Security questions and contradictions

[jan24]

We started using Proxmox today and have a cluster with 5 nodes.

The Proxmox WebUI is only accessible via VPN. The nodes are only accessible via the VPN using internal IP addresses. Only the VMs on the nodes are assigned public IP addresses.

Now I’m reading a lot of conflicting information online, including here in the forum. Some say you should do everything as root. That contradicts basic Linux best practices. Then I read about disabling SSH root login, using fail2ban, etc.

I’m wondering: Is all of this necessary if Proxmox is completely inaccessible? I’ve also enabled 2FA for the WebUI. And of course, the system hardening must be performed on the VMs (firewall, fail2ban, SSH security, etc.).

But as far as Proxmox is concerned—what’s the right approach?

By the way: We’re using the cluster in a production environment and for critical operations, so high security is very important.

 

[bbgeek17]

Hi @jan24, welcome to the forum.

Today, a PVE cluster relies extensively on cross-node SSH communication via root account. While it primarily uses key-based authentication, password authentication is required in some situations, particularly during the initial cluster configuration.

Additionally, some management operations (such as certain hardware-related VM operations and file management tasks) must be executed as root.

In short, disabling the root account in PVE while maintaining full functionality is extremely difficult, if not impossible.

Your best approach is to secure, rather than disable, the root account. For example:

• Restrict SSH access to trusted IP addresses (for example, over a dedicated management or cluster VLAN).
• Use a randomly generated password.
• Consider appending hardware-backed suffix to the password for administrative access.
• Use sudo with regular user accounts whenever practical, but leave the root account available for the operations that require it.

This approach generally provides a good balance between security and operational compatibility.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[jan24]

Hi @bbgeek17 , thank you!

I was wondering, if SSH security is needed, if my nodes are not available via the internet. So all nodes are behind a VPN with local IPs. There is no public IP for the nodes itself, only the VMs are getting public IPs of course.

That root should not be fully disabled, is clear