密码都不用就能登root？PVE爆出严重认证绕过漏洞（CVE-2023-54391），一文教你把Proxmox安全彻底焊死！

dpkg-query -W libpve-access-control

grep "POST /api2/json/access/ticket" /var/log/pveproxy/access.log*

# 彻底禁用密码登录，仅允许高强度私钥认证
PasswordAuthentication no
PermitRootLogin prohibit-password
# 推荐改用 Ed25519 纯密钥对
PubkeyAuthentication yes

# 注释掉默认企业源
sed -i 's/^deb/#deb/' /etc/apt/sources.list.d/pve-enterprise.list

# 添加官方无订阅稳定更新源 (以 Bookworm 为例)
cat << 'EOF' > /etc/apt/sources.list.d/pve-no-subscription.list
deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription
EOF

apt update

pve7to8 --full

#!/usr/bin/env bash
# ==============================================================================
# Proxmox VE Automated Security Audit & Hardening Toolkit (Ubuntu 26.04 / Linux)
# ==============================================================================
# Focus: CVE-2023-54391 Auth Bypass Detection, Port 8006 Audit & Backdoor Hunting
# Zero third-party dependencies. Supports Human CLI and Headless AI Agent modes.
# ==============================================================================
set -euo pipefail

TARGET_HOST=""
TARGET_USER="root"
TARGET_PORT="22"
TARGET_KEY=""
LOCAL_MODE=false
FORMAT="text"

while [[ $# -gt 0 ]]; do
    case "$1" in
        --host) TARGET_HOST="$2"; shift 2 ;;
        --user) TARGET_USER="$2"; shift 2 ;;
        --port) TARGET_PORT="$2"; shift 2 ;;
        --key)  TARGET_KEY="$2"; shift 2 ;;
        --local) LOCAL_MODE=true; shift ;;
        --format) FORMAT="$2"; shift 2 ;;
        --agent) FORMAT="json"; shift ;;
        *) echo "Unknown argument: $1" >&2; exit 1 ;;
    esac
done

if [[ "$LOCAL_MODE" == false && -z "$TARGET_HOST" ]]; then
    echo "[ERROR] Either --host <target> or --local must be specified." >&2
    exit 1
fi

run_cmd() {
    local cmd="$1"
    if [[ "$LOCAL_MODE" == true ]]; then
        eval "$cmd" 2>/dev/null || true
    else
        local ssh_opts=("-p" "$TARGET_PORT" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=accept-new" "-o" "ConnectTimeout=8")
        [[ -n "$TARGET_KEY" ]] && ssh_opts+=("-i" "$TARGET_KEY")
        ssh "${ssh_opts[@]}" "${TARGET_USER}@${TARGET_HOST}" "$cmd" 2>/dev/null || true
    fi
}

log() {
    local level="$1"; shift
    [[ "$FORMAT" != "json" ]] && echo "[$(date '+%Y-%m-%d %H:%M:%S')] [$level] $*"
}

log "INFO" "Starting Proxmox VE Security Audit on ${TARGET_HOST:-localhost}..."

# 1. Audit libpve-access-control version
PKG_VER="$(run_cmd "dpkg-query -W -f='\${Version}' libpve-access-control" | tr -d ' \r\n')"
if [[ -z "$PKG_VER" ]]; then
    PKG_VER="not-installed"; VER_STATUS="UNKNOWN"
else
    if dpkg --compare-versions "$PKG_VER" "ge" "8.0.4" 2>/dev/null; then
        VER_STATUS="PASS"
    else
        VER_STATUS="CRITICAL_VULNERABLE"
    fi
fi

# 2. Check PVE Release & EOL Status
PVE_MGR_VER="$(run_cmd "pveversion" | head -n 1 | tr -d '\r\n')"
if echo "$PVE_MGR_VER" | grep -q "pve-manager/7\."; then
    RELEASE_STATUS="EOL_WARNING"
elif echo "$PVE_MGR_VER" | grep -q "pve-manager/8\."; then
    RELEASE_STATUS="SUPPORTED"
else
    RELEASE_STATUS="UNKNOWN"
fi

