Stage 1 base config/hardening toolset, applied and verified on pve1

Splits the repo into Stage 1 (base host config/hardening, applies to any
node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC
hardware can't support the assumed split-disk/multi-NIC layout).

Adds the Stage 1 toolset: firewall deploy, named admin user creation,
unattended security upgrades, subscription-nag removal (with an apt hook
so the patch survives package updates), and a read-only audit script.
Fixes switch-to-no-subscription-repo.sh, which only handled the legacy
.list format and silently no-op'd against PVE 9's deb822 .sources files;
it now removes enterprise sources outright rather than commenting them
out. Shared logic (root check, idempotent file writes, backups) factored
into scripts/lib/common.sh.

Ran the full sequence against pve1 via scripts/bootstrap.sh +
create-admin-user.sh; scripts/audit.sh confirms all checks pass.
This commit is contained in:
2026-07-21 05:44:50 +00:00
parent 24a0047fa8
commit 2cca6a7dc0
17 changed files with 625 additions and 97 deletions
+100
View File
@@ -0,0 +1,100 @@
#!/bin/bash
# Read-only Stage 1 base-hardening audit. Checks the current state of a PVE
# host against the checklist in docs/04-security-hardening.md and prints
# PASS/FAIL per item. Exits non-zero if anything fails, so it can gate CI or
# be run periodically as a compliance check. Makes no changes.
#
# Usage: ./audit.sh (run as root on the PVE host)
set -uo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root
AUDIT_FAIL=0
# --- apt repos: no enabled enterprise source ---
ENTERPRISE_ENABLED=0
for f in /etc/apt/sources.list.d/*.sources /etc/apt/sources.list.d/*.list; do
[ -f "$f" ] || continue
grep -qi 'enterprise.proxmox.com' "$f" 2>/dev/null && ENTERPRISE_ENABLED=1
done
if [ "$ENTERPRISE_ENABLED" -eq 0 ]; then
audit_pass "no enabled enterprise apt repo"
else
audit_fail "an enterprise apt repo is still enabled (needs a subscription to update)"
fi
# --- SSH ---
SSHD_T="$(sshd -T 2>/dev/null)"
if echo "$SSHD_T" | grep -qiE '^permitrootlogin (prohibit-password|without-password)'; then
audit_pass "sshd: PermitRootLogin prohibit-password (key-only)"
else
audit_fail "sshd: PermitRootLogin is not key-only (prohibit-password/without-password)"
fi
if echo "$SSHD_T" | grep -qi '^passwordauthentication no'; then
audit_pass "sshd: PasswordAuthentication no"
else
audit_fail "sshd: PasswordAuthentication is not disabled"
fi
# --- fail2ban ---
if systemctl is-active --quiet fail2ban 2>/dev/null; then
audit_pass "fail2ban is active"
else
audit_fail "fail2ban is not active"
fi
# --- PVE firewall ---
FW_STATUS="$(pve-firewall status 2>/dev/null || true)"
if echo "$FW_STATUS" | grep -qi '^Status: enabled'; then
audit_pass "pve-firewall is enabled"
else
audit_fail "pve-firewall is not enabled (status: ${FW_STATUS:-unknown})"
fi
if [ -f /etc/pve/firewall/cluster.fw ] && grep -qi '^policy_in:\s*DROP' /etc/pve/firewall/cluster.fw 2>/dev/null; then
audit_pass "cluster.fw has default-deny inbound policy"
else
audit_fail "cluster.fw missing or does not default-deny inbound"
fi
# --- unattended-upgrades ---
if dpkg -s unattended-upgrades >/dev/null 2>&1 && systemctl is-enabled --quiet unattended-upgrades 2>/dev/null; then
audit_pass "unattended-upgrades installed and enabled"
else
audit_fail "unattended-upgrades not installed/enabled"
fi
if [ -f /var/run/reboot-required ]; then
audit_warn "a reboot is pending (/var/run/reboot-required) - schedule one"
fi
# --- named admin user (not just root@pam) ---
if pveum user list --output-format json 2>/dev/null | grep -q '"userid":"[^"]*@pve"'; then
audit_pass "a named @pve admin user exists (root@pam is not the only account)"
else
audit_fail "no named @pve user found - root@pam is the only account"
fi
# --- time sync ---
if timedatectl show -p NTPSynchronized --value 2>/dev/null | grep -qx 'yes'; then
audit_pass "clock is NTP-synchronized"
else
audit_fail "clock is not NTP-synchronized"
fi
# --- subscription nag (cosmetic - warn only, never fails the audit) ---
JS_FILE="/usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js"
if [ -f "$JS_FILE" ] && ! grep -qF "data.status.toLowerCase() !== 'active'" "$JS_FILE"; then
audit_pass "subscription nag patch applied"
else
audit_warn "subscription nag patch not applied (cosmetic only, see scripts/disable-subscription-nag.sh)"
fi
echo
if [ "$AUDIT_FAIL" -eq 0 ]; then
echo "All Stage 1 base-hardening checks passed."
