# Security Hardening

Proxmox has no `sudo` out of the box — everything defaults to root. That's
the install default, not the recommended end state. Two layers to harden
separately.

## Linux/SSH layer

- `PermitRootLogin prohibit-password` in `sshd_config` — root can only
  log in via SSH key, never password. Kills most brute-force attempts.
  See `scripts/harden-ssh.sh`.
- fail2ban jail for SSH on top of that.
- Restrict SSH to the management VLAN/trusted IPs via the Proxmox
  firewall (see `03-networking.md`) rather than exposing broadly.
- A separate Linux sudo user isn't strictly required for day-to-day PVE
  admin (the PVE permission system below governs that), but worth adding
  if multiple people SSH into the box directly, for accountability.

## PVE/web layer (the one that actually matters day-to-day)

- Keep `root@pam` for emergencies only.
- Create a named user (e.g. `wayne@pve`) with the Administrator role for
  routine cluster management: Datacenter → Permissions → Users.
- Enable 2FA (TOTP or hardware key) on both that account and `root@pam`:
  Datacenter → Permissions → Realms/Users.
- For API integrations (monitoring, automation, Terraform, etc.), issue
  scoped API tokens with least-privilege roles (e.g. `PVEAuditor` or a
  custom role) — never hand out root credentials.

## Firewall

Default-deny at datacenter/node level, whitelist only what's needed (see
`03-networking.md` for the specifics). Config templates in
`config/pve-firewall/`.

## Repos and updates

Fresh installs point at the enterprise repo, which fails on `apt update`
without a subscription. Switch to the no-subscription repo (or pay for
enterprise). See `scripts/switch-to-no-subscription-repo.sh`. Keep the
host patched — hypervisor CVEs are high-value targets.

## Misc

- Management interface on a network you trust, not the same broadcast
  domain as guest VM traffic.
- If the web UI is ever needed outside the LAN, put it behind a VPN —
  don't port-forward 8006 directly.

## Further reading

- CIS Benchmark for Proxmox VE
- Community PVE hardening guides (kernel parameters, audit logging,
  storage encryption)