# 3. Check Port 8006 Exposure
LISTEN_8006="$(run_cmd "ss -tulpn | grep -E ':8006\\b'" || true)"
PORT_BIND="RESTRICTED_OR_ABSENT"
echo "$LISTEN_8006" | grep -q "0.0.0.0:8006" && PORT_BIND="ALL_INTERFACES"

# 4. Check 2FA Status for root@pam
TFA_CHECK="$(run_cmd "grep -E '^user:root@pam:' /etc/pve/user.cfg" || true)"
TFA_STATUS="DISABLED"
echo "$TFA_CHECK" | grep -q "tfa=" && TFA_STATUS="ACTIVE"

# 5. Check pveproxy access log for exploit attempts
LOG_EXPLOIT_HITS="$(run_cmd "grep -c 'POST /api2/json/access/ticket' /var/log/pveproxy/access.log 2>/dev/null" || echo "0")"
LOG_EXPLOIT_HITS="${LOG_EXPLOIT_HITS//[^0-9]/}"
LOG_EXPLOIT_HITS="${LOG_EXPLOIT_HITS:-0}"

# 6. Check Persistence: authorized_keys, crontabs, ld.so.preload
AUTH_KEYS_COUNT="$(run_cmd "wc -l < /root/.ssh/authorized_keys 2>/dev/null" || echo "0")"
AUTH_KEYS_COUNT="${AUTH_KEYS_COUNT//[^0-9]/}"
AUTH_KEYS_COUNT="${AUTH_KEYS_COUNT:-0}"

CRON_SUSPICIOUS="$(run_cmd "grep -rnE '(curl|wget|bash|sh|python|\.sh)' /etc/cron* /var/spool/cron/crontabs/ 2>/dev/null | grep -vE '(pve|proxmox|certbot)' | wc -l" || echo "0")"
CRON_SUSPICIOUS="${CRON_SUSPICIOUS//[^0-9]/}"
CRON_SUSPICIOUS="${CRON_SUSPICIOUS:-0}"

LD_PRELOAD_EXISTS=false
run_cmd "test -f /etc/ld.so.preload" >/dev/null 2>&1 && LD_PRELOAD_EXISTS=true

# Compute Overall Health Score (0 - 100)
SCORE=100
[[ "$VER_STATUS" == "CRITICAL_VULNERABLE" ]] && SCORE=$((SCORE - 45))
[[ "$RELEASE_STATUS" == "EOL_WARNING" ]] && SCORE=$((SCORE - 20))
[[ "$TFA_STATUS" == "DISABLED" ]] && SCORE=$((SCORE - 15))
[[ "$PORT_BIND" == "ALL_INTERFACES" ]] && SCORE=$((SCORE - 10))
[[ "$LD_PRELOAD_EXISTS" == true ]] && SCORE=$((SCORE - 50))
(( CRON_SUSPICIOUS > 0 )) && SCORE=$((SCORE - 20))
(( SCORE < 0 )) && SCORE=0

GRADE="A"
if (( SCORE < 50 )); then GRADE="D (CRITICAL)"
elif (( SCORE < 70 )); then GRADE="C (RISK)"
elif (( SCORE < 85 )); then GRADE="B (WARNING)"
elif (( SCORE == 100 )); then GRADE="S (HARDENED)"
fi

