Skip to main content

Securing Your Server

Your Proxmox host is directly reachable on the internet, and its web interface and SSH are scanned constantly by automated bots. Take these steps in your first hour.

1. Change the root password​

Datacenter → Permissions → Users → root@pam → Password, or on the host:

cd /root
passwd

Use a long, unique password (20+ characters, ideally from a password manager).

2. Enable two-factor authentication​

Datacenter → Permissions → Two Factor → Add → TOTP

Scan the QR code with an authenticator app (e.g. Aegis, 2FAS, Google Authenticator, 1Password). From now on, logins to the web interface require a code.

:::warning Save recovery keys Also add Recovery Keys in the same menu and store them safely. Without them, losing your phone means losing access. :::

3. Use SSH keys​

From your own computer:

cd ~
ssh-copy-id root@YOUR-PUBLIC-IP

Once key login works, disable password login on the host:

cd /etc/ssh/sshd_config.d
echo "PasswordAuthentication no" > 10-no-passwords.conf
systemctl reload ssh

:::danger Test before you close the session Open a second SSH session with your key before closing the first one. If it fails, you still have the first session to fix it. :::

If you connect from fixed IP addresses (office, VPN), allow only those for SSH and the web interface.

  1. Datacenter → Firewall → IPSet → Create management, then add your own IP addresses.
  2. Datacenter → Firewall → Add rules:
DirectionActionSourceProtocolDest. port
inACCEPT+managementtcp8006
inACCEPT+managementtcp22
  1. Datacenter → Firewall → Options → Firewall: Yes

The Proxmox firewall drops other incoming traffic to the host, but always allows the IPs in the management IPSet.

:::danger Lock-out risk Double-check your IP (search "what is my IP") before enabling the firewall. If you lock yourself out, open a support ticket. :::

5. Keep it updated​

Node → Updates → Refresh, then Upgrade. Or on the host:

cd /root
apt update && apt full-upgrade -y

Reboot when a new kernel is installed. Check updates at least monthly.

:::info "No valid subscription" message At login, Proxmox shows a notice that you don't have a subscription. This is normal. Your server uses the free no-subscription update repository, which is fully functional. Subscriptions can be bought from Proxmox directly if you want enterprise support. :::

6. Back up your VMs​

Datacenter → Backup → Add to schedule automatic backups (e.g. nightly, mode Snapshot, compression ZSTD).

:::warning Backups on the same disk are not backups By default, backups are stored on the server itself (local). If the disk fails, they're gone too. Store copies off-server, e.g. on a Proxmox Backup Server or remote storage. Ask us about backup options. :::

7. Secure your VMs too​

Every VM with a port forward is reachable from the internet. Keep VM operating systems updated, use SSH keys inside VMs, and only forward the ports you actually need.

Was this page helpful?