proxmox host baseline: lock down the thing running every vm you own
why your proxmox host is the softest target in your homelab
think about what proxmox actually is for a second. it's not just "a vm." it's the thing underneath every vm. your pihole, your nas, your game server, that one container you forgot about running since 2022, all of it sits on top of a single host. if someone gets into that host, they don't get one box, they get all of them at once. and yet most homelab proxmox installs are running on default root login, no 2fa, and a web ui sitting wide open on the network like it's no big deal. it is a big deal. let's fix it.
stop logging in as root@pam
root@pam is the built-in proxmox admin account, and it's the first thing anyone probes for because every proxmox box has one by default. using it daily means every action in your logs just says "root did this," which tells you nothing if you're trying to figure out what happened later, or if you're sharing access with anyone else.
create a named user instead. something like yourname@pve. now every login, every backup job, every config change ties back to an actual identity instead of a generic superuser. this matters more than it sounds like it does, because audit trails are useless if everything says "root."
give that user the pveadmin role, not blanket root
proxmox has role-based access control built in. the pveadmin role gives your named account full administrative capability without you needing to touch root@pam for day to day work. the point isn't that pveadmin is weaker, it's that it's scoped, logged, and attributable. root@pam should basically become an emergency break-glass account you rarely touch, ideally with a long random password you store somewhere safe, not something you type every morning with coffee in hand.
turn on totp for every account, no exceptions
password-only auth on an admin panel in 2024 is like leaving your front door unlocked because you trust the neighborhood. proxmox supports TOTP two-factor natively, no extra plugins needed. go into datacenter, then users, then the account, and enable TOTP. use an authenticator app, scan the qr code, save your recovery codes somewhere that isn't a screenshot on your desktop.
do this for every account on the box, not just your main one. a lab with five users and one of them unprotected is still a lab with zero protection, because attackers go for the weakest door, not the strongest one.
keep the web ui off the open internet
the proxmox web interface runs on port 8006, and it is not meant to be internet-facing. ever. if you can hit your proxmox login page from a coffee shop wifi without a vpn, that's an exposure, not a convenience.
lock it down two ways. first, keep it on your lan only, no port forwarding 8006 on your router, period. second, if you need remote access, put it behind a vpn like wireguard or tailscale so you're authenticating to your own network before you ever see the proxmox login screen. that's a second lock on the door, and it means a leaked password alone isn't enough to get in.
you can check right now whether your port is exposed from outside your network:
nmap -p 8006 your.public.ipif that comes back open from outside your lan, go fix your router's port forwarding rules today, not this weekend.
schedule vzdump backups like you mean it
all the access control in the world doesn't help if a bad update, a failed disk, or a ransomware event wipes your vms and you have no backup. proxmox's built-in vzdump tool handles scheduled backups of every vm and container, and you set it once in datacenter, then backup, pick your storage target, pick your schedule, done.
the part people skip is sending those backups somewhere that isn't the same physical box. a backup stored on the same host it's protecting isn't a backup, it's a copy that dies with the original. push it to a nas, an external drive, or offsite storage so a host failure doesn't take your backups down with it.
the takeaway
proxmox runs every vm you own, which means it deserves the same hardening attention you'd give a production server, not whatever default state the installer left it in. named admin account, scoped pveadmin role, totp on everything, web ui locked to lan or vpn, and backups going somewhere offsite. none of this takes more than an afternoon, and it's the difference between a homelab that's resilient and one that's one leaked password away from losing everything at once.