if [[ "$FORMAT" == "json" ]]; then
    cat << JSON
{
  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "target": "${TARGET_HOST:-localhost}",
  "score": $SCORE,
  "grade": "$GRADE",
  "audit": {
    "libpve_access_control_version": "$PKG_VER",
    "version_status": "$VER_STATUS",
    "pve_release": "$PVE_MGR_VER",
    "release_status": "$RELEASE_STATUS",
    "port_8006_binding": "$PORT_BIND",
    "root_2fa_status": "$TFA_STATUS",
    "pveproxy_ticket_requests": $LOG_EXPLOIT_HITS,
    "authorized_keys_count": $AUTH_KEYS_COUNT,
    "suspicious_crontabs": $CRON_SUSPICIOUS,
    "ld_so_preload_detected": $LD_PRELOAD_EXISTS
  }
}
JSON
else
    echo "================================================================================"
    echo "PROXMOX VE SECURITY AUDIT REPORT: CVE-2023-54391 & HARDENING ASSESSMENT"
    echo "================================================================================"
    echo "Target Host             : ${TARGET_HOST:-localhost} (Port: $TARGET_PORT, User: $TARGET_USER)"
    echo "Overall Score           : $SCORE / 100 [Grade: $GRADE]"
    echo "--------------------------------------------------------------------------------"
    echo "1. libpve-access-control: $PKG_VER [$VER_STATUS]"
    echo "2. Proxmox OS Release   : $PVE_MGR_VER [$RELEASE_STATUS]"
    echo "3. Port 8006 Listener   : $PORT_BIND"
    echo "4. root@pam 2FA Status  : $TFA_STATUS"
    echo "5. pveproxy Ticket Hits : $LOG_EXPLOIT_HITS records"
    echo "6. root SSH Keys        : $AUTH_KEYS_COUNT key(s) installed"
    echo "7. Suspicious Cron Jobs : $CRON_SUSPICIOUS item(s)"
    echo "8. ld.so.preload Hook   : $( [[ "$LD_PRELOAD_EXISTS" == true ]] && echo "DETECTED (DANGER!)" || echo "Clean" )"
    echo "================================================================================"
fi

# 本地在 PVE 节点上执行：
sudo bash pve_security_toolkit_ubuntu2604.sh --local

# 从 Ubuntu 客户端远程扫描：
bash pve_security_toolkit_ubuntu2604.sh --host 192.168.X.X --user root

# Agent 静默调用获取结构化 JSON 报告，判定是否需触发自动化防御流程：
AGENT_REPORT=$(bash pve_security_toolkit_ubuntu2604.sh --host 192.168.X.X --agent)
echo "$AGENT_REPORT" | jq '.score'

#!/usr/bin/env zsh
# ==============================================================================
# Proxmox VE Automated Security Audit & Hardening Toolkit (macOS 26 / Zsh)
# ==============================================================================
# Focus: CVE-2023-54391 Remote Inspection, Port 8006 Probing & Compromise Audit
# Zero third-party dependencies. Compatible with Apple Silicon and Intel Macs.
# ==============================================================================
set -eu

TARGET_HOST=""
TARGET_USER="root"
TARGET_PORT="22"
TARGET_KEY=""
FORMAT="text"

while [[ $# -gt 0 ]]; do
    case "$1" in
        --host)   TARGET_HOST="$2"; shift 2 ;;
        --user)   TARGET_USER="$2"; shift 2 ;;
        --port)   TARGET_PORT="$2"; shift 2 ;;
        --key)    TARGET_KEY="$2"; shift 2 ;;
        --format) FORMAT="$2"; shift 2 ;;
        --agent)  FORMAT="json"; shift ;;
        *) echo "Unknown argument: $1" >&2; exit 1 ;;
    esac
done

if [[ -z "$TARGET_HOST" ]]; then
    echo "[ERROR] Target host must be specified via --host <IP/Host>." >&2
    exit 1
fi

run_ssh() {
    local cmd="$1"
    local ssh_opts=(-p "$TARGET_PORT" -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8)
    [[ -n "$TARGET_KEY" ]] && ssh_opts+=(-i "$TARGET_KEY")
    ssh "${ssh_opts[@]}" "${TARGET_USER}@${TARGET_HOST}" "$cmd" 2>/dev/null || true
}

log() {
    local level="$1"; shift
    [[ "$FORMAT" != "json" ]] && echo "[$(date '+%Y-%m-%d %H:%M:%S')] [$level] $*"
}

log "INFO" "Probing target Proxmox host: $TARGET_HOST (Port: $TARGET_PORT)..."

