Proxmox security hardening checklist for the host

A Proxmox host controls every VM on it, so it deserves stronger protection than any single guest. This Proxmox security hardening checklist covers access, accounts, network exposure, updates and backups.

Before you start

• Console or IPMI access before tightening access rules.
• A list of the IPs or VPN that admins use.

Limit network exposure

• Do not expose port 8006 (web UI) and SSH to the whole internet. Allow them only from admin IPs or over a VPN (WireGuard VPN).
• Use the Proxmox firewall at datacenter and node level (firewall setup).
• Keep IPMI/iDRAC on a private management network.
• Put corosync and storage traffic on separate, private networks.

Secure accounts

• Create personal admin accounts instead of sharing root@pam (users, permissions and 2FA).
• Turn on TOTP two-factor authentication for every admin, root included.
• Use API tokens with only the permissions each script needs.

Harden SSH

1. Add your public key and test key login.
2. In /etc/ssh/sshd_config, set PasswordAuthentication no and PermitRootLogin prohibit-password.
3. Restart SSH with systemctl restart ssh, keeping your current session open while you test.

Add fail2ban for the web UI

Install fail2ban and add a jail that watches failed Proxmox logins in the journal (the pvedaemon authentication failure messages) to block IPs after repeated failures on port 8006. Keep your own IPs in the ignore list.

apt install fail2ban -y

Keep the system patched

• Apply updates regularly with apt update && apt full-upgrade (repositories and updates).
• Reboot for kernel security fixes in planned windows.
• Install only what Proxmox needs on the host; run other services inside VMs or containers.

Protect backups

• Store backups on a separate system such as Proxmox Backup Server, with its own credentials (PBS setup).
• Consider client-side encryption and an off-site sync, so ransomware on one host cannot destroy all copies.

Troubleshooting

• Locked out of the web UI: use the console, run pve-firewall stop or unban your IP with fail2ban-client.
• Cluster errors after SSH changes: restore root key login between nodes.

Frequently asked questions

Should I change the 8006 port?

It only reduces noise. Firewall rules and a VPN are far more effective.

Is a reverse proxy in front of 8006 a good idea?

It can add SSL and access control, but keep it simple and patched.

Do containers weaken host security?

Privileged containers can; keep containers unprivileged (LXC management).

Next steps

• Proxmox firewall
• KVM hypervisor hardening
• Let's Encrypt SSL