HorlogeSkynet/blog
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Adds rpc-statd-notify.service disabling to Proxmox hardening guide

Browse Source
This commit is contained in:
Samuel FORESTIER
2024-12-21 17:18:23 +01:00
parent 7d93410206
commit a563010462
1 changed files with 4 additions and 3 deletions

7
_posts/2019-01-11-hardening-proxmox-some-in-one-place.md

@ -1,6 +1,7 @@
---
title: "Hardening Proxmox, some in one place"
date: 2019-01-11
last_modified_at: 2024-12-21 17:17
url: hardening-proxmox-some-in-one-place
layout: post
category: Security
@ -59,10 +60,10 @@ NEED_STATD=no
You can also disable **RPC** services :
{% highlight bash %}
systemctl disable --now rpcbind.service rpcbind.socket
systemctl disable --now rpcbind.service rpcbind.socket rpc-statd-notify.service
{% endhighlight %}
You only have to `reboot` now, and you will be able to verify the sockets that are listening with `ss -atlnup` :wink:
You only have to `reboot` now, and you will be able to verify the sockets that are listening with `ss -atlnup` :wink:
#### IPv6 sockets
@ -92,7 +93,7 @@ systemctl restart ssh.service
#### PVEProxy TLS certificate
If you consider administrating your Proxmox instance from the **WEB GUI** over an insecure network (as Internet), you really should consider using a signed certificate, to prevent MITM attacks.
If you consider administrating your Proxmox instance from the **Web GUI** over an insecure network (as Internet), you really should consider using a signed certificate, to prevent MITM attacks.
For this, you can follow the official [ACME documentation](https://pve.proxmox.com/wiki/Certificate_Management).
### Conclusion