We assess management access, roles, MFA, network segmentation, firewall, logging, update paths, and backup protection, then document prioritised measures.
Companies worldwide trust WZ-IT
Proxmox is a trademark of Proxmox Server Solutions GmbH. WZ-IT is an authorized reseller partner of Proxmox Server Solutions GmbH. Our managed services and service levels are agreed separately from Proxmox subscriptions.
Defense in depth - no single measure protects you. We combine six layers of protection into a robust security concept.
TOTP or WebAuthn, OIDC integration, and separate roles for administration, operations, and read-only access.
Proxmox firewall at cluster, node and VM level. Separation of management, storage and VM networks via VLAN/SDN.
Granular API tokens with scope limitation, rotation, revocation. No root tokens for automation.
Additional detection and restriction of repeated login attempts where this fits the access architecture.
Collect agreed administrative, security, and system logs centrally, retain them immutably, and connect them to a SIEM where required.
Assess security advisories for PVE, the kernel, and agreed components, then control changes through defined maintenance windows.
The following building blocks are selected for the architecture, operating model, and agreed audit scope rather than applied indiscriminately.
Before we harden, we do a structured security audit of your existing setup. You get a report with concrete findings, prioritized by risk, and an action plan with effort estimate.
More on security auditPVE, Corosync, quorum
VLAN, SDN, FW rules
RBAC, MFA, API tokens
PBS, offsite, restore tests
Update status, known CVEs
Logging, SIEM, retention
Proxmox ships the security tools - they just need to be used consistently. Our baseline works through the attack surfaces systematically, using the built-in capabilities of PVE 9:
Two-factor authentication via TOTP or WebAuthn/FIDO2 - enforced at realm level, not just optional. Recovery keys stored safely, no password login for root via SSH.
The Proxmox firewall on all three levels (datacenter, node, VM), management GUI never publicly reachable, corosync/storage/migration in separate networks or VLANs.
Role model via pveum instead of everyone-uses-root; API tokens with privilege separation (default for new tokens) for scripts, backups and CI - every access minimally privileged.
Updates in maintenance windows, prioritised handling of critical advisories, and documented assessment for PVE, the kernel, and agreed components.
Real certificates instead of self-signed - PVE ships ACME/Let’s Encrypt with automatic renewal. Plus audit-ready logs and documented changes.
SSH hardening, fail2ban/CrowdSec against brute force, hardened kernel parameters and AppArmor - the Debian base gets hardened too, not just the PVE layer.
From health checks and taken-over environments, we know the reality of grown Proxmox installations. These five findings keep coming up - every single one is an avoidable entry point:
A structured security check shows where your environment stands today, prioritised by risk rather than by checklist. We then harden the environment deliberately and document the result. Under managed operations, we monitor and maintain the agreed parts of the baseline continuously.
View security auditIn-depth knowledge from our Proxmox knowledge base.
Client-side encryption with PBS and Hetzner Storage Box.
Safe upgrade path with checklist and rollback plan.
Deduplication, encryption and restore tests at a glance.
Where Proxmox hits its limits - honestly assessed.
Billed by time
Describe a scoped task, receive an effort range, then decide.
For professional secrecy holders
If Proxmox processes client, patient or other professional secrets, WZ-IT plans the application, infrastructure, access, backups and ongoing operations within a purpose-built operating model.
Describe management access, network boundaries, and the current security posture.
22.08.2026
On 11 September 2026 the first operational obligation of the Cyber Resilience Act takes effect. It is narrowly scoped: it concerns reporting only, not conformity...
07.08.2026
Metabase closed two critical vulnerabilities on 6 August 2026. The more severe one carries CVSS 10.0 and is, according to the vendor, being actively exploited:...
30.06.2026
Within a few weeks in 2026, two Linux kernel local privilege-escalation flaws were published that work the same way: CVE-2026-46331 (nicknamed "pedit COW") and CVE-2026-43503...
13.05.2026
On 12 May 2026 the OPNsense team shipped version 26.1.8 with patches for two critical remote code execution flaws. CVE-2026-44194 (CVSS 9.1, GitHub advisory GHSA-f59w-m967-9rf6)...
