download.proxmox.com presents wrong certificate

V

VA1DER

New Member
Dec 24, 2024
17
2
3
When trying to set up https (to prevent certain types of supply chain hacks and attacks) for the Proxmox apt repository, it is impossible because download.proxmox.com presents a certificate for enterprise.proxmox.com. I see that you use letsencrypt for certificates, and it should be relatively easy to get the certificate issued for extra SANs. This would allow increased security for package distribution, in addition to the packages being signed by your key.

Thanks.
 
Maybe you can find those threads using the search functionality of this forum?
Click to expand...
When I see situations like this, I tend to believe the best. Meaning I tend to believe it a genuine oversight, rather than an intentional refusal to follow security best practices. So I don't tend to look for old discussions, I just report the issue.
 
  • Like
Reactions: dmackdaddy
VA1DER said:
When I see situations like this, I tend to believe the best. Meaning I tend to believe it a genuine oversight, rather than an intentional refusal to follow security best practices. So I don't tend to look for old discussions, I just report the issue.
Click to expand...
Proxmox staff has explained before why they won't use HTTPS for anything but the enterprise repository. I don't remember the details and maybe I'm mistaken about this. Please use the search or wait for another volunteer.

EDIT: Even with HTTPS people can know which packages you download due to their size and even with HTTP the downloads are checked for tampering with checksums.
 
Last edited:
  • Like
Reactions: Johannes S
One older thread on this:
sterzy

Post in thread 'Bad certificate for https://download.proxmox.com/'

Hi,

please also be aware that our apt repos come signed with our GPG keys anyway, so realistically adding HTTPS on top of that does not provide much of a security benefit.

The reason we use it for the enterprise repos is that you need to authenticate yourself there to prove you have a valid subscription. HTTPS is used there to protect those credentials.

The basic argument of Proxmox developers is, that all their packages are signed with gpg anyhow thus https doesn't add additional security.

I'm not much of a security researcher so have no opinion on this. I still trust Proxmox developers enough, that it doesn't affect my usage of the repositories ;)

And Proxmox isn't the only company/project who do this, best practices or not. Ubuntu for example do this the same, as seen in their documentation for their coming upstream release: https://manpages.ubuntu.com/manpages/resolute/man5/sources.list.5.html

My guess is that https (due to being encrypted) brings some additional load on the deployment infrastructure so the non-enterprise repositories (aka the ones who don't generate income) of Proxmox have http while paying customers can have https if they think this improves security.

Now ubuntu shouldn't have budget constraints but I can imagine that even at their scale https versus http can make a big difference. So while it's possible to use https for ubuntu the default is still http to save on computing resources.

VA1DER said:
So I don't tend to look for old discussions, I just report the issue.
Click to expand...

For bug reports bugzilla.proxmox.com should be used, for security reports the procedure is outlined at https://pve.proxmox.com/wiki/Security_Reporting Basically they have a dedicated mail adress so a responsible disclosure process can be followed in case of a critical vulnerability in the code.

Regarding best practices: It's not always easy to find the right keywords, but imho it's still best practice to look up whether somebody reported something before.
 
Last edited:
  • Like
Reactions: dmackdaddy, leesteken, UdoB and 1 other person
Luki20 said:
Maybe something for the security advisory threads?
Click to expand...
What do you want to achive with such an announcement? As explained it's a non-issue if you agree with the developers reasoning. Posting everything remotely security related in the advisory theads would result in a lot of noise, so that in the end the security advisory threads would become practically useless. They don't even post any Linux Kernel CVEs (since this would mean announcing 100s if not 1000s of fixed CVEs per Kernel release) which (even with all issues of the CVE metric system) are at least clearly security-related. While the problem with the wrong certificate for download.proxmox.com is at worst a red herring but not actually security-related if you agree with the Proxmox developers reasoning. If you don't (which is fair after all, personally I lack the needed knowledge to have a clear opinion) or are unsure then you also need to consider whether you even trust to use a software from developers with a (from your point of view) securitywise problematic method of distributing their software.

I'm aware that having everything in advisorys helps in dealing with compilance-managment etc and can understand that this can be quite a pain depending on the reguluations you are subjected too. Sadly (as a fellow community member with no insights or say on Proxmox Server Solutions GmBH and the developers internal discussions)) I have no idea, what could be a solution without sacrifing ressources which could also be spent on feature development or fixing actual bugs. I'm also aware that this dilemma can be quite a showstopper for adoption of the Proxmox ecosystem in certain environments.
It's a pity, really, because it's kind of a loop: Lack of adoption in such environments leads to lack of funding for features/documentation/support needed for said environments. But maybe somebody from the team can share some insights if they have nothing more important to do?
 
You must log in or register to reply here.
Top Bottom
Back