web security - port 8006

[michabbs]

PMG provides api access via 8006 port, as well as configuration access. I believe it is generally good idea to block connections to this port from outside of our internal network. (Why to open possibility of root log-in from the whole world?)
On the other hand - Spam Quarantine panel is also served via 8006 port. So if I want my users have access to it from their homes or from the road - I must allow connections from the world. I don't like it...

Is it possible to serve quarantine web panel and main api on two different ports?
Or to limit api/configuration access by ip?

 

[hata_ph]

Try out fail2ban on PMG 7.x

https://forum.proxmox.com/threads/pmg-7-debian-11-with-fail2ban.96109/

 

[mbrother]

Try to use csf, it use iptables to handle connection and it's really easy to use.

https://download.configserver.com/csf/install.txt

 

[dietmar]

So if I want my users have access to it from their homes or from the road - I must allow connections from the world. I don't like it...

The standard solution for such problems is a VPN for the home users...

Is it possible to serve quarantine web panel and main api on two different ports?
Or to limit api/configuration access by ip?

No, that is not possible because the quarantine GUI is a web app which uses the API.

 

[bougatoyta]

Hi,

IMO as long as PMG does not split the user interface for managing quarantine and all the other admin stuff you should not open this to the world.

If you do not have the possibility to setup a VPN for your user you could try to use the pre-mentioned Fail2Ban rule and do not hesitate to beeing really agressive with that. (I have a specific rule for the only PMG that is open to WAN in my infra that is permanently banning any ip beside ours that try the root login at least 1 time)