Editing Servers/Proxmox

== Proxmox WebUI User Management ==

=== Creating Users ===

https://pve.proxmox.com/wiki/User_Management

creating with pam is easiest, but creating with pve is probably safer to seperate from your sudo password.

Make sure to set 2 factor authentication after.

== IPMI ==

Make sure to install {{ic|ipmitool}} on your chosen distro.

Replace {{ic|<username>}} with your chosen username.

{{bc|
# modprobe ipmi_devintf
# ipmitool user set name 2 <username>
# ipmitool user set password 2
# ipmitool user enable 2 
|lang=bash}}

You can reset the BMC to factory settings as below:

https://siliconmechanics.zendesk.com/hc/en-us/articles/201143819-Resetting-the-BMC

=== IPMI Sideband ===

{{Tip|IPMI Sideband is useful if you are at a colocated datacenter and just want to test IPMI without having to ask a tech to attach it. But it might be a good idea to disable sideband once you can get IPMI working on it's native port, so that the host port can be disconnected when not needed.}}

Use this to run IPMI over the same network ethernet interface. IPMI requires it's own IP, so choose one out of your allotment and give it to it: at least temporarily.

https://www.ibm.com/support/knowledgecenter/linuxonibm/liabw/liabwenablenetwork.htm

== LXC vs KVM ==

You'll have to make a decision on whether to use LXC containers that share the host kernel, or KVM virtual machines that use their own kernel. 

LXC containers are most similar to FreeBSD jails, in that they use the same kernel as the host and thus have the least overhead. However, security implications appear whereby the host must be responsible for Mandatory Access Control, and you may want to trust your admin users per VM just in case. In addition, since Mandatory Access Control is handled by the host, SELinux and Apparmor cannot be enabled at the client level and the clients cannot actually customize their policies with more granularity. If there are applications that require custom kernels (such as GRSecurity), you're out of luck as well.

KVM virtual machines allow the VMs to use different kernels from the host, and use Mandatory Access Control. It also isolates the host system resources from client machines for greater security than OpenVZ's shared resources provide. The tradeoff is that multiple redundant kernels are active and using more resources than normal,.

{{Quote|Unfortunately, we have many guests where the [https://forum.proxmox.com/threads/moving-to-lxc-is-a-mistake.25603/#post-128412 overhead caused by KVM would make them unusable.]
Some of our MySQL guests simply stopped working under KVM (slowed down to a crawl) under high load, while the same workload under (containers) gives us 50% higher transactions per second, and much more graceful slowdown under extreme loads.}}

== Apparmor ==

For OpenVZ containers, Mandatory Access Control is handled at the host level. This is why apparmor and selinux are disabled on the containers themselves.

=== NFS ===

To enable NFS, you must allow it through apparmor.

https://forum.proxmox.com/threads/advice-for-file-sharing-between-containers.25704/#post-129006

Unfortunately, Proxmox's docs for allowing nfs mounting is outdated. They have a weird lxc fork so the official lxc docs are of no help.