ProxmoxVEx is built with a defense-in-depth approach. It protects the control plane, the credentials it stores and the actions performed by every user.
Authentication
- Local accounts with Argon2id-hashed passwords.
- LDAP and OIDC single sign-on for enterprise identity providers.
- Time-based one-time passwords (TOTP) for two-factor authentication.
- FIDO2 / WebAuthn security-key support for phishing-resistant MFA.
- API tokens with granular scopes for automation and integrations.
Authorization
- Role-based access control (RBAC) maps users and groups to roles.
- Resource-level permissions restrict access to specific clusters, nodes, VMs, storage pools and networks.
- Tenant isolation keeps MSP and hosting customers logically separated.
Encryption
- Sensitive fields such as cluster credentials are encrypted at rest using Fernet field-level encryption.
- Database volume encryption is the operator’s responsibility at the infrastructure layer.
- All web traffic should be served over TLS in production.
Audit logging
- Every security-relevant action is recorded in a tamper-evident audit log protected by an HMAC signature.
- Administrators can search, filter and export audit events.
- Unusual activity can trigger alerts through the notification system.
Secrets management
- Integration with external secret stores such as HashiCorp Vault is available through plugins.
- API tokens can be rotated and revoked from the admin console.
- Service accounts support least-privilege access to ProxmoxVEx APIs.
Deployment hardening
- Run ProxmoxVEx behind a reverse proxy with TLS termination.
- Restrict network access to the application and database ports.
- Keep the host OS, PostgreSQL and Python dependencies patched.
- Use the included backup and disaster-recovery plugins to protect the ProxmoxVEx database.
Responsible disclosure
If you discover a security issue, please contact the maintainers of your ProxmoxVEx instance directly. Please do not disclose vulnerabilities publicly until a fix is available.