Archived

This repository has been archived on 2026-08-17. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplenty a854412117 Initial planning docs and hardening scripts for HA rebuild

Covers node 1 hardware/network layout, LVM-thin -> ZFS migration path,
Ceph as the future HA storage upgrade, and baseline SSH/firewall
hardening.

2026-07-20 11:45:54 +10:00

2.1 KiB

Raw Blame History

Security Hardening

Proxmox has no sudo out of the box — everything defaults to root. That's the install default, not the recommended end state. Two layers to harden separately.

Linux/SSH layer

PermitRootLogin prohibit-password in sshd_config — root can only log in via SSH key, never password. Kills most brute-force attempts. See scripts/harden-ssh.sh.
fail2ban jail for SSH on top of that.
Restrict SSH to the management VLAN/trusted IPs via the Proxmox firewall (see 03-networking.md) rather than exposing broadly.
A separate Linux sudo user isn't strictly required for day-to-day PVE admin (the PVE permission system below governs that), but worth adding if multiple people SSH into the box directly, for accountability.

PVE/web layer (the one that actually matters day-to-day)

Keep root@pam for emergencies only.
Create a named user (e.g. wayne@pve) with the Administrator role for routine cluster management: Datacenter → Permissions → Users.
Enable 2FA (TOTP or hardware key) on both that account and root@pam: Datacenter → Permissions → Realms/Users.
For API integrations (monitoring, automation, Terraform, etc.), issue scoped API tokens with least-privilege roles (e.g. PVEAuditor or a custom role) — never hand out root credentials.

Firewall

Default-deny at datacenter/node level, whitelist only what's needed (see 03-networking.md for the specifics). Config templates in config/pve-firewall/.

Repos and updates

Fresh installs point at the enterprise repo, which fails on apt update without a subscription. Switch to the no-subscription repo (or pay for enterprise). See scripts/switch-to-no-subscription-repo.sh. Keep the host patched — hypervisor CVEs are high-value targets.

Misc

Management interface on a network you trust, not the same broadcast domain as guest VM traffic.
If the web UI is ever needed outside the LAN, put it behind a VPN — don't port-forward 8006 directly.

2.1 KiB Raw Blame History