Proxmox hardening - Proxmox iso vs Debian iso?

C

CS-

New Member
Apr 3, 2025
12
4
3
Hello,

I'm looking into hardening Proxmox VE. Unfortunately, there are no official baselines yet for Proxmox, so I'm using the information I can find online and in the Proxmox communities.
I came across the following hardening guide: https://github.com/HomeSecExplorer/Proxmox-Hardening-Guide/blob/main/docs/pve8-hardening-guide.md

One of the statements there is: "To satisfy several CIS Debian Benchmark controls (for example, partition layout), install Debian 12 first and then add the Proxmox VE repository instead of using the Proxmox ISO installer."

According to the following installation document: https://pve.proxmox.com/wiki/Install_Proxmox_VE_on_Debian_13_Trixie
You have to install a Standard Debian first, then install Proxmox VE, and part of that installation is removing the Debian Kernel again. That doesn't make sense. Aren't these steps included when using the Proxmox ISO?

Does this mean that we can't use the Proxmox ISO to install the environment? What's the point in having ISOs provided by Proxmox, if you have to install Debian separately first and after that install Proxmox VE? What is the recommended way?

Thanks for the information.

Kind regards,
C
 
  • Like
Reactions: ririmia
Hi,

CS- said:
You have to install a Standard Debian first, then install Proxmox VE, and part of that installation is removing the Debian Kernel again. That doesn't make sense.
Click to expand...
We ship our own kernel, thus you need to remove the stock Debian kernel if you start with a vanilla Debian installation.

If you are installing from the ISO, the system will already be fully set up as needed, including the kernel.

CS- said:
Aren't these steps included when using the Proxmox ISO?
Click to expand...
What do you mean exactly here? Proxmox VE (and for that matter, all other products of ours) are based on Debian, meaning you get a full-blown Debian install with extra components shipped by us.
 
  • Like
Reactions: ririmia and Johannes S
CS- said:
I'm looking into hardening Proxmox VE. Unfortunately, there are no official baselines yet for Proxmox, so I'm using the information I can find online and in the Proxmox communities.
Click to expand...
It was discussed in the past, did you already search the forums for it?
https://forum.proxmox.com/search/8806046/?q=hardening&o=date
Following threads I would consider quite helpful:
D

Thread 'Security: recommendations for going prod with pve'

Hello dear community,

We are a small startup with two people and are currently setting up our infrastructure.

We will be active in the media industry and have a strong focus on open source, as well as the intention to support relevant projects later on as soon as cash flow comes in.

We have a few questions about the deployment of our Proxmox hypervisor, as we have experience with PVE, but not directly in production.

We would like to know if additional hardening of the PVE hypervisor is necessary. From the outset, we opted for an immutable infrastructure and place value on quality and...
  • Like
H

Post in thread 'Proxmox server hardening document for compliance'

Hi y’all,
I’ve released a Proxmox hardening guide (PVE 8 / PBS 3) that extends the CIS Debian 12 benchmark with Proxmox specific tasks.
Repo: https://github.com/HomeSecExplorer/Proxmox-Hardening-Guide

A few controls are not yet validated and are marked accordingly.
If you have a lab and can verify the unchecked items (see the README ToDos), I’d appreciate your results and feedback.

Planned work: PVE 9 and PBS 4 once the CIS Debian 13 benchmark is available.

Feedback is very welcome!
Thanks!
  • Like

There are more, especially whether it's a good idea to run antivirus or EDR on a ProxmoxVE/BackupServer/Mailgateway Node (short: answer, no you really don't want to do this):
N

Thread 'PVE with antivirus'

Hi,

Is there an official statement from Proxmox regarding the installation of antivirus software on PVE?
Does this installation affect the license and support provided?

Thanks!
U

Thread 'Running EDR on PVE Host'

Having a thought in regards to running SentinelONE on the PVE host itself. Would definatley want to exclude the storage locations that have the VM/Container disks running from real-time scanning, but any other gotchas from running a EDR or AV in general on the PVE host to detect and stop malicious code?
CS- said:
I came across the following hardening guide: https://github.com/HomeSecExplorer/Proxmox-Hardening-Guide/blob/main/docs/pve8-hardening-guide.md

One of the statements there is: "To satisfy several CIS Debian Benchmark controls (for example, partition layout), install Debian 12 first and then add the Proxmox VE repository instead of using the Proxmox ISO installer."

According to the following installation document: https://pve.proxmox.com/wiki/Install_Proxmox_VE_on_Debian_13_Trixie
You have to install a Standard Debian first, then install Proxmox VE, and part of that installation is removing the Debian Kernel again. That doesn't make sense. Aren't these steps included when using the Proxmox ISO?
Click to expand...

Yes but the Proxmox installer installs a certain partitioning scheme. It's NOT less secure than the default Debian install. For example both won't setup the disc for full-encryption. But the PVE installer has no option to encrypt the disc, while the Debian installer would allow this.
The question however is if that certain requirement is needed in your environment. For example in my homelab I don't care about encrypting the discs in my nodes (nothing important on it) and I also wouldn't care about encryption discs of a server in a datacenter ( it's not easy for burglars to break in).
If you happen to work for a military contractor or another sector who needs to fullfill strict data protection regulations the story might be different.

CS- said:
Does this mean that we can't use the Proxmox ISO to install the environment? What's the point in having ISOs provided by Proxmox, if you have to install Debian separately first and after that install Proxmox VE? What is the recommended way?
Click to expand...

