Authentication & MFA
TOTP or WebAuthn, OIDC integration, and separate roles for administration, operations, and read-only access.
API Tokens & Service Accounts
Granular API tokens with scope limitation, rotation, revocation. No root tokens for automation.
Harden and secure Proxmox: security audit
We assess management access, roles, MFA, network segmentation, firewall, logging, update paths, and backup protection, then document prioritised measures.
Typical findings
What we find most often in security checks
From health checks and taken-over environments, we know grown Proxmox installations. Every one of these findings is an avoidable entry point.
The management GUI (port 8006) is publicly reachable from the internet
root login with password, without two-factor authentication
All services in one flat network: corosync next to VM and storage traffic
Updates postponed for months because there is no maintenance window
Scripts and backup jobs run with full root privileges instead of API tokens
Six Layers of Protection
What Proxmox security covers
Defense in depth: no single measure protects you. We combine six layers of protection into a robust security concept.
Firewall & Network Segmentation
Proxmox firewall at cluster, node and VM level. Separation of management, storage and VM networks via VLAN/SDN.
CrowdSec / Fail2Ban
Additional detection and restriction of repeated login attempts where this fits the access architecture.
Audit Logging & SIEM
Collect agreed administrative, security, and system logs centrally, retain them immutably, and connect them to a SIEM where required.
CVE Monitoring & Patching
Assess security advisories for PVE, the kernel, and agreed components, then control changes through defined maintenance windows.
Baseline
Harden Proxmox: the baseline in six areas
Proxmox ships the security tools, they just need to be used consistently. Our baseline works through the attack surfaces systematically, using the built-in capabilities of PVE 9.
Access
Second factor via TOTP, enforced at realm level instead of optional; WebAuthn/FIDO2 as an additional, user-configured factor. Recovery keys stored safely, no password login for root via SSH. Proxmox documentationNetwork
The Proxmox firewall on all three levels (datacenter, node, VM), management GUI never publicly reachable, corosync/storage/migration in separate networks or VLANs. Proxmox documentationPermissions & automation
Role model via pveum instead of everyone-uses-root; API tokens with privilege separation (default for new tokens) for scripts, backups and CI, every access minimally privileged. Proxmox documentationUpdates & vulnerabilities
Updates in maintenance windows, prioritised handling of critical advisories, and documented assessment for PVE, the kernel, and agreed components.Evidence & trust
Real certificates instead of self-signed: PVE ships ACME/Let’s Encrypt with automatic renewal. Plus audit-ready logs and documented changes. Proxmox documentationHardening the foundation
SSH hardening, fail2ban/CrowdSec against brute force, hardened kernel parameters and AppArmor: the Debian base gets hardened too, not just the PVE layer.
Hardening Checklist
Secure Proxmox: measures for clusters, VMs and backups
The building blocks are selected for the architecture, operating model, and agreed audit scope rather than applied indiscriminately.
Cluster & Host
- SSH with key authentication, restricted sources, and rate limiting
- Review kernel and host parameters for the target environment
- Define repository and update paths clearly
- Management access through VPN, bastion, or private network
- Document roles, API tokens, and emergency access
VMs & Containers
- Prefer unprivileged containers and review exceptions
- Keep guest, CPU, and device permissions minimal
- Assess PCI passthrough and IOMMU boundaries separately
- Design encryption around the storage and key model
- Maintain templates, cloud-init, and images in a controlled process
Backup & Recovery
- PBS with client-side encryption
- Assess separate off-site and immutability options
- Protect keys and recovery access separately
- Explicitly agree restore tests and recovery objectives
- Document runbooks and optional incident exercises
Where does your cluster stand?
- Cluster configuration: PVE, Corosync, quorum
- Network & firewall: VLAN, SDN, FW rules
- IAM & permissions: RBAC, MFA, API tokens
- Backup & recovery: PBS, offsite, restore tests
- Patching & CVEs: Update status, known CVEs
- Audit logs: Logging, SIEM, retention
Before we harden, we do a structured security audit of your existing setup. You get a report with concrete findings, prioritized by risk, and an action plan with effort estimate.
- HighGUI publicly reachable
- Mediumbackup jobs with root privileges
- Lowself-signed certificate
Security Audit
Measure first, then harden
A structured security check shows where your environment stands today. We then harden the environment deliberately and document the result. Under managed operations, we monitor and maintain the agreed parts of the baseline continuously.
Other routes
Billed by timeProxmox support without a contract
Describe the task and agree scope and fees.
Describe the task →For professional secrecy holdersOperate Proxmox in the Section 203 Managed Cloud
If Proxmox processes client, patient or other professional secrets, WZ-IT plans the application, infrastructure, access, backups and ongoing operations within a purpose-built operating model.
View the Section 203 Managed Cloud →Frequently Asked Questions
Answers to the most important questions
- No. The Rust-based nftables firewall (proxmox-firewall) has been a tech preview since PVE 8.2 and, per the official documentation, is still not suited for production use in PVE 9.2. We use the established Proxmox firewall on all three levels in production and will switch once Proxmox declares the new implementation stable.
- Yes. As of October 2026, Proxmox supports TOTP, WebAuthn/FIDO2 and recovery keys. Realms can enforce TOTP or YubiKey OTP; users in that realm then require a configured second factor (documentation). In the hardening baseline we enforce the second factor at realm level; recovery keys are stored safely outside the cluster.