12.05.2026
A cPanel vulnerability that has been actively exploited since 23 February 2026 is officially disclosed on 28 April 2026. By 5 May, more than 44,000...
08.05.2026
Three critical Local Privilege Escalation vulnerabilities in the Linux kernel within two weeks — all three sitting in the code for nine to twelve years....
05.05.2026
With Proxmox Backup Server 4.2 (released late April 2026), S3-compatible object storage is officially supported as a backup backend. No more tech preview label, no...
17.04.2026
Three numbers from the last four months: - CVSS 9.9 — Jellyfin: Path Traversal → Remote Code Execution as Root - CVSS 10.0 — n8n: Unauthenticated...
Answers to the most important questions
No. The Rust-based nftables firewall (proxmox-firewall) has been a tech preview since PVE 8.2 and, per the official documentation, is still not suited for production use in PVE 9.2. We use the established Proxmox firewall on all three levels in production and will switch once Proxmox declares the new implementation stable.
Yes. Proxmox supports TOTP, WebAuthn/FIDO2 and recovery keys - and 2FA can be enforced at realm level so no user can log in without a second factor. That is exactly how we configure it in the hardening baseline; recovery keys are stored safely outside the cluster.
A standard installation is not automatically aligned with the protection profile of a specific production environment. We assess management-interface exposure, MFA, roles, firewall, logging, update paths, and backup protection, then derive the required measures.
A complete security audit (cluster configuration, network, IAM, backup, patching, logging) costs from €1,490. You receive a detailed report with prioritized findings, risk assessment and concrete action plan. Implementation of findings is optional as hourly retainer or fixed-price project.
The baseline follows official Proxmox documentation, hardening of the underlying Linux system, and the security requirements relevant to the specific organisation. Mapping to BSI IT-Grundschutz, ISO 27001, or industry requirements is performed only where explicitly included in scope.
Network segmentation and firewall rules can limit lateral movement, but they do not replace guest-system security or backup and recovery measures. Protection and operational boundaries must therefore be designed across several layers.
Regular updates are planned in agreed maintenance intervals. For critical vulnerabilities, we assess exposure, available mitigations, and operational risk, then prioritise suitable patches. Response targets and further incident work follow the agreed service level.
We provide white-box audits with configuration review, but not a traditional penetration test. Where an external pentest is required, we can help define the technical scope and subsequently assess and remediate findings in a documented process.
No risk: worst case, you leave with a clearer understanding of your project than before.
“WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.”
Customer feedback on virtualization, backup, VPN, security and ongoing cluster operations.
“WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.”
Steve Kirchner
Managing Director, nextGYM GmbH
“Professional, honest and technically thoroughly sound: WZ-IT set up our Proxmox and backup infrastructure securely and future-proof. The consulting from Timo and Robin was objective and needs-driven, the implementation smooth and the final documentation exemplary. You can tell immediately that business-critical infrastructure is thought through holistically from the outset here and implemented with clear ownership.”
Pascal Block
Project Manager, Stadtwerke Brühl GmbH
Stadtwerke Brühl - municipal energy and infrastructure utility.
“WZ-IT provided very competent support in implementing our server and virtualization infrastructure. As part of the project, a Proxmox-based virtualization environment was set up along with a virtual machine for our application systems. Additionally, a structured backup concept was implemented. A particular focus was on security: the setup of a VPN tunnel and the clean implementation of encryption and access concepts were professionally executed. The structured consulting as well as the reliable and swift implementation deserve special mention. We are very satisfied with the services provided and are happy to recommend WZ-IT.”
John Hellmerichs
Managing Director, AInergy GmbH
AInergy - consultancy for energy and facility management.
“WZ-IT manages our Proxmox cluster reliably and professionally. The team handles continuous monitoring and regular updates for us and responds very quickly to any issues or inquiries. They also configure new nodes, systems, and applications that we need to add to our cluster. With WZ-IT's proactive support, our cluster and the business-critical applications running on it remain stable, and high availability is consistently ensured. We value the professional collaboration and the noticeable relief it brings to our daily operations.”
