Is it safe to expose spiceproxy to the internet? Any tips on hardening?

xapt

New Member
Mar 2, 2023
2
0
1
Hello friends,

I moved away from ESXi to Proxmox couple of weeks ago and switched to proxmox to downsize my infrastructure at home a little bit. I love how well I can use Proxmox as my VDI and how polished it feels using it in combination with SPICE/virt-viewer.

Now my question is regarding security by exposing certain services of Proxmox to the internet. I use an Apache reverse proxy for the Proxmox webgui, which is secured by the Apache's basic user auth as well as by Proxmox's own 2FA. I don't have too much security concerns here.

What I'm a little bit concerned about is the spiceproxy that is running on port 3128. I sometime need to use my VDI from the outside, and using a VPN is not always an option since some networks have firewall restrictions to prevent VPN usage.
Right now, I forwarded the port 3128 where spiceproxy is running to my Proxmox, and the virt-viewer works quite well from the outside of my network. Any word on how secure it is running the spiceproxy exposed this way? According to the description, it runs with very limited privileges, but I'm still concerned.
Any other ideas on how I could go about hardening it in this particular case?

Regards
 
spice-proxy authentification use a temporary (10s) generated token, when you click on the console button.

It doesn't established tunnel to the vm until you are connected the with correct.

So, until they are a bug, It should be safe. (but think of recent vmware security bugs on exposed services ;)
 
  • Like
Reactions: xapt

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!