gurubert's latest activity
-
gurubert reacted to leesteken's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with
Like.
The usual use of the zero-day term is for vulnerabilities that are being exploited while there is no fix yet (for a supported/current version). That is something the administrator cannot do much about. This vulnerability is probably already fixed... -
gurubert reacted to Gilberto Ferreira's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
In any case, I don't think this is a 0day vulnerability, because on this is happen due to out date servers and bad servers administration, to say the least. Many of this vulnerabilities are well-know documented, such as kernel and ssh...
-
gurubert reacted to leesteken's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
The Linux kernel has had at least 500 CVE's fixed per release (before LLMs) and your PVE 7 kernel (5.15?) is many version behind, so either one could potentially be the entry point. Whether you had a good password is irrelevant. Proxmox fixed...
-
gurubert reacted to J-Rod's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
PVE 7 and the Debian version it sits on went end of life over two (corrected from three) years ago. The list of vulnerabilities discovered and patched since then is going to be a mile long. It would even be a bad idea to expose a fully patched...
-
gurubert reacted to leesteken's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
Thank you for reminding people to regularly upgrade their software (and not run unsupported versions). I do hope you can recover from backups on a fresh (and supported) Proxmox. There is a section in the PBS manual about ransomware...
-
In a PVE-cluster, there is no master node or something like that. Just move all guests to the other nodes and power that node off. Wait a few minutes and if nothing explodes, move on with your reinstallation... ;)
-
You can just upgrade without removing it…? Are you following the upgrade guide?
-
https://forum.proxmox.com/threads/proxmox-virtual-environment-9-2-available.183742/
-
I ran into the same warning after upgrading from PVE 8 to PVE 9 with Ceph Squid. It looks like /etc/init.d/ceph is simply an obsolete conffile left behind by ceph-base: # dpkg -S /etc/init.d/ceph ceph-base: /etc/init.d/ceph # dpkg-query -W...
-
gurubert replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Sorry for your loss, but why would anyone do that?
-
Sending notifications for exceeding storage limits is not possible with the current PBS feature set, using external monitoring is the best way to achieve this [0]. FWIW there is some development work in adding protections for datastores running...
-
gurubert reacted to proxuser77's post in the thread [SOLVED] Does this update require a reboot? with Like.
You could try needrestart: needrestart man page By default, it runs in interactive mode, i.e. if you update from the CLI (apt update && apt full-upgrade), it tells you whether a reboot is necessary, lists all services that need to be restarted...
-
There is another old thread about that topic as well as bugzilla entry. https://forum.proxmox.com/threads/feature-request-proxmox-ve-scheduled-tasks.152468/ https://bugzilla.proxmox.com/show_bug.cgi?id=7539
-
gurubert reacted to JohnnieKF's post in the thread [SOLVED] Feature Request: Scheduled tasks with Like.
You could only grant them access to manually execute shutdowns via the UI with VM.PowerMgmt perms on a pool or on individual guests. For the scheduling you'd need to go outside PVE. Either drive the API directly with a token scoped to that same...
-
gurubert reacted to bbgeek17's post in the thread May I ask if PVE supports the following operating systems with Like.
Virtual machine support is better classified first by CPU architecture rather than by the guest OS itself. At this point, the relevant architectures are x86 and ARM. The next question is whether the guest OS supports the virtual hardware...
-
gurubert reacted to JohnnieKF's post in the thread May I ask if PVE supports the following operating systems with Like.
PVE doesn't have a 'supported' list, I am assuming this is a list of VMs you're wanting to export from an existing system like vSphere? You can run essentially any x86-64 OS, so all of those are fine. The OS Type field in PVE isn't a...
-
I swapped the nics and it made a huge difference, I know mellanox is better, but damn. Ceph Network Swapping Test Summary Workload TypeMetricBefore (Old Public/Cluster Setup)After (ConnectX-5 for Cluster Network)Performance Impact...
-
gurubert reacted to t.lamprecht's post in the thread Ceph CVEs – keyring rotation strongly advised, probably required in the future with Like.
There is now a newer pve-manager with version 9.2.12 available on the pve-test repo and a backport of that as 8.4.22 for PVE 8's pvetest repo, matching our respective test repo of the ceph-squid and ceph-tentacle releases. There is some better...
-
gurubert reacted to t.lamprecht's post in the thread Ceph CVEs – keyring rotation strongly advised, probably required in the future with Like.
This can be done gradually, but needs a bit of care. We're currently in the process of finishing a migration helper tool and providing documentation for how to do this.
-
I am on the Ceph users email list, and it seems the fix is not a simple update, and will not be trivial. You have to use new authentication keys, aes256k, and rotate the keys used, and for that (for rbd storage at least), shutdown all VMs. And...