Proxmox hates security
-
I don't know if any of you try to use Proxmox with a user other than
root, but it is a pain in the ass.First they do not make it easy to even add users and grant them permissions.
Then even if once you do, there are so many things that do not work.
Here is one I found today. Adding a USB passthrough device.
-
Interesting observation.
If you think about it, using a web UI on the hypervisor increases the attack surface substantially.
What I'm trying to say is that Proxmox was clearly not designed with security as it's primary focus.
-
@Pete-S said in Proxmox hates security:
Interesting observation.
If you think about it, using a web UI on the hypervisor increases the attack surface substantially.
What I'm trying to say is that Proxmox was clearly not designed with security as it's primary focus.
You realize that 100% of the hypervisors out there use a remote interface? web or proprietary desktop app doesn't change anything.
-
@JaredBusch said in Proxmox hates security:
@Pete-S said in Proxmox hates security:
Interesting observation.
If you think about it, using a web UI on the hypervisor increases the attack surface substantially.
What I'm trying to say is that Proxmox was clearly not designed with security as it's primary focus.
You realize that 100% of the hypervisors out there use a remote interface? web or proprietary desktop app doesn't change anything.
Attack surface is the difference. With proxmox you have a complete webserver on the hypervisor, not just an remote API. The more services you run and the larger or more complex they are, the larger the attack surface.
I'm not saying Proxmox is insecure, I'm just saying it wasn't designed with security as it's primary focus.
KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.
-
@Pete-S said in Proxmox hates security:
KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.
Remotely using Virt-manager for example, via remote SSH connection.
-
@Obsolesce said in Proxmox hates security:
@Pete-S said in Proxmox hates security:
KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.
Remotely using Virt-manager for example, via remote SSH connection.
Yes, that's one option.
The more minimal approach is to just use
virshas you don't need a desktop environment for that. -
@Pete-S said in Proxmox hates security:
@Obsolesce said in Proxmox hates security:
@Pete-S said in Proxmox hates security:
KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.
Remotely using Virt-manager for example, via remote SSH connection.
Yes, that's one option.
The more minimal approach is to just use
virshas you don't need a desktop environment for that.Huh? Who doesn't use a desktop environment on their PC?
-
@Pete-S said in Proxmox hates security:
I'm not saying Proxmox is insecure, I'm just saying it wasn't designed with security as it's primary focus.
KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.Ignoring "by default" in that, ProxMox can be the same. You can close everything up and only manage however you like. You don't have to use the web interface on it, it can be totally shut down. Obviously defeating lots of the purpose, but plausible.
I spend far more time on ProxMox via command line via MeshCentral than via the web interface and the web interface, while we don't lock it down from the LAN in most cases (we run a LOT of ProxMox these days) we primarily access it from the PM host itself from a jump box running on top of it for the cases when the web interface is needed. So while we don't go to the degree of locking it off from the LAN, we could and we wouldn't notice the difference most of the time.
That's not a default, so obviously totally different. But it's a really simple setting.
-
@Obsolesce said in Proxmox hates security:
@Pete-S said in Proxmox hates security:
@Obsolesce said in Proxmox hates security:
@Pete-S said in Proxmox hates security:
KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.
Remotely using Virt-manager for example, via remote SSH connection.
Yes, that's one option.
The more minimal approach is to just use
virshas you don't need a desktop environment for that.Huh? Who doesn't use a desktop environment on their PC?
SSH jump servers seldom have a desktop environment. And seldom allow tunneling.
And you seldom want a desktop environment on the hypervisor.
-
@scottalanmiller said in Proxmox hates security:
@Pete-S said in Proxmox hates security:
I'm not saying Proxmox is insecure, I'm just saying it wasn't designed with security as it's primary focus.
KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.Ignoring "by default" in that, ProxMox can be the same. You can close everything up and only manage however you like. You don't have to use the web interface on it, it can be totally shut down. Obviously defeating lots of the purpose, but plausible.
I spend far more time on ProxMox via command line via MeshCentral than via the web interface and the web interface, while we don't lock it down from the LAN in most cases (we run a LOT of ProxMox these days) we primarily access it from the PM host itself from a jump box running on top of it for the cases when the web interface is needed. So while we don't go to the degree of locking it off from the LAN, we could and we wouldn't notice the difference most of the time.
That's not a default, so obviously totally different. But it's a really simple setting.
That's good to know.
We don't use gui anymore either but we're moving away from pre-packaged hypervisors and to pure KVM with libvirt compatible management tools.
We have found that to be the best solution for our use case (high degree of automation and customization).
-
@Pete-S said in Proxmox hates security:
@scottalanmiller said in Proxmox hates security:
@Pete-S said in Proxmox hates security:
I'm not saying Proxmox is insecure, I'm just saying it wasn't designed with security as it's primary focus.
KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.Ignoring "by default" in that, ProxMox can be the same. You can close everything up and only manage however you like. You don't have to use the web interface on it, it can be totally shut down. Obviously defeating lots of the purpose, but plausible.
I spend far more time on ProxMox via command line via MeshCentral than via the web interface and the web interface, while we don't lock it down from the LAN in most cases (we run a LOT of ProxMox these days) we primarily access it from the PM host itself from a jump box running on top of it for the cases when the web interface is needed. So while we don't go to the degree of locking it off from the LAN, we could and we wouldn't notice the difference most of the time.
That's not a default, so obviously totally different. But it's a really simple setting.
That's good to know.
We don't use gui anymore either but we're moving away from pre-packaged hypervisors and to pure KVM with libvirt compatible management tools.
We have found that to be the best solution for our use case (high degree of automation and customization).
I'd like to see that for sure. There's a lot of benefit to that, potentially at least.
-
@scottalanmiller said in Proxmox hates security:
@Pete-S said in Proxmox hates security:
@scottalanmiller said in Proxmox hates security:
@Pete-S said in Proxmox hates security:
I'm not saying Proxmox is insecure, I'm just saying it wasn't designed with security as it's primary focus.
KVM by default for instance is managed by libvirt and by default doesn't open any tcp ports at all. That gives the administrator the option to decide what level of security versus convenience they want.Ignoring "by default" in that, ProxMox can be the same. You can close everything up and only manage however you like. You don't have to use the web interface on it, it can be totally shut down. Obviously defeating lots of the purpose, but plausible.
I spend far more time on ProxMox via command line via MeshCentral than via the web interface and the web interface, while we don't lock it down from the LAN in most cases (we run a LOT of ProxMox these days) we primarily access it from the PM host itself from a jump box running on top of it for the cases when the web interface is needed. So while we don't go to the degree of locking it off from the LAN, we could and we wouldn't notice the difference most of the time.
That's not a default, so obviously totally different. But it's a really simple setting.
That's good to know.
We don't use gui anymore either but we're moving away from pre-packaged hypervisors and to pure KVM with libvirt compatible management tools.
We have found that to be the best solution for our use case (high degree of automation and customization).
I'd like to see that for sure. There's a lot of benefit to that, potentially at least.
We're automating a lot.
But the real problem is not the automation itself. The real problem is that automation and standardization is time consuming.
