Proxmox VE is an incredible virtualization platform, but a fresh install needs hardening before it’s production-ready. This guide covers everything from basic configuration to advanced security controls.

Prerequisites

  • Proxmox VE 8.x installed on bare metal
  • Physical access or IPMI/iKVM for recovery
  • Basic Linux command line familiarity

1. Repository Configuration

Disable Enterprise Repositories

By default, Proxmox uses enterprise repositories that require a subscription. For homelab use, switch to the community repositories:

# Remove enterprise repository
rm /etc/apt/sources.list.d/pve-enterprise.list

# Add community repository (no-subscription)
echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription" > /etc/apt/sources.list.d/pve-community.list

# Update and upgrade
apt update && apt dist-upgrade -y

Enable Proxmox Test Repository (Optional)

For newer packages, add the test repository:

echo "deb http://download.proxmox.com/debian/pve bookworm pvetest" > /etc/apt/sources.list.d/pve-test.list

2. User Management

Create Non-Root Admin User

Never use root@pam for daily operations:

# Create user
pveum user add admin@pve --password <secure_password>

# Create admin group
pveum group add admins --comment "Proxmox Administrators"

# Add user to group
pveum user modify admin@pve --group admins

# Create role with full permissions
pveum role add PVEAdmin --privs "Datastore.AllocateSpace Datastore.Audit Datastore.AllocateTemplate Sys.Audit Sys.Console Sys.Modify VM.Allocate VM.Audit VM.Clone VM.Console VM.Config.CDROM VM.Config.CPU VM.Config.Cloudinit VM.Config.Disk VM.Config.Hardware VM.Config.Memory VM.Config.Network VM.Config.Options VM.Migrate VM.Monitor VM.PowerMgmt VM.Snapshot VM.Snapshot.Rollback"

# Assign role to group at root
pveum acl modify / --group admins --role PVEAdmin

Enable Two-Factor Authentication

# Install TOTP
apt install libpam-google-authenticator

# Configure for user
google-authenticator

3. Network Segmentation

Create Network Bridges

Isolate traffic with separate bridges:

# VM bridge (VLAN-aware)
auto vmbr0
iface vmbr0 inet manual
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 2-4094

# Management bridge (VLAN 10)
auto vmbr1
iface vmbr1 inet static
    address 192.168.10.2/24
    gateway 192.168.10.1
    bridge-ports eno1.10
    bridge-stp off
    bridge-fd 0

# DMZ bridge (VLAN 20)
auto vmbr2
iface vmbr2 inet manual
    bridge-ports eno1.20
    bridge-stp off
    bridge-fd 0

Firewall Rules

Enable the Proxmox firewall at the datacenter level:

# Enable firewall
pvesh set /cluster/firewall/options --enable 1

# Create security group for management
pvesh create /cluster/firewall/groups --group management
pvesh create /cluster/firewall/groups/management --action ACCEPT --source 192.168.10.0/24 --proto tcp --dport 8006 --comment "Web UI"
pvesh create /cluster/firewall/groups/management --action ACCEPT --source 192.168.10.0/24 --proto tcp --dport 22 --comment "SSH"

4. Storage Hardening

Enable Encryption with LUKS

For sensitive workloads, encrypt your storage:

# Create encrypted volume
cryptsetup luksFormat /dev/sdb1
cryptsetup luksOpen /dev/sdb1 encrypted_storage
mkfs.ext4 /dev/mapper/encrypted_storage

# Add to crypttab
echo "encrypted_storage UUID=$(blkid -s UUID -o value /dev/sdb1) none luks" >> /etc/crypttab

Configure Backup Encryption

Proxmox backups can be encrypted:

# Generate key
openssl rand -base64 32 > /etc/pve/backup.key

# Configure encryption in backup job
# Via GUI: Datacenter -> Backup -> Add -> Encryption

5. Update Management

Automatic Security Updates

# Install unattended-upgrades
apt install unattended-upgrades apt-listchanges -y

# Configure for security updates only
dpkg-reconfigure -plow unattended-upgrades

Kernel Updates with Live Patching

# Install kernel live patching (requires reboot once)
apt install pve-kernel-6.8

6. Monitoring and Alerting

Netdata for Real-Time Metrics

# Install Netdata
bash <(curl -Ss https://my-netdata.io/kickstart.sh)

# Configure for Proxmox
systemctl enable netdata
systemctl start netdata

SNMP for External Monitoring

apt install snmpd

# Configure SNMP v3 only
cat > /etc/snmp/snmpd.conf <<EOF
createUser snmpuser SHA "authpass123" AES "privpass123"
rouser snmpuser authPriv
sysLocation "Homelab"
sysContact "[email protected]"
EOF

systemctl enable snmpd
systemctl start snmpd

7. Snapshot Strategy

Automated Snapshots

Create a script for periodic snapshots:

#!/bin/bash
# /root/scripts/snapshot.sh

SNAP_NAME="daily_$(date +%Y_%m_%d)"
KEEP_DAYS=7

# Get all VMs
for VMID in $(qm list | awk '{print $1}' | tail -n +2); do
    # Create snapshot
    qm snapshot $VMID $SNAP_NAME --vmstate 0
    
    # Delete old snapshots
    for OLD_SNAP in $(qm listsnapshot $VMID | grep daily | awk '{print $2}' | head -n -$KEEP_DAYS); do
        qm delsnapshot $VMID $OLD_SNAP
    done
done

Add to crontab:

# Daily snapshots at 2 AM
0 2 * * * /root/scripts/snapshot.sh >> /var/log/proxmox-snapshots.log 2>&1

8. API Security

Create API Tokens (Not Passwords)

# Create API token
pveum user token add root@pve automation --privsep 0

# Output: Token ID and Secret (save securely)

Restrict Token Permissions

# Create limited role
pveum role add Automation --privs "VM.Audit VM.PowerMgmt VM.Snapshot VM.Snapshot.Rollback"

# Apply to specific VM
pveum acl modify /vms/100 --user root@pve --token automation --role Automation

Verification Checklist

After completing all steps, verify:

  • Can login with non-root admin account
  • TOTP is required for login
  • Firewall blocks unauthorized access
  • Backups are encrypted
  • Monitoring is active
  • Snapshots are running on schedule
  • API tokens work with limited scope

Next Steps

Found an issue? Open a PR on GitHub.