Initial planning docs and hardening scripts for HA rebuild

Covers node 1 hardware/network layout, LVM-thin -> ZFS migration path, Ceph as the future HA storage upgrade, and baseline SSH/firewall hardening.
2026-07-20 11:45:54 +10:00
commit a854412117
10 changed files with 414 additions and 0 deletions
@@ -0,0 +1,54 @@
+# Security Hardening
+
+Proxmox has no `sudo` out of the box — everything defaults to root. That's
+the install default, not the recommended end state. Two layers to harden
+separately.
+
+## Linux/SSH layer
+
+- `PermitRootLogin prohibit-password` in `sshd_config` — root can only
+  log in via SSH key, never password. Kills most brute-force attempts.
+  See `scripts/harden-ssh.sh`.
+- fail2ban jail for SSH on top of that.
+- Restrict SSH to the management VLAN/trusted IPs via the Proxmox
+  firewall (see `03-networking.md`) rather than exposing broadly.
+- A separate Linux sudo user isn't strictly required for day-to-day PVE
+  admin (the PVE permission system below governs that), but worth adding
+  if multiple people SSH into the box directly, for accountability.
+
+## PVE/web layer (the one that actually matters day-to-day)
+
+- Keep `root@pam` for emergencies only.
+- Create a named user (e.g. `wayne@pve`) with the Administrator role for
+  routine cluster management: Datacenter → Permissions → Users.
+- Enable 2FA (TOTP or hardware key) on both that account and `root@pam`:
+  Datacenter → Permissions → Realms/Users.
+- For API integrations (monitoring, automation, Terraform, etc.), issue
+  scoped API tokens with least-privilege roles (e.g. `PVEAuditor` or a
+  custom role) — never hand out root credentials.
+
+## Firewall
+
+Default-deny at datacenter/node level, whitelist only what's needed (see
+`03-networking.md` for the specifics). Config templates in
+`config/pve-firewall/`.
+
+## Repos and updates
+
+Fresh installs point at the enterprise repo, which fails on `apt update`
+without a subscription. Switch to the no-subscription repo (or pay for
+enterprise). See `scripts/switch-to-no-subscription-repo.sh`. Keep the
+host patched — hypervisor CVEs are high-value targets.
+
+## Misc
+
+- Management interface on a network you trust, not the same broadcast
+  domain as guest VM traffic.
+- If the web UI is ever needed outside the LAN, put it behind a VPN —
+  don't port-forward 8006 directly.
+
+## Further reading
+
+- CIS Benchmark for Proxmox VE
+- Community PVE hardening guides (kernel parameters, audit logging,
+  storage encryption)