RunBook AcademyProxmox VE

← All checklists in Proxmox VE

QuarterlySecurity

Security hardening audit

15 items ·7 critical ·5 warn ·3 info

Security hardening audit

A thorough quarterly audit of cluster security. Best performed alongside compliance reviews.

When to run

Quarterly as part of compliance
After any team or staffing change
After any reported incident or near-miss
After major configuration changes

What to capture

A signed PDF of the completed checklist, stored with compliance records. Any critical findings need a remediation ticket.

Critical7 items

SSH password authentication disabled cluster-wide
```
sshd -T | grep passwordauthentication
```
Root SSH restricted to key-based auth (PermitRootLogin prohibit-password)
```
sshd -T | grep permitrootlogin
```
2FA enrolled for all human accounts with admin privileges
```
pveum tfa list
```
No accounts with default or weak passwords

TLS certificate valid for > 30 days, properly issued

openssl x509 -in /etc/pve/local/pveproxy-ssl.pem -noout -dates -issuer

Offsite backup transmission encrypted (TLS / VPN)
No unpatched critical CVEs in installed packages

Warning5 items

PVE firewall enabled with documented ruleset in version control
No unused services exposed on management interface
```
ss -tlnp
```
fail2ban (or equivalent) active on every internet-exposed host
```
systemctl status fail2ban
```
All backups encrypted (client-side or at-rest)
RBAC permissions reviewed for least privilege
```
pveum acl list
```

Info3 items

Audit logging enabled for privileged operations
```
auditctl -l | head -20
```
User list reviewed; unused accounts disabled
```
pveum user list
```
SSH config and firewall config in version control