proxguard

Active

You suspect your Proxmox host is soft in a few places, but "run the CIS Benchmark by hand" never happens. ProxGuard takes your actual config files, grades your posture A-to-F against 16 CIS-backed rules, and hands back a copy-paste fix for every failure.

GitHub repo →
$git clone https://github.com/lidless-labs/proxguard.git && cd proxguard && npm install && npm run dev
browser-onlyno data leaves the boxTypeScript 5

What it does

ProxGuard is a browser-based Proxmox VE security auditor: you paste your real config files (sshd_config, cluster.fw, user.cfg, storage.cfg, and the API token list) and it grades your security posture across six weighted categories, then generates a remediation script for every failed check. It exists because Proxmox hosts drift toward insecure defaults (root SSH, ACCEPT firewall policy, no 2FA) and nobody hand-walks the CIS Benchmark. What sets it apart: every rule traces to a CIS Debian 11 or Proxmox-specific standard, the whole audit runs client-side so no config ever leaves your machine, and it doubles as a firewall visualizer that flags shadowing, contradictions, and unreachable rules before they bite.

Capabilities16 rules across 6 scored categories

SSH hardening

4 rules

Root login, global password auth, default port 22, MaxAuthTries. Weighted 25%.

Firewall

3 rules

Cluster firewall enabled, default INPUT policy, rule existence. Weighted 25%.

Authentication

3 rules

2FA enrollment, root API tokens, overpermissive Administrator roles. Weighted 20%.

Container

2 rules

Privileged LXC containers and container nesting. Weighted 15%.

Storage

2 rules

NFS no_root_squash mounts and broad CIFS permissions. Weighted 10%.

API tokens

2 rules

Full-admin token privileges and tokens without expiration. Weighted 5%.

Firewall conflict detection

5 types

Shadowing, contradictions, unreachable rules, port overlap, protocol mismatch, with drag-drop reordering.

Full tool reference on GitHub →

Setup

01 · install
git clone https://github.com/lidless-labs/proxguard.git && cd proxguard && npm install && npm run dev
02 · configure

No env or backend to configure. Requires Node 20+. Open http://localhost:5190, go to the Audit tab, and paste your Proxmox config files (or load a built-in demo config).

03 · config files it reads
/etc/ssh/sshd_config
/etc/pve/firewall/cluster.fw
/etc/pve/user.cfg
/etc/pve/storage.cfg
pveum apitoken list

Safety

how it stays safe
Everything runs client-side in the browser. Pasted config files are parsed in-page and never sent to any server, so credentials, firewall layouts, and token lists stay on your machine. The tool is read-only: it grades and generates remediation scripts for you to run yourself, it never touches or writes to the Proxmox host.

More in Homelab5 tools

proxmox-mcpOperate Proxmox VMs, containers, and nodes from your agent, every write gated. adguardctrlRun AdGuard Home DNS filtering from shells and agents, destructive writes gated. jellyctrlDrive Jellyfin libraries, sessions, and users from a CLI or MCP, writes gated. immichctrlOne typed control surface for Immich: search, albums, and duplicate audits. samba-ad-migrationAutomated migration of a Windows AD file share to Samba on Proxmox, with Winbind domain join and permission-preserving data copy.