Production hardening checklist

Why this matters in production

A hardened environment reduces the attack surface and makes incidents less likely. This lesson is a production-ready checklist.

Hardening checklist

Network

• Management interface on dedicated VLAN with firewall allow-list
• SSH on non-standard port (security through obscurity, reduces log noise)
• PermitRootLogin prohibit-password, PasswordAuthentication no
• Per-host firewall enabled with explicit allow-list
• Cluster firewall rules reviewed quarterly

Authentication

• Admin accounts use AD/LDAP, not local
• TFA mandatory for all admin accounts
• API tokens use --privsep 1
• Break-glass accounts exist in sealed envelopes
• Service accounts are distinct from human accounts

Patching

• Subscribed to enterprise or stable no-subscription repository
• Test repository disabled
• Security updates applied within 7 days of release
• Kernel updates followed by reboot during maintenance windows

Storage

• PBS encryption keys backed up to a separate location
• PBS admin access via bastion or VPN
• Off-site PBS sync tested quarterly
• Datastores on ZFS with checksumming

Cluster

• Watchdog configured (hardware preferred)
• QDevice on a separate failure domain (for 2-node clusters)
• HA rules reviewed; no over-permissive rules
• /etc/pve/ backed up to off-cluster storage

Operations

• Audit logs forwarded to SIEM
• Failed login attempts alerted
• Configuration changes tracked in change management
• Quarterly access reviews for admin accounts

CLI checks

grep -E 'PermitRootLogin|PasswordAuthentication' /etc/ssh/sshd_config

pvesh get /cluster/firewall/options

ls /etc/apt/sources.list.d/pvetest* 2>/dev/null && echo WARNING || echo OK

Common anti-patterns

Production considerations

Common mistakes

• “We don’t have time for hardening” (until an incident proves you don’t have time not to).
• Hardening the host but not the VMs.
• Hardening the cluster but not PBS.

Key takeaways

• Use the checklist as a deployment gate.
• Network, auth, patching, storage, cluster, ops.
• Review quarterly.

Knowledge check