Pascal Hakkers
Aphy AG
Aphy AG - AI platform for hotel back-office.
“I recently worked with Timo and the WZ-IT team, and honestly, it turned out to be one of the best tech decisions I have made for my business. Right from the start, Timo took the time to walk me through every step in a simple and calm way. No matter how many questions I had, he never rushed me. The results speak for themselves. With WZ-IT, we reduced our monthly expenses from $1,300 down to $250. This was a huge win for us.”
Aleksandr Shuliko
CTO, EVA Real Estate
EVA Real Estate - leading real-estate agency in Dubai.
“Communication with WZ-IT was open, friendly and professional from the very beginning. Mr. Wevelsiep and Mr. Zins responded to every one of our questions patiently, promptly and respectfully, and contributed their own suggestions and good ideas on how to modernize our server infrastructure and adapt it even better to our needs. Throughout, WZ-IT consistently kept our need for data sovereignty and GDPR compliance in mind. Even short-notice adjustments and change requests from our side were implemented quickly and patiently and integrated consistently into the overall concept. From planning to the final handover, every step was documented transparently and comprehensively - so if a provider change should ever become necessary, the documentation would let us onboard a successor into our infrastructure very quickly. We are extremely satisfied with WZ-IT and hope to continue working together for a long time.”
Christoph Mußmann
Project Officer, DGHO e.V.
DGHO - German Society for Hematology and Medical Oncology.
“I got to know Timo and Robin as dedicated and professional partners who make a lot of things possible for their clients that initially seem impossible. I felt very well advised. The services offered have thoroughly convinced me. (translated)”
Andrea Pawlowski
Communications Manager, Golem.de
Golem.de - leading German IT news outlet.
“While looking for a partner to integrate a local AI solution, we came across Timo and Robin - and could not have made a better decision. They quickly understood our requirements and solved technical challenges competently and pragmatically. We were particularly impressed by the straightforward collaboration, their high level of expertise and the speed of implementation. We are delighted to have Timo and Robin at our side as reliable business partners and look forward to our next projects together. (translated)”
Henrik Jeche
Head of IT Administration
ml&s - full-service provider for the electronics industry.
“With Timo and Robin, you're not only on the safe side technically - you also get the best human support! Whether it's quick help in everyday life or complex IT solutions: the guys from WZ-IT think along with you, act quickly and speak a language you understand. The collaboration is uncomplicated, reliable and always on an equal footing. That makes IT fun - and above all: it works! Big thank you to the team! (translated)”
Sonja Aßer
Data Manager, ARGE
ARGE Neue Medien - master data & digital standards for plumbing and building technology.
“We have had very good experiences with Mr. Wevelsiep and WZ-IT. The consultation was professional, clearly understandable, and at fair prices. The team not only implemented our requirements but also thought along and proactively. Instead of just processing individual tasks, they provided us with well-founded explanations that strengthened our own understanding. WZ-IT took a lot of pressure off us with their structured approach - that was exactly what we needed and is the reason why we keep coming back. (translated)”
Matthias Zimmermann
Managing Director, Annota GmbH
Annota - healthtech startup with an AI documentation assistant.
“Timo and Robin from WZ-IT set up a RocketChat server for us - and I couldn't be more satisfied! From the initial consultation to the final implementation, everything was absolutely professional, efficient, and to my complete satisfaction. I particularly appreciate the clear communication, transparent pricing, and the comprehensive expertise that both bring to the table. Even after the setup, they take care of the maintenance, which frees up my time enormously and allows me to focus on other important areas of my business - with the good feeling that our IT is in the best hands. I can recommend WZ-IT without reservation and look forward to continuing our collaboration! (translated)”
Sebastian Maier
Managing Director, Yonju GmbH
Yonju - business coaching and AI products.
“Counting on WZ-IT team was crucial, their expertise and solutions gave us the pace to deploy in production our services, even suggesting and performing improvements over our configuration and setup. We expect to keep counting on them for continuous maintenance of our services and implementation of new solutions.”
Gabriel Sanz Señor
Managing Director, Odiseo Solutions
Odiseo Solutions - software engineering for the space industry.
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
Companies worldwide trust WZ-IT
