proxguard

Active

You suspect your Proxmox host is soft in a few places, but "run the CIS Benchmark by hand" never happens. ProxGuard takes your actual config files, grades your posture A-to-F against 16 CIS-backed rules, and hands back a copy-paste fix for every failure.

GitHub repo →

16 CIS-backed rules6 scored categoriesbrowser-onlyno data leaves the boxTypeScript 5MIT

What it does

ProxGuard is a browser-based Proxmox VE security auditor: you paste your real config files (sshd_config, cluster.fw, user.cfg, storage.cfg, and the API token list) and it grades your security posture across six weighted categories, then generates a remediation script for every failed check. It exists because Proxmox hosts drift toward insecure defaults (root SSH, ACCEPT firewall policy, no 2FA) and nobody hand-walks the CIS Benchmark. What sets it apart: every rule traces to a CIS Debian 11 or Proxmox-specific standard, the whole audit runs client-side so no config ever leaves your machine, and it doubles as a firewall visualizer that flags shadowing, contradictions, and unreachable rules before they bite.

Capabilities

16 rules across 6 scored categories

SSH hardening4 rules

Root login, global password auth, default port 22, MaxAuthTries. Weighted 25%.

Firewall3 rules

Cluster firewall enabled, default INPUT policy, rule existence. Weighted 25%.

Authentication3 rules

2FA enrollment, root API tokens, overpermissive Administrator roles. Weighted 20%.

Container2 rules

Privileged LXC containers and container nesting. Weighted 15%.

Storage2 rules

NFS no_root_squash mounts and broad CIFS permissions. Weighted 10%.

API tokens2 rules

Full-admin token privileges and tokens without expiration. Weighted 5%.

Firewall conflict detection5 types

Shadowing, contradictions, unreachable rules, port overlap, protocol mismatch, with drag-drop reordering.

Full reference on GitHub →

Set it up

git clone https://github.com/lidless-labs/proxguard.git && cd proxguard && npm install && npm run dev

No env or backend to configure. Requires Node 20+. Open http://localhost:5190, go to the Audit tab, and paste your Proxmox config files (or load a built-in demo config).

Config files it reads

/etc/ssh/sshd_config
/etc/pve/firewall/cluster.fw
/etc/pve/user.cfg
/etc/pve/storage.cfg
pveum apitoken list

[ shield ]

Everything runs client-side in the browser. Pasted config files are parsed in-page and never sent to any server, so credentials, firewall layouts, and token lists stay on your machine. The tool is read-only: it grades and generates remediation scripts for you to run yourself, it never touches or writes to the Proxmox host.

CIS-backed rules

scored categories

conflict types

bytes leave the browser

MIT

license