$authorized_keys_present" ]; then
|
||||
echo "Add your SSH public key before disconnecting, or you'll lock yourself out." >&2
|
||||
fi
|
||||
|
||||
mkdir -p /etc/ssh/sshd_config.d
|
||||
write_if_changed "/etc/ssh/sshd_config.d/99-hardening.conf" "PermitRootLogin prohibit-password
|
||||
PasswordAuthentication no"
|
||||
|
||||
sshd -t
|
||||
systemctl reload sshd
|
||||
echo "sshd reloaded with key-only root login."
|
||||
@@ -36,15 +30,13 @@ if ! dpkg -s fail2ban >/dev/null 2>&1; then
|
||||
fi
|
||||
|
||||
mkdir -p /etc/fail2ban/jail.d
|
||||
cat > /etc/fail2ban/jail.d/sshd.local <<'EOF'
|
||||
[sshd]
|
||||
write_if_changed "/etc/fail2ban/jail.d/sshd.local" "[sshd]
|
||||
enabled = true
|
||||
port = ssh
|
||||
backend = systemd
|
||||
maxretry = 5
|
||||
bantime = 1h
|
||||
findtime = 10m
|
||||
EOF
|
||||
findtime = 10m"
|
||||
|
||||
systemctl enable --now fail2ban
|
||||
systemctl restart fail2ban
|
||||
|
||||
Executable
+47
@@ -0,0 +1,47 @@
|
||||
#!/bin/bash
|
||||
# Shared helpers for proxmox-configuration scripts. Sourced, not executed
|
||||
# directly:
|
||||
# SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# source "${SCRIPT_DIR}/lib/common.sh"
|
||||
|
||||
require_root() {
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "Must run as root." >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Codename of the running Debian/PVE release, e.g. "trixie".
|
||||
pve_codename() {
|
||||
(. /etc/os-release && echo "$VERSION_CODENAME")
|
||||
}
|
||||
|
||||
# backup_file <path>
|
||||
# Copies an existing file to <path>.bak.<epoch>. No-op if it doesn't exist.
|
||||
backup_file() {
|
||||
local path="$1"
|
||||
if [ -f "$path" ]; then
|
||||
cp "$path" "${path}.bak.$(date +%s)"
|
||||
echo "Backed up ${path}"
|
||||
fi
|
||||
}
|
||||
|
||||
# write_if_changed <path> <content>
|
||||
# Writes content to path only if it differs from what's already there,
|
||||
# backing up the previous version first. Prints what happened.
|
||||
write_if_changed() {
|
||||
local path="$1" content="$2"
|
||||
if [ -f "$path" ] && [ "$(cat "$path")" = "$content" ]; then
|
||||
echo "Already up to date: $path"
|
||||
return 0
|
||||
fi
|
||||
backup_file "$path"
|
||||
printf '%s\n' "$content" > "$path"
|
||||
echo "Wrote $path"
|
||||
}
|
||||
|
||||
# --- audit.sh status helpers ---
|
||||
# Callers should initialize: AUDIT_FAIL=0
|
||||
audit_pass() { echo "PASS $1"; }
|
||||
audit_fail() { echo "FAIL $1"; AUDIT_FAIL=1; }
|
||||
audit_warn() { echo "WARN $1"; }
|
||||
Executable
+22
@@ -0,0 +1,22 @@
|
||||
#!/bin/bash
|
||||
# Neutralizes the Proxmox "No valid subscription" nag (login popup and the
|
||||
# dashboard subscription indicator) by patching proxmox-widget-toolkit's
|
||||
# proxmoxlib.js. Cosmetic only - doesn't create or spoof a subscription
|
||||
# anywhere except this UI check.
|
||||
#
|
||||
# This file is not run from the repo directly - disable-subscription-nag.sh
|
||||
# installs a copy of it to /usr/local/sbin and wires it into an apt
|
||||
# Post-Invoke hook, because a proxmox-widget-toolkit package upgrade
|
||||
# overwrites proxmoxlib.js and reverts the patch. Idempotent: exits quietly
|
||||
# if already patched or if the file isn't present.
|
||||
set -euo pipefail
|
||||
|
||||
JS_FILE="/usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js"
|
||||
[ -f "$JS_FILE" ] || exit 0
|
||||
|
||||
PATTERN="data.status.toLowerCase() !== 'active'"
|
||||
grep -qF "$PATTERN" "$JS_FILE" || exit 0
|
||||
|
||||
cp "$JS_FILE" "${JS_FILE}.bak.$(date +%s)"
|
||||
sed -i "s/${PATTERN}/false/g" "$JS_FILE"
|
||||
echo "Patched subscription nag in $JS_FILE"
|
||||
Executable
+46
@@ -0,0 +1,46 @@
|
||||
#!/bin/bash
|
||||
# Install and configure unattended-upgrades for security patches. Deliberately
|
||||
# conservative for a hypervisor: security-only origins (Debian security +
|
||||
# the active PVE repo), no automatic reboot ever - a flag file is left at
|
||||
# /var/run/reboot-required for you to act on manually.
|
||||
#
|
||||
# Idempotent - safe to re-run. Run as root on the PVE host.
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
if ! dpkg -s unattended-upgrades >/dev/null 2>&1; then
|
||||
apt-get update
|
||||
apt-get install -y unattended-upgrades
|
||||
fi
|
||||
|
||||
CODENAME="$(pve_codename)"
|
||||
|
||||
write_if_changed "/etc/apt/apt.conf.d/51pve-unattended-upgrades.conf" "// Managed by proxmox-configuration/scripts/setup-unattended-upgrades.sh
|
||||
Unattended-Upgrade::Origins-Pattern {
|
||||
\"origin=Debian,codename=${CODENAME},label=Debian-Security\";
|
||||
\"origin=Debian,codename=${CODENAME}-security,label=Debian-Security\";
|
||||
\"origin=Proxmox\";
|
||||
};
|
||||
|
||||
// Never auto-reboot a hypervisor. Check /var/run/reboot-required manually
|
||||
// (or via scripts/audit.sh) and reboot during a planned maintenance window.
