securing PMG GUI root and other users

[velocity08]

Hi All

i've been doing some searches for securing the PMG web GUI for the root user and haven't come across anything specific.

Is there an option for 2fa?
Would there bay any issues if we installed Fail2Ban?
Nothing is jumping out in the Administrators guide.

any assistance would be greatly appreciated.

""Cheers
G

 

[Stoiko Ivanov]

Is there an option for 2fa?

currently this is not implemented - we have it on the roadmap though - no timeframe when this will available though

Would there bay any issues if we installed Fail2Ban?

not to my knowledge
fail2ban should work and not interfere with PMG (unless you configure it to block smtp-traffic and are too harsh on the limits)

I hope this helps!

 

[Nikole]

Good morning.

I just logged in to ask exactly the same question!
I was expecting that 2FA needs implementation to happen however my question is:
To use Fail2Ban it needs to be examining the logs which clearly indicate remote IP and login result (the failures).
Which logfile is that?

Nikole

 

[oguz]

To use Fail2Ban it needs to be examining the logs which clearly indicate remote IP and login result (the failures).
Which logfile is that?

/var/log/pmgproxy/pmgproxy.log is basically the access log

 

[Nikole]

/var/log/pmgproxy/pmgproxy.log is basically the access log

Hm...
I have seen this log but it does not appear to be showing whether a login attempt was successful or failed.
Here is an example of 2 failed attemtps. (The POST lines)
-------------------

192.168.2.10 - - [10/09/2020:10:54:58 +0100] "GET / HTTP/1.1" 200 710
192.168.2.10 - - [10/09/2020:10:54:58 +0100] "GET /pve2/ext6/theme-crisp/resources/theme-crisp-all.css HTTP/1.1" 200 68
192.168.2.10 - - [10/09/2020:10:54:58 +0100] "GET /pve2/css/ext6-pmg.css?ver=2.2-2 HTTP/1.1" 200 1583
192.168.2.10 - - [10/09/2020:10:54:58 +0100] "GET /fontawesome/css/font-awesome.css HTTP/1.1" 200 7289
192.168.2.10 - - [10/09/2020:10:54:58 +0100] "GET /pve2/ext6/theme-crisp/resources/theme-crisp-all_2.css HTTP/1.1" 200 5208
192.168.2.10 - - [10/09/2020:10:54:58 +0100] "GET /pve2/ext6/crisp/resources/charts-all.css HTTP/1.1" 200 995
192.168.2.10 - - [10/09/2020:10:54:58 +0100] "GET /pwt/css/ext6-pmx.css?ver=2.2-8 HTTP/1.1" 200 697
192.168.2.10 - - [10/09/2020:10:54:59 +0100] "GET /proxmoxlib.js?ver=2.2-8 HTTP/1.1" 200 52351
192.168.2.10 - - [10/09/2020:10:54:59 +0100] "GET /pve2/ext6/ext-all.js HTTP/1.1" 200 609692
192.168.2.10 - - [10/09/2020:10:54:59 +0100] "GET /pve2/ext6/charts.js HTTP/1.1" 200 100383
192.168.2.10 - - [10/09/2020:10:54:59 +0100] "GET /pve2/ext6/theme-crisp/resources/theme-crisp-all_1.css HTTP/1.1" 200 33744
192.168.2.10 - - [10/09/2020:10:54:59 +0100] "GET /pve2/ext6/locale/locale-en.js HTTP/1.1" 200 2569
192.168.2.10 - - [10/09/2020:10:54:59 +0100] "GET /pve2/js/pmgmanagerlib.js?ver=2.2-2 HTTP/1.1" 200 56716
192.168.2.10 - - [10/09/2020:10:54:59 +0100] "GET /pve2/ext6/theme-crisp/resources/images/form/trigger.png HTTP/1.1" 200 17627
192.168.2.10 - - [10/09/2020:10:54:59 +0100] "GET /pve2/images/proxmox_logo.png HTTP/1.1" 200 2809
192.168.2.10 - - [10/09/2020:10:55:00 +0100] "GET /pve2/images/logo-128.png HTTP/1.1" 200 4977
192.168.2.10 - root@pam [10/09/2020:10:55:02 +0100] "GET /api2/json/nodes/antispam/rrddata?timeframe=hour&cf=AVERAGE HTTP/1.1" 200 4196
192.168.2.10 - - [10/09/2020:10:55:06 +0100] "GET /pve2/ext6/theme-crisp/resources/images/loadmask/loading.gif HTTP/1.1" 200 1849
192.168.2.10 - - [10/09/2020:10:55:09 +0100] "POST /api2/extjs/access/ticket HTTP/1.1" 200 75
192.168.2.10 - - [10/09/2020:10:55:10 +0100] "GET /pve2/ext6/theme-crisp/resources/images/tools/tool-sprites.png HTTP/1.1" 200 24404
192.168.2.10 - - [10/09/2020:10:55:10 +0100] "GET /pve2/ext6/theme-crisp/resources/images/shared/icon-error.png HTTP/1.1" 200 18494
192.168.2.10 - - [10/09/2020:10:55:18 +0100] "POST /api2/extjs/access/ticket HTTP/1.1" 200 75

This cannot be used obviously...

 

[Stoiko Ivanov]

the authentication failures are logged in the journal:

Sep 10 13:03:21 pmg pmgdaemon[1138]: authentication failure; rhost=192.0.2.200 user=root@pam msg=auth failed: Authentication failure at /usr/share/perl5/PMG/AccessControl.pm

I hope this helps!