首页 » 生活Linux

海光KVM虚拟化兼容性实测

2025-03-31 作者： Fisherworks

两台浪潮海光，CS5620H2和CS5820H2，前者装两片海光5380，后者单片海光7390。做完KVM虚拟化后，实测vm兼容性（cpu设为host）情况如下，供参考。

CentOS 7启动完成后随机崩溃，journal说这cpu哥们没支持过。精神续作Rocky Linux 8启动过程中崩溃。Rocky 9可以正常工作，只是journal说这硬件Unmaintained，说白了就是责任自负。Rocky9 stress一直表现正常。
Debian 11和12都没啥，只是journal里说这是hygon就继续工作了，stress表现正常。11上我用incus容器带了wine，进容器后用wine运行一个win x86 cli app也正常。
Ubuntu用的不多，下载一个22.04 qcow2走cloud init启动一下，跟Debian表现基本一致，就不继续stress了。
openEuler 22.03也一切正常，stress表现正常。
Arch没有细测，手头有个2022的qcow2，cloud init起来后pacman能运行，就没有继续，毕竟能拿Arch做生产环境服务的应该不是主流…吧。
Win7启动就蓝屏（报错5D），Win10启动正常，因为日常工作完全不用win，所以没有继续测。

PVE web portal hardening

2025-01-09 作者： Fisherworks

本文：配置fail2ban实现PVE web登录入口的暴破防护。

On a Proxmox VE host accessible to the public internet, using fail2ban to protect SSH away from malicious traffic is fairly common, but what about the web management portal?

I’ve got a blog post talking about that, which seems promising. However it’s already version 8.x, I’m learning something about journald, and so far it’s good to me – I don’t want reinstall the rsyslog just for this, then how can I get it work? Let’s find out.

WHAT HAPPENED

Daily routine, check the system journal with something like journalctl --since='yesterday' .

Jan 09 16:29:23 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:29:26 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:31:33 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:31:35 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:33:44 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:33:45 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:35:54 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:35:56 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:38:04 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:38:05 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:40:14 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:40:16 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:42:25 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:42:27 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:44:35 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:44:37 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:46:46 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:46:48 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure
Jan 09 16:48:56 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx  user=root
Jan 09 16:48:58 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:29:23 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:29:26 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:31:33 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:31:35 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:33:44 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:33:45 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:35:54 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:35:56 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:38:04 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:38:05 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:40:14 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:40:16 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:42:25 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:42:27 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:44:35 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:44:37 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:46:46 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:46:48 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

Jan 09 16:48:56 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root

Jan 09 16:48:58 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure

CUSTOMIZED CONF FOR FAIL2BAN

The filter rule of /etc/fail2ban/filter.d/pvedaemon.conf .

[DEFAULT]
_daemon = pvedaemon

[Definition]
failregex = pvedaemon\[.*authentication failure; rhost=<HOST> user=.* msg=.*
ignoreregex =
journalmatch = _SYSTEMD_UNIT=pvedaemon.service + _COMM=pvedaemon

[DEFAULT]

_daemon = pvedaemon

[Definition]

failregex = pvedaemon\[.*authentication failure; rhost=<HOST> user=.* msg=.*

ignoreregex =

journalmatch = _SYSTEMD_UNIT=pvedaemon.service + _COMM=pvedaemon

Then enable the jail in /etc/fail2ban/jail.local .

#... below the sshd conf, add this for pve daemon
[pvedaemon]
enabled = true
port = https,http,8006
filter = pvedaemon
backend = systemd

#... others

#... below the sshd conf, add this for pve daemon

[pvedaemon]

enabled = true

port = https,http,8006

filter = pvedaemon

backend = systemd

#... others

CHECK THE RESULT

Restart the fail2ban service, here it goes.

$ fail2ban-client status pvedaemon
Status for the jail: pvedaemon
|- Filter
|  |- Currently failed:	0
|  |- Total failed:	2
|  `- Journal matches:	_SYSTEMD_UNIT=pvedaemon.service + _COMM=pvedaemon
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	162.19.61.xxx