else
echo "One or more checks failed - see FAIL lines above."
fi
exit "$AUDIT_FAIL"
+45
View File
@@ -0,0 +1,45 @@
#!/bin/bash
# Stage 1 base config + hardening, end to end, for a single fresh PVE host.
# Runs the individual scripts in order. Idempotent - safe to re-run.
#
# Does NOT create the named admin user (needs a username decision) - run
# create-admin-user.sh separately afterwards. Run audit.sh at the end to
# verify.
#
# Usage: MGMT_CIDR=192.168.2.0/24 ./bootstrap.sh
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root
if [ -z "${MGMT_CIDR:-}" ]; then
echo "MGMT_CIDR is not set. Example: MGMT_CIDR=192.168.2.0/24 $0" >&2
exit 1
fi
echo "=== 1/5: remove enterprise repos, switch to no-subscription ==="
"${SCRIPT_DIR}/switch-to-no-subscription-repo.sh"
echo
echo "=== 2/5: SSH hardening (key-only root login + fail2ban) ==="
"${SCRIPT_DIR}/harden-ssh.sh"
echo
echo "=== 3/5: unattended security upgrades ==="
"${SCRIPT_DIR}/setup-unattended-upgrades.sh"
echo
echo "=== 4/5: PVE firewall (mgmt-only SSH/8006) ==="
MGMT_CIDR="$MGMT_CIDR" "${SCRIPT_DIR}/deploy-firewall.sh"
echo
echo "=== 5/5: disable subscription nag (cosmetic) ==="
"${SCRIPT_DIR}/disable-subscription-nag.sh"
echo
echo "=== Base hardening applied. Remaining manual/deliberate steps: ==="
echo " - ${SCRIPT_DIR}/create-admin-user.sh <username>"
echo " - Enable 2FA/TOTP for that user and root@pam via the web UI"
echo " - ${SCRIPT_DIR}/audit.sh (verify everything above)"
+43
View File
@@ -0,0 +1,43 @@
#!/bin/bash
# Create a named PVE admin user (Administrator role) so root@pam can be
# reserved for emergencies. Generates a random initial password, printed
# once - change it and enable TOTP on first login (Datacenter -> Permissions
# -> Two Factor, or the user icon menu in the top right).
#
# Idempotent - if the user already exists, does nothing (won't reset an
# existing password). Run as root on the PVE host.
#
# Usage: ./create-admin-user.sh <username> (realm is always @pve)
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root
USERNAME="${1:-}"
if [ -z "$USERNAME" ]; then
echo "Usage: $0 <username>" >&2
exit 1
fi
USERID="${USERNAME}@pve"
if pveum user list --output-format json 2>/dev/null | grep -q "\"${USERID}\""; then
echo "${USERID} already exists - not touching password or role. Skipping."
exit 0
fi
PASSWORD="$(openssl rand -base64 24)"
pveum user add "$USERID" --password "$PASSWORD" --comment "Named admin account, created by create-admin-user.sh"
pveum acl modify / --users "$USERID" --roles Administrator
echo
echo "Created ${USERID} with the Administrator role."
echo "Initial password (shown once - not logged anywhere): ${PASSWORD}"
echo
echo "Next steps (do these before relying on this account):"
echo " 1. Log in as ${USERID} and change the password."
echo " 2. Enable TOTP/2FA for ${USERID} (and for root@pam)."
echo " 3. Reserve root@pam for emergencies only from here on."