- A standard installation is not automatically aligned with the protection profile of a specific production environment. We assess management-interface exposure, MFA, roles, firewall, logging, update paths, and backup protection, then derive the required measures.
- A complete security audit (cluster configuration, network, IAM, backup, patching, logging) costs from €1,490. You receive a detailed report with prioritized findings, risk assessment and concrete action plan. Implementation of findings is optional, billed by effort, as an hour package with 10, 25 or 50 hours or as a fixed-price project.
- The baseline follows official Proxmox documentation, hardening of the underlying Linux system, and the security requirements relevant to the specific organisation. Mapping to BSI IT-Grundschutz, ISO 27001, or industry requirements is performed only where explicitly included in scope.
- Network segmentation and firewall rules can limit lateral movement, but they do not replace guest-system security or backup and recovery measures. Protection and operational boundaries must therefore be designed across several layers.
- Regular updates are planned in agreed maintenance intervals. For critical vulnerabilities, we assess exposure, available mitigations, and operational risk, then prioritise suitable patches. Response targets and further incident work follow the agreed service level.
- We provide white-box audits with configuration review, but not a traditional penetration test. Where an external pentest is required, we can help define the technical scope and subsequently assess and remediate findings in a documented process.
- Review six areas: access with MFA, separate networks and firewall, minimal roles and API privileges, updates and vulnerabilities, certificates and logs, and the Linux foundation. Protect backups and recovery separately. The hardening checklist organizes these measures.
- Keep management access private through VPN or a bastion and restricted source networks. Use SSH keys and verify fallback access before disabling password authentication. Enforce MFA for the web interface and retain recovery keys separately.
Knowledge
Further Proxmox guides
In-depth knowledge from our Proxmox knowledge base.
Guides
- Secure and harden ProxmoxChecklist for access, firewall, permissions and backups.
- Encrypted BackupsClient-side encryption with PBS and Hetzner Storage Box.
- PVE 8 → 9 UpgradeSafe upgrade path with checklist and rollback plan.
- What is Proxmox Backup Server?Deduplication, encryption and restore tests at a glance.
- Drawbacks & Suitability of ProxmoxTechnical limits and suitable use cases.
Related tutorials & guides
- CWPdoor: Detect and Clean Up the Backdoor in Control Web PanelOn 5 November 2026 the XLab research team at QiAnXin published the backdoor CWPdoor in Control Web Panel (CWP, formerly CentOS Web Panel). It does...
- Linux Kernel TCP Vulnerability CVE-2026-98432: Proxmox Kernel Update, Debian and Ubuntu PatchingOn 15 October 2026 the Linux kernel CNA published the vulnerability CVE-2026-98432: a use-after-free in the IPv4 TCP connection setup, rated CVSS 3.1 9.8. Kernels...
- PHP Update 8.5.12, 8.4.27, 8.3.36 and 8.2.35: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), Affected Software and MeasuresPHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution: CVE-2026-109618 and CVE-2026-109619, each CVSS 4.0 9.2, called...
- CRA reporting obligation from 11 September 2026: who reports, what and whenOn 11 September 2026 the first operational obligation of the Cyber Resilience Act takes effect. It is narrowly scoped: it concerns reporting only, not conformity...
- Metabase emergency patch: SQL injection rated CVSS 10.0 is being actively exploitedMetabase closed two critical vulnerabilities on 6 August 2026. The more severe one carries CVSS 10.0 and is, according to the vendor, being actively exploited:...
- pedit COW & DirtyClone: Two Critical Linux Kernel Flaws in 2026Within a few weeks in 2026, two Linux kernel local privilege-escalation flaws were published that work the same way: CVE-2026-46331 (nicknamed "pedit COW") and CVE-2026-43503...
- OPNsense 26.1.8: Two Critical RCE Bugs (CVE-2026-44194 & 45158), Four Significant CVEs in Twelve DaysOn 12 May 2026 the OPNsense team shipped version 26.1.8 with patches for two critical remote code execution flaws. CVE-2026-44194 (CVSS 9.1, GitHub advisory GHSA-f59w-m967-9rf6)...
- cPanel CVE-2026-41940: 44,000 Servers Compromised — What Companies on Shared Hosting Need to Do NowA cPanel vulnerability that has been actively exploited since 23 February 2026 is officially disclosed on 28 April 2026. By 5 May, more than 44,000...
- Linux Kernel Vulnerabilities 2026: Why Patch Management Is Now a Board-Level Issue (Dirty Frag, Copy Fail & Co.)Three critical Local Privilege Escalation vulnerabilities in the Linux kernel within two weeks — all three sitting in the code for nine to twelve years....
- Proxmox Backup Server 4.2: S3 Storage Exits Tech Preview - What You Need to KnowWith Proxmox Backup Server 4.2 (released late April 2026), S3-compatible object storage is officially supported as a backup backend. No more tech preview label, no...
- CVSS 9.9, CVSS 10.0, 1.5M Servers Affected: Why Enterprises Need CVE MonitoringThree numbers from the last four months: - CVSS 9.9 — Jellyfin: Path Traversal → Remote Code Execution as Root - CVSS 10.0 — n8n:...
Reviews & projects
Proxmox proof from real projects
Customer feedback on virtualization, backup, VPN, security and ongoing cluster operations.
Networking & Provisioning
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
Read client reviews
Enquiry
Assess Proxmox security scope
Describe management access, network boundaries, and the current security posture.
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.