Hardening Compliance
The Compliance page evaluates your Proxmox infrastructure against security hardening best practices. It identifies misconfigurations, insecure defaults, and deviations from security frameworks, giving you a clear picture of your security posture.
Overview
ProxCenter runs automated compliance checks against your Proxmox nodes, VMs, and cluster configuration. Each check produces a pass, fail, or warning result with a description of what was tested, why it matters, and how to remediate failures.
Results are grouped by category and presented as an overall compliance score per node and per cluster.
Check Categories
| Category | Examples |
|---|---|
| SSH Hardening | Root login disabled, key-only authentication, protocol version |
| Kernel Parameters | ASLR enabled, SYN cookies, IP forwarding settings |
| Filesystem | Noexec on /tmp, proper mount options, world-writable files |
| Authentication | Password complexity, account lockout, PAM configuration |
| Network | Unnecessary open ports, firewall enabled, ICMP settings |
| Proxmox-Specific | Two-factor authentication, API token permissions, cluster encryption |
| TLS/Certificates | Certificate expiry, cipher strength, self-signed certificate detection |
Running Compliance Scans
- Navigate to Security > Compliance
- Select the target nodes or clusters to scan
- Click Run Scan -- ProxCenter connects via SSH and evaluates each check
- Results appear in real time as checks complete
Scans can also be scheduled to run automatically (e.g., daily or weekly) with results stored for trend analysis.
Results Dashboard
The compliance dashboard shows:
- Overall score -- Percentage of checks passing across all scanned nodes
- Per-node breakdown -- Drill into each node to see its individual results
- Trend chart -- Track compliance improvement or regression over time
- Severity distribution -- Critical, high, medium, and low findings
Remediation Guidance
Each failed check includes:
- A description of the security risk
- The expected configuration value
- The actual value found on the node
- Step-by-step remediation instructions
Framework Mapping
The Frameworks tab of Security > Compliance reads the same hardening checks through recognised control catalogues, so a finding reads as the control it breaks and not only as a Proxmox setting. Pick a cluster and you get one card per framework, each with a score, the number of controls assessed, a per-node breakdown, and a Download report (PDF) button.
| Framework | Version | Catalogue size |
|---|---|---|
| NIST SP 800-53 | Rev 5, Moderate baseline | 287 controls |
| NIST SP 800-171 | Rev 2 | 110 controls |
| CMMC | Level 2 | 110 practices |
| ISO/IEC 27001 | 2022 | 93 Annex A controls |
| CIS Controls | v8.1 | 153 safeguards under 18 controls |
CIS Controls v8.1 joined the tab in v1.4.7. The card carries all 18 top-level controls and their 153 safeguards, of which 30 are currently crosswalked to a ProxCenter hardening check; the score is the pass rate over those. Only safeguard identifiers and short titles are shown, because the CIS descriptive text is copyright of the Center for Internet Security and is not reproduced in the product.
Framework scoring ignores the profile and the weighting used by the Hardening tab: every check runs, and each framework is scored on the checks that map to it.
A framework score is a technical pass rate over the controls ProxCenter is able to assess. Treat it as a posture indicator and as evidence for an audit, never as a certification.
Compliance checks require SSH access to the Proxmox nodes. Ensure SSH connections are configured in Settings > Connections before running a scan.
Hardening Compliance is available in the Enterprise edition.
Permissions
| Permission | Description |
|---|---|
security.view | View compliance scan results |
security.manage | Run compliance scans and configure schedules |