CIS Proxmox VE 8 Benchmark

This recommendation verifies that Proxmox VE is running the latest stable version on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Proxmox VE version:
pveversion -v

# Check for available updates:
apt update && apt list --upgradable 2>/dev/null | grep pve

# Update Proxmox VE:
apt update && apt full-upgrade -y

# For major upgrades, follow official migration guide:
# https://pve.proxmox.com/wiki/Upgrade

This recommendation verifies that enterprise repository is used in production on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check repositories configured:
cat /etc/apt/sources.list.d/pve-enterprise.list
cat /etc/apt/sources.list.d/pve-no-subscription.list 2>/dev/null

# Check subscription status:
pvesubscription get

# Use enterprise repository with valid subscription:
echo 'deb https://enterprise.proxmox.com/debian/pve bookworm pve-enterprise' > /etc/apt/sources.list.d/pve-enterprise.list

# Remove no-subscription repo in production:
rm -f /etc/apt/sources.list.d/pve-no-subscription.list

This recommendation verifies that external authentication realm with 2FA is configured on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List authentication realms:
pveum realm list

# Check PAM and PVE realm settings:
pveum realm list --output-format json-pretty

# Check two-factor enabled:
grep 'tfa' /etc/pve/user.cfg

# Configure LDAP/AD realm:
pveum realm add company-ad --type ad \
  --server1 dc1.company.com \
  --base_dn 'DC=company,DC=com' \
  --tfa type=totp

# Enable 2FA for PVE realm:
pveum realm modify pam --tfa type=totp

This recommendation verifies that user accounts are managed with principle of least privilege on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List all users:
pveum user list

# Check for disabled users:
pveum user list | grep -i disable

# Check root@pam 2FA:
pveum user list --output-format json-pretty | python3 -c "import sys,json; [print(u) for u in json.load(sys.stdin) if u.get('userid')=='root@pam']"

# Create limited admin user:
pveum user add admin@pve --password SecureP@ss123!
pveum aclmod / -user admin@pve -role PVEAdmin

# Require 2FA for all users:
pveum realm modify pve --tfa type=totp

# Disable unused accounts:
pveum user modify olduser@pve --enable 0

This recommendation verifies that API tokens use privilege separation on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List API tokens:
pveum user token list root@pam

# Check all tokens across users:
for user in $(pveum user list --noheader -c userid); do
  echo "=== $user ==="
  pveum user token list "$user" 2>/dev/null
done

# Create API token with least privilege:
pveum user token add admin@pve monitoring --privsep 1
pveum aclmod / -token 'admin@pve!monitoring' -role PVEAuditor

# Remove unnecessary tokens:
pveum user token remove root@pam old-token

This recommendation verifies that custom roles with minimal privileges are used on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List all roles:
pveum role list

# Check ACLs:
pveum acl list

# Show specific role privileges:
pveum role list --output-format json-pretty

# Create custom roles with least privilege:
pveum role add VMOperator -privs "VM.Console VM.Monitor VM.PowerMgmt"
pveum role add BackupAdmin -privs "Datastore.AllocateSpace Datastore.Audit"

# Assign role to path:
pveum aclmod /vms -user operator@pve -role VMOperator

This recommendation verifies that web UI uses strong TLS configuration on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check web UI access port and TLS:
grep -E 'SSLCipherSuite|SSLProtocol' /etc/apache2/sites-enabled/*.conf 2>/dev/null
ss -tlnp | grep 8006

# Check pveproxy TLS config:
cat /etc/default/pveproxy 2>/dev/null

# Configure TLS in /etc/default/pveproxy:
TLS_CIPHERS="ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"
HONOR_CIPHER_ORDER=yes
TLS_MIN_VERSION=1.2

systemctl restart pveproxy

This recommendation verifies that Proxmox firewall is enabled on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check firewall status:
pve-firewall status

# Check cluster firewall rules:
pve-firewall cluster-rules

# Check host firewall rules:
pve-firewall host-rules

# Enable Proxmox firewall at cluster level:
pvesh set /cluster/firewall/options --enable 1 --policy_in DROP --policy_out ACCEPT

# Enable on host:
pvesh set /nodes/$(hostname)/firewall/options --enable 1

# Add management access rule:
pvesh create /cluster/firewall/rules --action ACCEPT --type in --source 10.0.0.0/8 --dport 8006 --proto tcp --comment 'PVE Management'

This setting ensures that console access is restricted on the Proxmox VE 8 virtualization platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Proxmox VE 8 virtualization platform is essential for defense in depth.