|
||||
Unattended-Upgrade::Automatic-Reboot \"false\";
|
||||
|
||||
// Don't remove packages automatically; review before doing so by hand.
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies \"false\";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages \"false\";"
|
||||
|
||||
write_if_changed "/etc/apt/apt.conf.d/20auto-upgrades" '// Managed by proxmox-configuration/scripts/setup-unattended-upgrades.sh
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";'
|
||||
|
||||
systemctl enable --now unattended-upgrades.service >/dev/null
|
||||
echo "unattended-upgrades enabled (security-only origins, no auto-reboot)."
|
||||
echo "Dry run:"
|
||||
unattended-upgrade --dry-run --debug 2>&1 | tail -20
|
||||
@@ -1,33 +1,42 @@
|
||||
#!/bin/bash
|
||||
# Switch a fresh Proxmox VE install from the enterprise repo (which fails
|
||||
# on apt update without a paid subscription) to the no-subscription repo.
|
||||
# Remove the Proxmox/Ceph enterprise apt sources (which fail on apt update
|
||||
# without a paid subscription) and switch to the no-subscription repo.
|
||||
# Handles both the legacy one-line .list format and the deb822 .sources
|
||||
# format current PVE installers write.
|
||||
# Idempotent - safe to re-run. Run as root on the PVE host.
|
||||
set -euo pipefail
|
||||
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "Must run as root." >&2
|
||||
exit 1
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
SOURCES_DIR="/etc/apt/sources.list.d"
|
||||
|
||||
# Any sources file pointing at the enterprise host gets moved out of apt's
|
||||
# way entirely (renamed .disabled) rather than commented out in place -
|
||||
# apt only reads *.sources/*.list, so this fully removes it from
|
||||
# consideration while keeping a copy on disk for reference.
|
||||
for f in "${SOURCES_DIR}"/*.sources "${SOURCES_DIR}"/*.list; do
|
||||
[ -f "$f" ] || continue
|
||||
grep -qi 'enterprise.proxmox.com' "$f" 2>/dev/null || continue
|
||||
mv "$f" "${f}.disabled"
|
||||
echo "Removed enterprise source (renamed to .disabled): $f"
|
||||
done
|
||||
|
||||
write_if_changed "${SOURCES_DIR}/pve-no-subscription.sources" "Types: deb
|
||||
URIs: http://download.proxmox.com/debian/pve
|
||||
Suites: $(pve_codename)
|
||||
Components: pve-no-subscription
|
||||
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg"
|
||||
|
||||
# Clean up a legacy-format no-subscription file from a previous run of an
|
||||
# older version of this script, to avoid two sources for the same repo.
|
||||
LEGACY_NOSUB="${SOURCES_DIR}/pve-no-subscription.list"
|
||||
if [ -f "$LEGACY_NOSUB" ]; then
|
||||
rm -f "$LEGACY_NOSUB"
|
||||
echo "Removed superseded $LEGACY_NOSUB"
|
||||
fi
|
||||
|
||||
CODENAME="$(. /etc/os-release && echo "$VERSION_CODENAME")"
|
||||
|
||||
ENTERPRISE_LIST="/etc/apt/sources.list.d/pve-enterprise.list"
|
||||
if [ -f "$ENTERPRISE_LIST" ]; then
|
||||
sed -i 's/^deb/#deb/' "$ENTERPRISE_LIST"
|
||||
echo "Disabled $ENTERPRISE_LIST"
|
||||
fi
|
||||
|
||||
CEPH_ENTERPRISE_LIST="/etc/apt/sources.list.d/ceph.list"
|
||||
if [ -f "$CEPH_ENTERPRISE_LIST" ] && grep -q enterprise "$CEPH_ENTERPRISE_LIST" 2>/dev/null; then
|
||||
sed -i 's/^deb/#deb/' "$CEPH_ENTERPRISE_LIST"
|
||||
echo "Disabled $CEPH_ENTERPRISE_LIST"
|
||||
fi
|
||||
|
||||
NOSUB_LIST="/etc/apt/sources.list.d/pve-no-subscription.list"
|
||||
cat > "$NOSUB_LIST" <<EOF
|
||||
deb http://download.proxmox.com/debian/pve ${CODENAME} pve-no-subscription
|
||||
EOF
|
||||
echo "Wrote $NOSUB_LIST for codename '${CODENAME}'."
|
||||
|
||||
apt-get update
|
||||
echo "Repo switched. Review 'apt list --upgradable' before upgrading."
|
||||
|
||||
Reference in New Issue
Block a user