If you don't know why you need to install Debian first you shouldn't do it. So the recommended way is actually to start with the Proxmox installer except you have a good reason not to do it.
What's the actual reason you want to apply the hardening guide? Security is not a "one-time-procedure" but a process and you need to think which threats you deal with and what to do about them (threat-modeling). The need to satisfy some security-/compilance-theater-audit can also be a threat (from a business or legal point of view and if not at least to your sanity) but if you are aware about it's (pointless from a security point of view) nature you are better prepared to do something which will actually improve security. See also this discussion on running antivirus-snakeoil on PVE:
U

Thread 'Running EDR on PVE Host'

Having a thought in regards to running SentinelONE on the PVE host itself. Would definatley want to exclude the storage locations that have the VM/Container disks running from real-time scanning, but any other gotchas from running a EDR or AV in general on the PVE host to detect and stop malicious code?

I referenced these alternative guides for Linux hardening:
https://github.com/trimstray/the-practical-linux-hardening-guide
https://github.com/dev-sec/ansible-collection-hardening

Please note that the first guide by trimstray was only tested with CentOS but like the author wrote most of it applies to all Linux systems.
Please also note following note from it:
Do not treat this hardening guide as revealed knowledge. You should take a scientific approach when reading this document. If you have any doubts and disagree with me, please point out my mistakes. You should to discover cause and effect relationships by asking questions, carefully gathering and examining the evidence, and seeing if all the available information can be combined in to a logical answer.
Click to expand...

This is also true for @HomeSecExplorer guide, especially given the fact that parts of his guide covers acts not covered by Proxmox regular support:

Some procedures in this guide are community best-effort methods and not officially supported by Proxmox GmbH. Evaluate, test, and maintain these at your own risk; do not expect vendor support for issues arising from their use.
Click to expand...
 
Last edited:
  • Like
Reactions: ririmia and proxuser77
CS- said:
Does this mean that we can't use the Proxmox ISO to install the environment?
Click to expand...
The answer to that is in your own post, and it is: Only if you need to satisfy the CIS Debian benchmarks that need e.g. a diffrenet partition layout, mentioned in the guide you linked to. So the question you should ask yourself is whether you actually need to satisfy these specific benchmarks.

Assuming that the Proxmox ISO is unusable in a production environment soley based on some online hardening guide you stumbled over is, in my opinion, a bit of a stretch. As Johannes already said, blindly ticking boxes whose implications you don’t fully understand can, in the worst case, be counterproductive.
 
Last edited:
  • Like
Reactions: ririmia and Johannes S
Thanks you all for your feedback, much appreciated. If someone else still needs to add something, feel free to do so. Thx.
 
What did you actually want to achieve? I'm feeling a little bit trolled that somebody asked a rather generic question, I bothered to answer and now don't even now which problem I helped to solve. This is also annoying for people who also stumble over this thread and might be interested whether their problem is similiar to yours. So: Which goal do you want to achieve by hardening? Ticking a box in an audit? Protection against a certain threat (if yes, which one)?
 
We are a service provider. We are planning to replace a part of our VMware environment with Proxmox. The VMware environment is a multi-tenant environment running many customers (=private cloud). All our environments have to be compliant for audit purposes. For VMware everything is clear, there are CIS benchmarks available, we have configured the VMware environments accordingly and we can use Tenable to perform compliance scans. For Proxmox there is no official benchmark available. We have to basically build a benchmark ourselves, probably based on the Debian hardening guide and other online information about Proxmox specifics. This should be something we expect from the vendor, Proxmox.
 
  • Like
Reactions: Johannes S
Then it's propably a good idea to file a feature request on https://bugzilla.proxmox.com since in the forum there is no guarantee that a developer will notice a thread. If you happen to have a subscription (which you propably do if it's such an essential part of your operations) this is also something worth a support ticket imho.
 
CS- said:
For Proxmox there is no official benchmark available. We have to basically build a benchmark ourselves, probably based on the Debian hardening guide and other online information about Proxmox specifics. This should be something we expect from the vendor, Proxmox.
Click to expand...
This is most likely because, as far as I know, Proxmox is not designed for multi-tenancy, and it’s also not really supported in that sense, at least not multi-tenancy as VPS providers like Hetzner, DigitalOcean, or Linode implement it with full self-service portals, strict tenant isolation, etc.

There’s probably a good reason why those providers develop their own software stacks around KVM/QEMU rather than simply deploying Proxmox and handing out user accounts. As far as I understand, Proxmox is primarily aimed at single-organisation environments such as homelabs, SMEs and enterprises, where all users are trusted to some degree and belong to the same administrative domain.

For your use case, however, something like Openstack would likely be much more suitable.

EDIT:
Just to avoid any misunderstandings: by “where all users are trusted to some degree” I’m not referring to end users of the OSs or applications hosted inside the VMs or containers, but to the users or admins of Proxmox itself.

If the goal is to provide MSP-style SaaS products and only you or your employees have access to the Proxmox management interface, then in my opinion it is perfectly possible to host VMs for different customers on the same Proxmox host or cluster. You can also make those VMs publicly accessible, but I wouldn’t necessarily do that with the Proxmox interface itself.
 
Last edited:
Only staff from our company have access to the PVE management layer. The end customers whose VMs are running on the platform don't have access to the PVE management layer. The Proxmox interface itself is indeed not publicly accessible.
 
You must log in or register to reply here.
Top Bottom