+48
View File
@@ -0,0 +1,48 @@
#!/bin/bash
# Deploy the Proxmox datacenter-level firewall from
# config/pve-firewall/cluster.fw.example, with the management CIDR filled
# in, and enable it. Default-deny inbound; allow SSH/8006 from mgmt only.
#
# Idempotent - safe to re-run. Run as root on the PVE host.
#
# Usage: MGMT_CIDR=192.168.2.0/24 ./deploy-firewall.sh
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root
if [ -z "${MGMT_CIDR:-}" ]; then
echo "MGMT_CIDR is not set. Example: MGMT_CIDR=192.168.2.0/24 $0" >&2
exit 1
fi
if ! [[ "$MGMT_CIDR" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$ ]]; then
echo "MGMT_CIDR '${MGMT_CIDR}' doesn't look like a CIDR (e.g. 192.168.2.0/24)." >&2
exit 1
fi
TEMPLATE="${SCRIPT_DIR}/../config/pve-firewall/cluster.fw.example"
if [ ! -f "$TEMPLATE" ]; then
echo "Template not found: $TEMPLATE" >&2
exit 1
fi
# Corosync/Ceph rules stay commented placeholders until Stage 2 (cluster);
# only the mgmt IPSET is real for a single Stage 1 node.
mkdir -p /etc/pve/firewall
write_if_changed "/etc/pve/firewall/cluster.fw" "$(sed "s|<MGMT_CIDR>|${MGMT_CIDR}|" "$TEMPLATE")"
echo "Validating ruleset..."
pve-firewall compile
echo "Restarting pve-firewall..."
pve-firewall restart
sleep 1
pve-firewall status
echo
echo "Firewall enabled. SSH (22) and the web UI (8006) are now only reachable"
echo "from ${MGMT_CIDR}. If your current SSH session is NOT from that range,"
echo "reconnect and verify access before closing this session."
+24
View File
@@ -0,0 +1,24 @@
#!/bin/bash
# Install the subscription-nag patch (lib/nag-patch.sh) as a persistent
# standalone script under /usr/local/sbin, plus an apt Post-Invoke hook that
# re-applies it after every dpkg run - a proxmox-widget-toolkit package
# upgrade overwrites the patched file, so without the hook the patch would
# silently revert on the next `apt upgrade`.
#
# Idempotent - safe to re-run. Run as root on the PVE host.
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root
INSTALLED="/usr/local/sbin/pve-disable-subscription-nag.sh"
write_if_changed "$INSTALLED" "$(cat "${SCRIPT_DIR}/lib/nag-patch.sh")"
chmod +x "$INSTALLED"
HOOK="/etc/apt/apt.conf.d/85pve-nosubnag"
write_if_changed "$HOOK" 'DPkg::Post-Invoke { "test -x /usr/local/sbin/pve-disable-subscription-nag.sh && /usr/local/sbin/pve-disable-subscription-nag.sh || true"; };'
"$INSTALLED"
echo "Subscription nag patch installed; will reapply automatically after updates."
+10 -18
View File
@@ -3,20 +3,10 @@
# + fail2ban. Idempotent - safe to re-run. Run as root on the PVE host.
set -euo pipefail
DROPIN_DIR="/etc/ssh/sshd_config.d"
DROPIN_FILE="${DROPIN_DIR}/99-hardening.conf"
if [ "$(id -u)" -ne 0 ]; then
echo "Must run as root." >&2
exit 1
fi
mkdir -p "$DROPIN_DIR"
cat > "$DROPIN_FILE" <<'EOF'
PermitRootLogin prohibit-password
PasswordAuthentication no
EOF
echo "Wrote $DROPIN_FILE"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root
if ! authorized_keys_present=$(find /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys -type f 2>/dev/null | head -n1); then
authorized_keys_present=""
@@ -26,6 +16,10 @@ if [ -z "$authorized_keys_present" ]; then
echo "Add your SSH public key before disconnecting, or you'll lock yourself out." >&2
fi
mkdir -p /etc/ssh/sshd_config.d
write_if_changed "/etc/ssh/sshd_config.d/99-hardening.conf" "PermitRootLogin prohibit-password
PasswordAuthentication no"
sshd -t
systemctl reload sshd
echo "sshd reloaded with key-only root login."