# 1. Check libpve-access-control
PKG_VER="$(run_ssh "dpkg-query -W -f='\${Version}' libpve-access-control" | tr -d ' \r\n')"
if [[ -z "$PKG_VER" ]]; then
    PKG_VER="unknown"; VER_STATUS="NOT_DETECTED"
else
    if [[ "$PKG_VER" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+) ]]; then
        V_MAJ="${match[1]}"; V_MIN="${match[2]}"; V_REV="${match[3]}"
        if (( V_MAJ > 8 )) || (( V_MAJ == 8 && V_MIN > 0 )) || (( V_MAJ == 8 && V_MIN == 0 && V_REV >= 4 )); then
            VER_STATUS="PASS"
        else
            VER_STATUS="CRITICAL_VULNERABLE"
        fi
    elif [[ "$PKG_VER" =~ ^7\. ]]; then
        VER_STATUS="CRITICAL_VULNERABLE"
    else
        VER_STATUS="PASS"
    fi
fi

# 2. Check PVE Release
PVE_MGR="$(run_ssh "pveversion" | head -n 1 | tr -d '\r\n')"
RELEASE_STATUS="UNKNOWN"
[[ "$PVE_MGR" == *"pve-manager/7."* ]] && RELEASE_STATUS="EOL_WARNING"
[[ "$PVE_MGR" == *"pve-manager/8."* ]] && RELEASE_STATUS="SUPPORTED"

# 3. Check 2FA
TFA_CHECK="$(run_ssh "grep -E '^user:root@pam:' /etc/pve/user.cfg" || true)"
TFA_STATUS="DISABLED"
[[ "$TFA_CHECK" == *"tfa="* ]] && TFA_STATUS="ACTIVE"

# 4. Check Access Logs
LOG_HITS="$(run_ssh "grep -c 'POST /api2/json/access/ticket' /var/log/pveproxy/access.log 2>/dev/null" || echo "0")"
LOG_HITS="${LOG_HITS//[^0-9]/}"
LOG_HITS="${LOG_HITS:-0}"

# 5. Check Persistence
AUTH_KEYS="$(run_ssh "wc -l < /root/.ssh/authorized_keys 2>/dev/null" || echo "0")"
AUTH_KEYS="${AUTH_KEYS//[^0-9]/}"
AUTH_KEYS="${AUTH_KEYS:-0}"

LD_PRELOAD=false
run_ssh "test -f /etc/ld.so.preload" >/dev/null 2>&1 && LD_PRELOAD=true

# Scorecard
SCORE=100
[[ "$VER_STATUS" == "CRITICAL_VULNERABLE" ]] && (( SCORE -= 45 ))
[[ "$RELEASE_STATUS" == "EOL_WARNING" ]] && (( SCORE -= 20 ))
[[ "$TFA_STATUS" == "DISABLED" ]] && (( SCORE -= 15 ))
[[ "$LD_PRELOAD" == true ]] && (( SCORE -= 50 ))
(( SCORE < 0 )) && SCORE=0

GRADE="A"
if (( SCORE < 50 )); then GRADE="D (CRITICAL)"
elif (( SCORE < 70 )); then GRADE="C (RISK)"
elif (( SCORE < 85 )); then GRADE="B (WARNING)"
elif (( SCORE == 100 )); then GRADE="S (HARDENED)"
fi

