LinuxinfrastructureTested on real hardware

Proxmox VE Post-Install Hardening

Essential post-install steps for a new Proxmox VE node: remove the subscription nag, switch to the free repo, disable the enterprise repo, update the system, and fix storage.

Distrosproxmox, debian
Shellbash
Updated
Script
bash
# 1. Disable enterprise (paid) repository
echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription" \
  > /etc/apt/sources.list.d/pve-community.list
sed -i 's/^deb/#deb/' /etc/apt/sources.list.d/pve-enterprise.list 2>/dev/null || true
sed -i 's/^deb/#deb/' /etc/apt/sources.list.d/ceph.list 2>/dev/null || true

# 2. Remove subscription nag from the web UI
sed -i.bak "s/NotFound/Active/g" \
  /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js

# 3. Update all packages
apt-get update && apt-get dist-upgrade -y

# 4. Install useful tools
apt-get install -y \
  sudo curl wget git htop iotop ncdu \
  net-tools nmap dnsutils \
  qemu-guest-agent

# 5. Disable IPv6 if not in use (optional — comment out if you use it)
echo "net.ipv6.conf.all.disable_ipv6 = 1" >> /etc/sysctl.d/99-proxmox.conf
sysctl -p /etc/sysctl.d/99-proxmox.conf

# 6. Set timezone
timedatectl set-timezone America/New_York

echo ""
echo "Done. Reboot recommended: reboot"

What this does

Prepares a freshly installed Proxmox VE node for homelab use:

  1. Switches to the community (free) repo — the enterprise repo requires a paid subscription and will block updates otherwise
  2. Removes the subscription nag popup that appears on every login (UI-only change, no functionality impact)
  3. Runs a full system update via dist-upgrade
  4. Installs common tools useful for day-to-day administration
  5. Optionally disables IPv6 to reduce attack surface if you’re not using it
  6. Sets the timezone

Prerequisites

  • Fresh Proxmox VE 8.x install (Debian 12 “Bookworm” base)
  • Root access (SSH or console)
  • Internet connectivity from the node

Set your timezone

Replace America/New_York with your zone. Find yours:

timedatectl list-timezones | grep Your_Region

Harden SSH on the Proxmox node

Proxmox uses the standard Debian sshd. Apply the SSH hardening playbook after this one.

Notes

  • Run as root directly — Proxmox nodes don’t use sudo by default
  • The nag patch modifies /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js; a .bak backup is created automatically. It will revert after a proxmox-widget-toolkit package update — reapply the sed line if needed
  • qemu-guest-agent enables memory/disk reporting from within VMs that have it installed; harmless if you only run LXC containers
  • Ceph enterprise repo is also disabled — if you use Ceph, re-enable the community Ceph repo separately
All playbooks