# Check if SPICE/VNC is restricted:
grep -E 'console|vnc|spice' /etc/pve/datacenter.cfg 2>/dev/null

# Check listening ports:
ss -tlnp | grep -E '3128|5900|59'

# Restrict console access in /etc/pve/datacenter.cfg:
console: html5

# Use only SPICE with TLS or noVNC through proxy:
# Ensure no direct VNC ports exposed
# All console access should go through pveproxy on 8006

This recommendation verifies that storage encryption is configured where appropriate on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List storage pools:
pvesm status

# Check storage configuration:
cat /etc/pve/storage.cfg

# Check ZFS encryption:
zfs get encryption rpool 2>/dev/null

# Configure encrypted ZFS storage:
zfs create -o encryption=aes-256-gcm -o keyformat=passphrase rpool/secure-data

# Restrict storage access per pool:
pveum aclmod /storage/local-lvm -user vmadmin@pve -role PVEDatastoreUser

This recommendation verifies that automated backups with retention are configured on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check backup configuration:
cat /etc/pve/jobs.cfg 2>/dev/null
pvesh get /cluster/backup

# List existing backups:
pvesh get /nodes/$(hostname)/storage/local/content --content backup

# Configure scheduled backups:
pvesh create /cluster/backup \
  --dow mon,wed,fri \
  --starttime 02:00 \
  --mode snapshot \
  --compress zstd \
  --mailnotification always \
  --mailto admin@company.com \
  --all 1 \
  --notes-template '{{guestname}}-{{node}}'

# Set backup retention:
pvesh set /cluster/backup/<id> --prune-backups keep-daily=7,keep-weekly=4,keep-monthly=3

This recommendation verifies that VM security settings are configured on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check VM configurations for security settings:
for vmid in $(qm list --noheader | awk '{print $1}'); do
  echo "=== VM $vmid ==="
  qm config $vmid | grep -E 'balloon|hotplug|agent|protection'
done

# Harden VM configuration:
qm set <vmid> --protection 1
qm set <vmid> --balloon 0
qm set <vmid> --hotplug 0
qm set <vmid> --agent enabled=1,fstrim_cloned_disks=1

# Disable USB passthrough if not needed:
qm set <vmid> --delete usb0

This setting ensures that containers are unprivileged with restricted features on the Proxmox VE 8 virtualization platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Proxmox VE 8 virtualization platform is essential for defense in depth.

# Check container security:
for ctid in $(pct list --noheader | awk '{print $1}'); do
  echo "=== CT $ctid ==="
  pct config $ctid | grep -E 'unprivileged|features|protection'
done

# Use unprivileged containers:
pct set <ctid> --unprivileged 1
pct set <ctid> --protection 1

# Restrict container features:
pct set <ctid> --features nesting=0,mount=0

# Set resource limits:
pct set <ctid> --memory 2048 --swap 512 --cpulimit 2

This recommendation verifies that cluster communication is encrypted on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check cluster status:
pvecm status

# Check cluster network:
pvecm nodes

# Check corosync config:
cat /etc/pve/corosync.conf | grep -E 'interface|bindnet|crypto'

# Configure cluster encryption:
pvecm updatecerts --force

# Use dedicated cluster network:
# In corosync.conf, ensure ring0/link0 uses dedicated VLAN:
# interface {
#   ringnumber: 0
#   bindnetaddr: 10.10.10.0
# }

# Set cluster-wide options:
pvesh set /cluster/options --migration_type secure

This recommendation verifies that SSH is hardened on hypervisor hosts on the Proxmox VE 8 virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Proxmox VE 8 virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SSH configuration:
grep -E 'PermitRootLogin|PasswordAuthentication|Port' /etc/ssh/sshd_config

# Check listening services:
ss -tlnp

# Harden SSH on hosts:
sed -i 's/^#*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^#*MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config

systemctl restart sshd