if [[ "$FORMAT" == "json" ]]; then
    cat << JSON
{
  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "target": "$TARGET_HOST",
  "score": $SCORE,
  "grade": "$GRADE",
  "audit": {
    "libpve_access_control_version": "$PKG_VER",
    "version_status": "$VER_STATUS",
    "pve_release": "$PVE_MGR",
    "release_status": "$RELEASE_STATUS",
    "root_2fa_status": "$TFA_STATUS",
    "pveproxy_ticket_requests": $LOG_HITS,
    "authorized_keys_count": $AUTH_KEYS,
    "ld_so_preload_detected": $LD_PRELOAD
  }
}
JSON
else
    echo "================================================================================"
    echo "PROXMOX VE SECURITY AUDIT REPORT: macOS 26 Remote Inspection"
    echo "================================================================================"
    echo "Target Host             : $TARGET_HOST (Port: $TARGET_PORT, User: $TARGET_USER)"
    echo "Overall Security Score  : $SCORE / 100 [Grade: $GRADE]"
    echo "--------------------------------------------------------------------------------"
    echo "1. libpve-access-control: $PKG_VER [$VER_STATUS]"
    echo "2. Proxmox OS Release   : $PVE_MGR [$RELEASE_STATUS]"
    echo "3. root@pam 2FA Status  : $TFA_STATUS"
    echo "4. pveproxy Ticket Hits : $LOG_HITS records"
    echo "5. root SSH Keys Count  : $AUTH_KEYS key(s)"
    echo "6. ld.so.preload Hook   : $( [[ "$LD_PRELOAD" == true ]] && echo "DETECTED (DANGER!)" || echo "Clean" )"
    echo "================================================================================"
fi

zsh pve_security_toolkit_macos26.zsh --host pve-node.lan --user root

# Agent 自动抓取审计结果并判断是否通过：
zsh pve_security_toolkit_macos26.zsh --host pve-node.lan --agent | jq -r '.grade'

# ==============================================================================
# Proxmox VE Automated Security Audit & Hardening Toolkit (Windows 11 / PowerShell)
# ==============================================================================
# Focus: CVE-2023-54391 Remote Inspection, Port 8006 Auditing & Backdoor Hunting
# Zero third-party dependencies. Compatible with Windows 11 Windows Terminal / PS 7.x / 5.1.
# ==============================================================================
[CmdletBinding()]
param (
    [Parameter(Mandatory = $true, Position = 0)]
    [string]$HostName,

    [Parameter(Mandatory = $false)]
    [string]$User = "root",

    [Parameter(Mandatory = $false)]
    [int]$Port = 22,

    [Parameter(Mandatory = $false)]
    [string]$KeyPath = "",

    [Parameter(Mandatory = $false)]
    [ValidateSet("text", "json")]
    [string]$Format = "text",

    [Parameter(Mandatory = $false)]
    [switch]$Agent
)

if ($Agent) { $Format = "json" }

function Invoke-RemotePveCommand {
    param([string]$Command)
    $sshArgs = @("-p", $Port, "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=accept-new", "-o", "ConnectTimeout=8")
    if ($KeyPath -and (Test-Path $KeyPath)) { $sshArgs += @("-i", $KeyPath) }
    $sshArgs += @("$User@$HostName", $Command)
    try {
        $res = & ssh.exe $sshArgs 2>$null
        return ($res -join "`n").Trim()
    } catch { return "" }
}

if ($Format -ne "json") {
    Write-Host "[INFO] Initiating Proxmox VE Security Audit for $HostName (Port $Port)..." -ForegroundColor Cyan
}

# 1. Check libpve-access-control
$pkgVer = Invoke-RemotePveCommand "dpkg-query -W -f='`${Version}' libpve-access-control"
$verStatus = "UNKNOWN"
if ($pkgVer) {
    if ($pkgVer -match '^([0-9]+)\.([0-9]+)\.([0-9]+)') {
        $maj = [int]$Matches[1]; $min = [int]$Matches[2]; $rev = [int]$Matches[3]
        if (($maj -gt 8) -or ($maj -eq 8 -and $min -gt 0) -or ($maj -eq 8 -and $min -eq 0 -and $rev -ge 4)) {
            $verStatus = "PASS"
        } else { $verStatus = "CRITICAL_VULNERABLE" }
    } elseif ($pkgVer -like "7.*") { $verStatus = "CRITICAL_VULNERABLE" }
    else { $verStatus = "PASS" }
}

# 2. Check PVE Release
$pveMgr = Invoke-RemotePveCommand "pveversion"
$releaseStatus = "UNKNOWN"
if ($pveMgr -like "*pve-manager/7.*") { $releaseStatus = "EOL_WARNING" }
elseif ($pveMgr -like "*pve-manager/8.*") { $releaseStatus = "SUPPORTED" }

