Make Pveproxy only listen on localhost

[Stan Lee]

I really don't like logging into the web ui using root or admin credentials over the network, so what I would like to do is have the web ui only listen on localhost, and use ssh port forwarding to connect to it.

So I've searched google and the forums and turned up nothing except some old posts which mentioned editing /etc/default/pveproxy (this does not exist on my installation, which is Proxmox Virtual Environment 4.2-18).

What is the preferred way of doing this with proxmox 4.2?

-Thanks

 

[cadbury]

The webui forces SSL so unless you're not using a valid certificate or you know of some MITM cert, it's just as secure as SSH.

 

[dietmar]

see

# man pveproxy

 

[Circlenaut]

I've created an nginx reverse proxy for the webui and created the file /etc/default/pveproxy and configured it as follows:
ALLOW_FROM="127.0.0.1"
DENY_FROM="all"
POLICY="allow"

The proxy works and the web-ui listen only on local host but now my spice console and vnc connections doesn't work. If I delete the pveproxy file and issue the command pvecm updatecerts --force and reboot spice (but not vnc) starts to work through the reverse proxy.

Is the pveproxy file also limiting spice to localhost only?