Proxmox VE - fine tuning

[imthiazaar]

Hi,

Is there any best practices to fine tune Proxmos VE, remove unwanted package, hardening and how to keep the setup light weight?

Please suggest..

Thanks in advance..

 

[oguz]

hi,

Proxmos VE

Proxmox VE

emove unwanted package,

the default installation comes with a relatively small set of packages anyway. other "big" packages such as ceph and so on are opt-in.
what kind of packages would you like to remove from the default installation?
you can get a list of the installed packages with dpkg -l > installed.txt (keep in mind a lot of them are dependencies for other packages)

hardening

depends highly on your actual setup.

some general recommendations:
* enabling firewalls on Datacenter/Node levels is always recommended, along with a reasonable ruleset (which again depends on what you want to do). [0]
* use a strong password for your root@pam account
* use two-factor auth [1] (also for root@pam since it's the most privileged user)
* if you're providing user accounts, make sure you give them the least possible privileges that you can (this holds especially true if you're providing accounts to untrusted users/customers)
* if you're providing VM/CT access to untrusted users, you'll also probably need to think about network segmentation (who can access which resources)

for general setup tips feel free to read our admin guide (linked below)

hope this helps

[0]: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#chapter_pve_firewall
[1]: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pveum_tfa_auth

 

[imthiazaar]

Thanks for the links.. 2FA is promising..