# 3. Check 2FA
$tfaRaw = Invoke-RemotePveCommand "grep -E '^user:root@pam:' /etc/pve/user.cfg"
$tfaStatus = if ($tfaRaw -like "*tfa=*") { "ACTIVE" } else { "DISABLED" }

# 4. Check Access Logs
$logHits = Invoke-RemotePveCommand "grep -c 'POST /api2/json/access/ticket' /var/log/pveproxy/access.log 2>/dev/null"
$logHits = ($logHits -replace '[^0-9]', '')
if (-not $logHits) { $logHits = "0" }

# 5. Check Persistence
$authKeys = Invoke-RemotePveCommand "wc -l < /root/.ssh/authorized_keys 2>/dev/null"
$authKeys = ($authKeys -replace '[^0-9]', '')
if (-not $authKeys) { $authKeys = "0" }

$ldPreload = Invoke-RemotePveCommand "test -f /etc/ld.so.preload && echo 'YES' || echo 'NO'"
$ldPreloadExists = ($ldPreload -eq "YES")

# Scorecard
$score = 100
if ($verStatus -eq "CRITICAL_VULNERABLE") { $score -= 45 }
if ($releaseStatus -eq "EOL_WARNING") { $score -= 20 }
if ($tfaStatus -eq "DISABLED") { $score -= 15 }
if ($ldPreloadExists) { $score -= 50 }
if ($score -lt 0) { $score = 0 }

$grade = "A"
if ($score -lt 50) { $grade = "D (CRITICAL)" }
elseif ($score -lt 70) { $grade = "C (RISK)" }
elseif ($score -lt 85) { $grade = "B (WARNING)" }
elseif ($score -eq 100) { $grade = "S (HARDENED)" }

if ($Format -eq "json") {
    [PSCustomObject]@{
        timestamp = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
        target = $HostName
        score = $score
        grade = $grade
        audit = [PSCustomObject]@{
            libpve_access_control_version = $pkgVer
            version_status = $verStatus
            pve_release = $pveMgr
            release_status = $releaseStatus
            root_2fa_status = $tfaStatus
            pveproxy_ticket_requests = [int]$logHits
            authorized_keys_count = [int]$authKeys
            ld_so_preload_detected = $ldPreloadExists
        }
    } | ConvertTo-Json -Depth 5
} else {
    Write-Host "================================================================================" -ForegroundColor Gray
    Write-Host "PROXMOX VE SECURITY AUDIT REPORT: Windows 11 PowerShell Diagnostic" -ForegroundColor White
    Write-Host "================================================================================" -ForegroundColor Gray
    Write-Host "Target Host             : $HostName (Port: $Port, User: $User)"
    Write-Host "Overall Security Score  : $score / 100 [Grade: $grade]"
    Write-Host "--------------------------------------------------------------------------------" -ForegroundColor Gray
    Write-Host "1. libpve-access-control: $pkgVer [$verStatus]"
    Write-Host "2. Proxmox OS Release   : $pveMgr [$releaseStatus]"
    Write-Host "3. root@pam 2FA Status  : $tfaStatus"
    Write-Host "4. pveproxy Ticket Hits : $logHits records"
    Write-Host "5. root SSH Keys Count  : $authKeys key(s)"
    Write-Host "6. ld.so.preload Hook   : $(if ($ldPreloadExists) { 'DETECTED (DANGER!)' } else { 'Clean' })"
    Write-Host "================================================================================" -ForegroundColor Gray
}

.\pve_security_toolkit_windows11.ps1 -HostName "192.168.X.X" -User "root"

# PowerShell 环境下 Agent 管道调用：
$report = .\pve_security_toolkit_windows11.ps1 -HostName "192.168.X.X" -Agent | ConvertFrom-Json
if ($report.score -lt 85) { Write-Warning "Agent Alert: PVE security posture requires remediation!" }