Proxmox Backup Server configuration , change listen address and port

S

samsambings

New Member
Jan 13, 2023
1
1
3
Hello,
I spent some time trying to make my proxmox Backup Server listen only on localhost but couldn't find it.
It seem that it doesnt have pveproxy service but proxmox-backup-proxy and the /etc/default/pveproxy is not read by the service.

Is there any way to make the service listen only in localhost ?
the documentation doesnt mention anything like this.

I read the following thread that looks like mine but not really and no info either :
https://forum.proxmox.com/threads/proxmox-not-listening-on-default-port.87484/post-407392
https://forum.proxmox.com/threads/p...not-running-on-8007-but-82.76407/#post-339957

It might not be possible because of the datastore requirements ?

Thank you
 
  • Like
Reactions: cwista
Also wondering the same, anyone figured out how to configure this? Alternative option would be to block it with a firewall, but would be nice to set the listening address and port.
 
Based on my review of the current code, I understand that proxmox-backup-proxy is designed to expose its service over HTTPS/TCP port 8007, while the internal privileged API listens on 127.0.0.1:82, and that there is no available configuration to change this behavior.

Personally, since Proxmox VE also uses the API on port 8007, any change would require modifications on both the PVE and PBS sides, so I suspect it is unlikely that this will be changed.

As described in the manual, does it mean that the only practical approach is to mitigate security risks by using solutions like WireGuard or by leveraging API tokens?
https://pbs.proxmox.com/docs/backup-client.html#environment-variables
 
  • Like
Reactions: Johannes S
One possible alternative to VPN is to use s reverse proxy as described by @meyergru
M

[TUTORIAL] Thread 'Using a reverse proxy to limit PBS exposition to API endpoints only'

It always bugged me that when there is no possibility of having a VPN to a remote PBS server, you will have to expose the web UI as a whole.

I even did a feature request to create an "API-only" frontend to PBS to limit the attack surface, see: https://bugzilla.proxmox.com/show_bug.cgi?id=7010

I have this running for a while now. I found that neither Caddy nor Nginx were really suitable, because they lack one critical feature that HAproxy has, namely: "option http-server-close".

If you do not have that option, the setup works partially, but on the server side, you will get log...
  • Like

Personally I would still use a vpn like wireguard whenever possible. And API tokes should be used in any case since they make it easier to seperate concerns and priviliges depending on the needed access
 
Last edited:
  • Like
Reactions: d.oishi and UdoB
You must log in or register to reply here.
Top Bottom
Back