@@ -36,15 +30,13 @@ if ! dpkg -s fail2ban >/dev/null 2>&1; then
fi
mkdir -p /etc/fail2ban/jail.d
cat > /etc/fail2ban/jail.d/sshd.local <<'EOF'
[sshd]
write_if_changed "/etc/fail2ban/jail.d/sshd.local" "[sshd]
enabled = true
port = ssh
backend = systemd
maxretry = 5
bantime = 1h
findtime = 10m
EOF
findtime = 10m"
systemctl enable --now fail2ban
systemctl restart fail2ban
+47
View File
@@ -0,0 +1,47 @@
#!/bin/bash
# Shared helpers for proxmox-configuration scripts. Sourced, not executed
# directly:
# SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# source "${SCRIPT_DIR}/lib/common.sh"
require_root() {
if [ "$(id -u)" -ne 0 ]; then
echo "Must run as root." >&2
exit 1
fi
}
# Codename of the running Debian/PVE release, e.g. "trixie".
pve_codename() {
(. /etc/os-release && echo "$VERSION_CODENAME")
}
# backup_file <path>
# Copies an existing file to <path>.bak.<epoch>. No-op if it doesn't exist.
backup_file() {
local path="$1"
if [ -f "$path" ]; then
cp "$path" "${path}.bak.$(date +%s)"
echo "Backed up ${path}"
fi
}
# write_if_changed <path> <content>
# Writes content to path only if it differs from what's already there,
# backing up the previous version first. Prints what happened.
write_if_changed() {
local path="$1" content="$2"
if [ -f "$path" ] && [ "$(cat "$path")" = "$content" ]; then
echo "Already up to date: $path"
return 0
fi
backup_file "$path"
printf '%s\n' "$content" > "$path"
echo "Wrote $path"
}
# --- audit.sh status helpers ---
# Callers should initialize: AUDIT_FAIL=0
audit_pass() { echo "PASS $1"; }
audit_fail() { echo "FAIL $1"; AUDIT_FAIL=1; }
audit_warn() { echo "WARN $1"; }
+22
View File
@@ -0,0 +1,22 @@
#!/bin/bash
# Neutralizes the Proxmox "No valid subscription" nag (login popup and the
# dashboard subscription indicator) by patching proxmox-widget-toolkit's
# proxmoxlib.js. Cosmetic only - doesn't create or spoof a subscription
# anywhere except this UI check.
#
# This file is not run from the repo directly - disable-subscription-nag.sh
# installs a copy of it to /usr/local/sbin and wires it into an apt
# Post-Invoke hook, because a proxmox-widget-toolkit package upgrade
# overwrites proxmoxlib.js and reverts the patch. Idempotent: exits quietly
# if already patched or if the file isn't present.
set -euo pipefail
JS_FILE="/usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js"
[ -f "$JS_FILE" ] || exit 0
PATTERN="data.status.toLowerCase() !== 'active'"
grep -qF "$PATTERN" "$JS_FILE" || exit 0
cp "$JS_FILE" "${JS_FILE}.bak.$(date +%s)"
sed -i "s/${PATTERN}/false/g" "$JS_FILE"
echo "Patched subscription nag in $JS_FILE"
+46
View File
@@ -0,0 +1,46 @@
#!/bin/bash
# Install and configure unattended-upgrades for security patches. Deliberately
# conservative for a hypervisor: security-only origins (Debian security +
# the active PVE repo), no automatic reboot ever - a flag file is left at
# /var/run/reboot-required for you to act on manually.
#
# Idempotent - safe to re-run. Run as root on the PVE host.
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root
if ! dpkg -s unattended-upgrades >/dev/null 2>&1; then
apt-get update
apt-get install -y unattended-upgrades
fi
CODENAME="$(pve_codename)"
write_if_changed "/etc/apt/apt.conf.d/51pve-unattended-upgrades.conf" "// Managed by proxmox-configuration/scripts/setup-unattended-upgrades.sh
Unattended-Upgrade::Origins-Pattern {
\"origin=Debian,codename=${CODENAME},label=Debian-Security\";
\"origin=Debian,codename=${CODENAME}-security,label=Debian-Security\";
\"origin=Proxmox\";
};
// Never auto-reboot a hypervisor. Check /var/run/reboot-required manually
// (or via scripts/audit.sh) and reboot during a planned maintenance window.
