Archived
beatzaplenty
a854412117
Covers node 1 hardware/network layout, LVM-thin -> ZFS migration path, Ceph as the future HA storage upgrade, and baseline SSH/firewall hardening.
55 lines
2.1 KiB
Markdown
55 lines
2.1 KiB
Markdown
# Security Hardening
|
|
|
|
Proxmox has no `sudo` out of the box — everything defaults to root. That's
|
|
the install default, not the recommended end state. Two layers to harden
|
|
separately.
|
|
|
|
## Linux/SSH layer
|
|
|
|
- `PermitRootLogin prohibit-password` in `sshd_config` — root can only
|
|
log in via SSH key, never password. Kills most brute-force attempts.
|
|
See `scripts/harden-ssh.sh`.
|
|
- fail2ban jail for SSH on top of that.
|
|
- Restrict SSH to the management VLAN/trusted IPs via the Proxmox
|
|
firewall (see `03-networking.md`) rather than exposing broadly.
|
|
- A separate Linux sudo user isn't strictly required for day-to-day PVE
|
|
admin (the PVE permission system below governs that), but worth adding
|
|
if multiple people SSH into the box directly, for accountability.
|
|
|
|
## PVE/web layer (the one that actually matters day-to-day)
|
|
|
|
- Keep `root@pam` for emergencies only.
|
|
- Create a named user (e.g. `wayne@pve`) with the Administrator role for
|
|
routine cluster management: Datacenter → Permissions → Users.
|
|
- Enable 2FA (TOTP or hardware key) on both that account and `root@pam`:
|
|
Datacenter → Permissions → Realms/Users.
|
|
- For API integrations (monitoring, automation, Terraform, etc.), issue
|
|
scoped API tokens with least-privilege roles (e.g. `PVEAuditor` or a
|
|
custom role) — never hand out root credentials.
|
|
|
|
## Firewall
|
|
|
|
Default-deny at datacenter/node level, whitelist only what's needed (see
|
|
`03-networking.md` for the specifics). Config templates in
|
|
`config/pve-firewall/`.
|
|
|
|
## Repos and updates
|
|
|
|
Fresh installs point at the enterprise repo, which fails on `apt update`
|
|
without a subscription. Switch to the no-subscription repo (or pay for
|
|
enterprise). See `scripts/switch-to-no-subscription-repo.sh`. Keep the
|
|
host patched — hypervisor CVEs are high-value targets.
|
|
|
|
## Misc
|
|
|
|
- Management interface on a network you trust, not the same broadcast
|
|
domain as guest VM traffic.
|
|
- If the web UI is ever needed outside the LAN, put it behind a VPN —
|
|
don't port-forward 8006 directly.
|
|
|
|
## Further reading
|
|
|
|
- CIS Benchmark for Proxmox VE
|
|
- Community PVE hardening guides (kernel parameters, audit logging,
|
|
storage encryption)
|