ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Proxmox hates security

    IT Discussion
    proxmox proxmox 7 security
    4
    12
    795
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • 1
      1337
      last edited by

      Interesting observation.

      If you think about it, using a web UI on the hypervisor increases the attack surface substantially.

      What I'm trying to say is that Proxmox was clearly not designed with security as it's primary focus.

      JaredBuschJ 1 Reply Last reply Reply Quote 0
      • JaredBuschJ
        JaredBusch @1337
        last edited by

        @Pete-S said in Proxmox hates security:

        Interesting observation.

        If you think about it, using a web UI on the hypervisor increases the attack surface substantially.

        What I'm trying to say is that Proxmox was clearly not designed with security as it's primary focus.

        You realize that 100% of the hypervisors out there use a remote interface? web or proprietary desktop app doesn't change anything.

        1 1 Reply Last reply Reply Quote 0
        • 1
          1337 @JaredBusch
          last edited by 1337

          @JaredBusch said in Proxmox hates security:

          @Pete-S said in Proxmox hates security:

          Interesting observation.

          If you think about it, using a web UI on the hypervisor increases the attack surface substantially.

          What I'm trying to say is that Proxmox was clearly not designed with security as it's primary focus.

          You realize that 100% of the hypervisors out there use a remote interface? web or proprietary desktop app doesn't change anything.

          Attack surface is the difference. With proxmox you have a complete webserver on the hypervisor, not just an remote API. The more services you run and the larger or more complex they are, the larger the attack surface.

          I'm not saying Proxmox is insecure, I'm just saying it wasn't designed with security as it's primary focus.

          KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.

          ObsolesceO scottalanmillerS 2 Replies Last reply Reply Quote 0
          • ObsolesceO
            Obsolesce @1337
            last edited by

            @Pete-S said in Proxmox hates security:

            KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.

            Remotely using Virt-manager for example, via remote SSH connection.

            1 1 Reply Last reply Reply Quote 1
            • 1
              1337 @Obsolesce
              last edited by

              @Obsolesce said in Proxmox hates security:

              @Pete-S said in Proxmox hates security:

              KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.

              Remotely using Virt-manager for example, via remote SSH connection.

              Yes, that's one option.

              The more minimal approach is to just use virsh as you don't need a desktop environment for that.

              ObsolesceO 1 Reply Last reply Reply Quote 0
              • ObsolesceO
                Obsolesce @1337
                last edited by

                @Pete-S said in Proxmox hates security:

                @Obsolesce said in Proxmox hates security:

                @Pete-S said in Proxmox hates security:

                KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.

                Remotely using Virt-manager for example, via remote SSH connection.

                Yes, that's one option.

                The more minimal approach is to just use virsh as you don't need a desktop environment for that.

                Huh? Who doesn't use a desktop environment on their PC?

                1 1 Reply Last reply Reply Quote 0
                • scottalanmillerS
                  scottalanmiller @1337
                  last edited by

                  @Pete-S said in Proxmox hates security:

                  I'm not saying Proxmox is insecure, I'm just saying it wasn't designed with security as it's primary focus.
                  KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.

                  Ignoring "by default" in that, ProxMox can be the same. You can close everything up and only manage however you like. You don't have to use the web interface on it, it can be totally shut down. Obviously defeating lots of the purpose, but plausible.

                  I spend far more time on ProxMox via command line via MeshCentral than via the web interface and the web interface, while we don't lock it down from the LAN in most cases (we run a LOT of ProxMox these days) we primarily access it from the PM host itself from a jump box running on top of it for the cases when the web interface is needed. So while we don't go to the degree of locking it off from the LAN, we could and we wouldn't notice the difference most of the time.

                  That's not a default, so obviously totally different. But it's a really simple setting.

                  1 1 Reply Last reply Reply Quote 1
                  • 1
                    1337 @Obsolesce
                    last edited by 1337

                    @Obsolesce said in Proxmox hates security:

                    @Pete-S said in Proxmox hates security:

                    @Obsolesce said in Proxmox hates security:

                    @Pete-S said in Proxmox hates security:

                    KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.

                    Remotely using Virt-manager for example, via remote SSH connection.

                    Yes, that's one option.

                    The more minimal approach is to just use virsh as you don't need a desktop environment for that.

                    Huh? Who doesn't use a desktop environment on their PC?