Unattended-Upgrade::Automatic-Reboot \"false\";
// Don't remove packages automatically; review before doing so by hand.
Unattended-Upgrade::Remove-Unused-Dependencies \"false\";
Unattended-Upgrade::Remove-Unused-Kernel-Packages \"false\";"
write_if_changed "/etc/apt/apt.conf.d/20auto-upgrades" '// Managed by proxmox-configuration/scripts/setup-unattended-upgrades.sh
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";'
systemctl enable --now unattended-upgrades.service >/dev/null
echo "unattended-upgrades enabled (security-only origins, no auto-reboot)."
echo "Dry run:"
unattended-upgrade --dry-run --debug 2>&1 | tail -20
+34 -25
View File
@@ -1,33 +1,42 @@
#!/bin/bash
# Switch a fresh Proxmox VE install from the enterprise repo (which fails
# on apt update without a paid subscription) to the no-subscription repo.
# Remove the Proxmox/Ceph enterprise apt sources (which fail on apt update
# without a paid subscription) and switch to the no-subscription repo.
# Handles both the legacy one-line .list format and the deb822 .sources
# format current PVE installers write.
# Idempotent - safe to re-run. Run as root on the PVE host.
set -euo pipefail
if [ "$(id -u)" -ne 0 ]; then
echo "Must run as root." >&2
exit 1
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root
SOURCES_DIR="/etc/apt/sources.list.d"
# Any sources file pointing at the enterprise host gets moved out of apt's
# way entirely (renamed .disabled) rather than commented out in place -
# apt only reads *.sources/*.list, so this fully removes it from
# consideration while keeping a copy on disk for reference.
for f in "${SOURCES_DIR}"/*.sources "${SOURCES_DIR}"/*.list; do
[ -f "$f" ] || continue
grep -qi 'enterprise.proxmox.com' "$f" 2>/dev/null || continue
mv "$f" "${f}.disabled"
echo "Removed enterprise source (renamed to .disabled): $f"
done
write_if_changed "${SOURCES_DIR}/pve-no-subscription.sources" "Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: $(pve_codename)
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg"
# Clean up a legacy-format no-subscription file from a previous run of an
# older version of this script, to avoid two sources for the same repo.
LEGACY_NOSUB="${SOURCES_DIR}/pve-no-subscription.list"
if [ -f "$LEGACY_NOSUB" ]; then
rm -f "$LEGACY_NOSUB"
echo "Removed superseded $LEGACY_NOSUB"
fi
CODENAME="$(. /etc/os-release && echo "$VERSION_CODENAME")"
ENTERPRISE_LIST="/etc/apt/sources.list.d/pve-enterprise.list"
if [ -f "$ENTERPRISE_LIST" ]; then
sed -i 's/^deb/#deb/' "$ENTERPRISE_LIST"
echo "Disabled $ENTERPRISE_LIST"
fi
CEPH_ENTERPRISE_LIST="/etc/apt/sources.list.d/ceph.list"
if [ -f "$CEPH_ENTERPRISE_LIST" ] && grep -q enterprise "$CEPH_ENTERPRISE_LIST" 2>/dev/null; then
sed -i 's/^deb/#deb/' "$CEPH_ENTERPRISE_LIST"
echo "Disabled $CEPH_ENTERPRISE_LIST"
fi
NOSUB_LIST="/etc/apt/sources.list.d/pve-no-subscription.list"
cat > "$NOSUB_LIST" <<EOF
deb http://download.proxmox.com/debian/pve ${CODENAME} pve-no-subscription
EOF
echo "Wrote $NOSUB_LIST for codename '${CODENAME}'."
apt-get update
echo "Repo switched. Review 'apt list --upgradable' before upgrading."