Password protecting the node's ssh-key in the cluster

[staticrsa]

Hello all

I have found some older posts about people asking about password protecting the ssh-keys that the nodes use to communicate with eachother.

Many say that it will break certain functionality.

I was wondering if this is still the case? Or have those features that would have broke, now use the proxmox API instead?

My largest concern is that, if one node gets compromised, it is extremely easy for the threat actor to pivot across your entire proxmox cluster in 2 seconds.

My current thoughts on mitigating this is to add a pass-phrase to the ssh-keys granted nothing breaks. Unless there is another way to mitigate this?

Cheers!

 

[fabian]

yes, things would still break, migration for example requires a passwordless SSH key. adding a password also wouldn't really help in your threat scenario - if I am root on one node, I am root on every node, with or without direct SSH access. every node trusts the other nodes, there is no way around it. if you want to isolate your nodes in such a fashion, don't cluster them and use backup/restore or the experimental (CLI/API only for now) remote migration feature to transfer guests as needed.