Post-install hardening baseline

Why this matters in production

A fresh install is functional but not production-ready. The defaults are tuned for ease of use, not security. This lesson walks through the minimum baseline to apply before the node joins a cluster and serves any workload.

Baseline hardening checklist

The order matters — apply each step in sequence and verify before moving on.

flowchart LR
  A[Patch] --> B[SSH hardening]
  B --> C[Time sync]
  C --> D[Firewall baseline]
  D --> E[Updates & reboots]
  E --> F[Cluster join]

1. Patch

apt update && apt full-upgrade -y && [ -e /var/run/reboot-required ] && systemctl reboot

2. SSH hardening

The Proxmox default allows password login as root. This is dangerous in production.

sed -i 's/^#\\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config && sed -i 's/^#\\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config && systemctl reload sshd

Before disabling password auth, ensure your SSH public key is in /root/.ssh/authorized_keys.

Optional but recommended:

• Change the SSH port (security-through-obscurity, but reduces log noise).
• Disable X11Forwarding, PermitEmptyPasswords.

3. Time synchronisation

Time skew breaks Kerberos, breaks Corosync, breaks PBS verification, breaks TLS. NTP must work.

apt install -y chrony && systemctl enable --now chrony

cat > /etc/chrony/conf.d/10-local.conf <<EOF
server ntp1.example.com iburst
server ntp2.example.com iburst
makestep 1.0 3
rtcsync
EOF
systemctl restart chrony

chronyc tracking && timedatectl status

4. Firewall baseline

Proxmox ships with a host firewall that is off by default. Enable it.

# Best done via GUI: Datacenter > Firewall > Options > Firewall: Yes
# Or use pvesh set:
pvesh set /cluster/firewall/options --enable 1

At minimum, allow SSH (port 22) and the Proxmox web UI (port 8006) from the management network. Block everything else. Cluster network (port 5404–5405 UDP for Corosync, port 2224 TCP for ssh between nodes) must be allowed between nodes.

5. Cluster join

Once the baseline is in place, the node can join a cluster (covered in Part XI). Verify the join by:

pvecm status

Production considerations

Common mistakes

• Disabling password login before confirming SSH key access.
• Skipping NTP setup; discovering weeks later that the cluster had silent time drift.
• Enabling the firewall but blocking Corosync traffic, causing cluster join to fail.
• Patching without testing; deploying a kernel that breaks some workload.

Key takeaways

• Patch, harden SSH, configure NTP, enable firewall, then join the cluster.
• Verify each step before moving on.
• Capture the baseline as code for repeatability.

Knowledge check