                    SSH jump servers seldom have a desktop environment. And seldom allow tunneling.

                    And you seldom want a desktop environment on the hypervisor.

                    1 Reply Last reply Reply Quote 0
                    • 1
                      1337 @scottalanmiller
                      last edited by 1337

                      @scottalanmiller said in Proxmox hates security:

                      @Pete-S said in Proxmox hates security:

                      I'm not saying Proxmox is insecure, I'm just saying it wasn't designed with security as it's primary focus.
                      KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.

                      Ignoring "by default" in that, ProxMox can be the same. You can close everything up and only manage however you like. You don't have to use the web interface on it, it can be totally shut down. Obviously defeating lots of the purpose, but plausible.

                      I spend far more time on ProxMox via command line via MeshCentral than via the web interface and the web interface, while we don't lock it down from the LAN in most cases (we run a LOT of ProxMox these days) we primarily access it from the PM host itself from a jump box running on top of it for the cases when the web interface is needed. So while we don't go to the degree of locking it off from the LAN, we could and we wouldn't notice the difference most of the time.

                      That's not a default, so obviously totally different. But it's a really simple setting.

                      That's good to know.

                      We don't use gui anymore either but we're moving away from pre-packaged hypervisors and to pure KVM with libvirt compatible management tools.

                      We have found that to be the best solution for our use case (high degree of automation and customization).

                      scottalanmillerS 1 Reply Last reply Reply Quote 2
                      • scottalanmillerS
                        scottalanmiller @1337
                        last edited by

                        @Pete-S said in Proxmox hates security:

                        @scottalanmiller said in Proxmox hates security:

                        @Pete-S said in Proxmox hates security:

                        I'm not saying Proxmox is insecure, I'm just saying it wasn't designed with security as it's primary focus.
                        KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.

                        Ignoring "by default" in that, ProxMox can be the same. You can close everything up and only manage however you like. You don't have to use the web interface on it, it can be totally shut down. Obviously defeating lots of the purpose, but plausible.

                        I spend far more time on ProxMox via command line via MeshCentral than via the web interface and the web interface, while we don't lock it down from the LAN in most cases (we run a LOT of ProxMox these days) we primarily access it from the PM host itself from a jump box running on top of it for the cases when the web interface is needed. So while we don't go to the degree of locking it off from the LAN, we could and we wouldn't notice the difference most of the time.

                        That's not a default, so obviously totally different. But it's a really simple setting.

                        That's good to know.

                        We don't use gui anymore either but we're moving away from pre-packaged hypervisors and to pure KVM with libvirt compatible management tools.

                        We have found that to be the best solution for our use case (high degree of automation and customization).

                        I'd like to see that for sure. There's a lot of benefit to that, potentially at least.

                        1 1 Reply Last reply Reply Quote 0
                        • 1
                          1337 @scottalanmiller
                          last edited by 1337

                          @scottalanmiller said in Proxmox hates security:

                          @Pete-S said in Proxmox hates security:

                          @scottalanmiller said in Proxmox hates security:

                          @Pete-S said in Proxmox hates security:

                          I'm not saying Proxmox is insecure, I'm just saying it wasn't designed with security as it's primary focus.
                          KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.

                          Ignoring "by default" in that, ProxMox can be the same. You can close everything up and only manage however you like. You don't have to use the web interface on it, it can be totally shut down. Obviously defeating lots of the purpose, but plausible.

                          I spend far more time on ProxMox via command line via MeshCentral than via the web interface and the web interface, while we don't lock it down from the LAN in most cases (we run a LOT of ProxMox these days) we primarily access it from the PM host itself from a jump box running on top of it for the cases when the web interface is needed. So while we don't go to the degree of locking it off from the LAN, we could and we wouldn't notice the difference most of the time.

                          That's not a default, so obviously totally different. But it's a really simple setting.

                          That's good to know.

                          We don't use gui anymore either but we're moving away from pre-packaged hypervisors and to pure KVM with libvirt compatible management tools.

                          We have found that to be the best solution for our use case (high degree of automation and customization).

                          I'd like to see that for sure. There's a lot of benefit to that, potentially at least.

                          We're automating a lot.

                          But the real problem is not the automation itself. The real problem is that automation and standardization is time consuming.

                          1 Reply Last reply Reply Quote 1
                          • 1 / 1
                          • First post
                            Last post