tontonjo / proxmox_toolbox

A toolbox to get the firsts configurations of Proxmox VE / BS done in no time

Proxmox Toolbox

Toolbox to setup Proxmox Virtual Environment and Backup Server

Tonton Jo

Join the community & Support my work

Click Here!

Informations:

This little tool aim to get smalls one-time configurations for Proxmox Virtual environement and backup server hosts in no time.
It automatically will find if the host is a pve or a pbs host and setup accordingly.

Demonstration:

You can watch a demonstration of the tool in this playlist

Prerequisits:

• Up-to-date PVE 7 / 8 or PBS server
• Internet connexion

Features are:

• Automatic PVE / PBS host detection
• Hide enterprise repo and set no-subscription repository
• Update host and create a new command "proxmox-update"
• • when no-enterprise source is set, disable no-subscription message
• Install usefull dependencies: ifupdown2 - git - sudo - libsasl2-modules - snmp
• Security settings:
• • Enable fail 2 ban with default configuration for sshd, proxmox virtual environement and backup server
    (credits to inettgmbh)
• • Create another debian user with sudo rights
• • Disable root ssh login
• • Create another Proxmox GUI administrator (login with Proxmox VE Realm)
• • Disabling root@pam user !!! root@pam is needed to update from GUI - update can still be done trough SSH if disabled !!!
• Change or disable SWAP
• Enable S.M.A.R.T self-tests on all supported drives
• • short: every sunday@22 - Long: every 1st of month @22
• Enable SNMP V2 or v3 - you choose - with a default working configuration
• Backup and restore Proxmox Virtual Environment and Backup Server configuration
• • Automatic remount of directories and zpools using previously existing configurations
• • Please find more informations below

Legacy hidden function:

• Configure email service to send system and proxmox notifications (postfix)

News

2023.11.24: Proxmox 8.1 - Emails Notifications - Proxmox VE now supports email configurations very well from the GUI, the toolbox wont get any update related to this function anymore.

Usage and arguments:

Get and execute:

wget -qO proxmox_toolbox.sh https://raw.githubusercontent.com/Tontonjo/proxmox_toolbox/main/proxmox_toolbox.sh && bash proxmox_toolbox.sh

Updating host & remove subscription message

The script will update your host and detect if the no-enterprise source is configured, if so, remove the subscription message.

• If you still encounter it after, clear your broswer cache.
• If you update your host directly within the system, the no subscribtion message may reappear when the file gets updated.
• In order to nerver see this again, you have to update Proxmox with one of the following options:

To start an update only, without menu or prompt:

bash proxmox_toolbox.sh -u

Once the tool has been used to update host, you can execute this command to fully update your host - kind of an alias of bash proxmox_toolbox.sh -u

proxmox-update

Backup configuration

To start a configuration backup only:

bash proxmox_toolbox.sh -b

Fail2ban:

If you enable fail2ban, i guess you know what you're doing, if you dont: here's some usefull informations and commands:

• ban are for 1 hour
• ssh and web interface logins are monitored

List of $jailname:

fail2ban-client status

get status of a jails - display banned IP's

fail2ban-client status $jailname

Unband an IP:

fail2ban-client set $jailname unbanip  $ipaddress

Backup and Restoration:

• Be carefull as this was not extensively tested - especially not with cluster configurations
• The following folders and configurations are backuped by default:
  /etc/ssh/sshd_config /root/.ssh/ /etc/fail2ban/ /etc/systemd/system/*.mount /etc/network/interfaces /etc/sysctl.conf /etc/resolv.conf /etc/hosts /etc/hostname /etc/cron* /etc/aliases /etc/snmp/ /etc/smartd.conf /usr/share/snmp/snmpd.conf /etc/postfix/ /etc/pve/ /etc/lvm/ /etc/modprobe.d/ /var/lib/pve-firewall/ /var/lib/pve-cluster/ /etc/vzdump.conf /etc/ksmtuned.conf /etc/proxmox-backup/

Backup

The script will put every folder listed in backup_content in a tar.gz archive.

• You cand add /remove folder trough the edit of backup_content= line in the script
• You can change the target folder to use for backup and restoration in the script env. variables at: backupdir="/root/"

Once the backup is done, a tar.gz archive is located at backupdir="/root/".

Restauration:

The script looks for tar.gz files located in backupdir="/root/" and will list all the available archives for you to choose one.
Warning: The restauration will overwrite any existing file with the one in archive

The restauration process will:

• Reinstall missing dependencies for snmp and fail2ban if config were existing
• Restore Proxmox configurations (proxmox configs, certificates, vm configs, storages configs, proxmox users)
• Automatically remount the following storages: dir and zpools

Directory mountpoint and zpool

In case of need, here's how you can manually mount storages:

Directory:

Mount configurations are located in /etc/systemd/system/mnt-datastore-$datastorename.mount

• run the following commands:

source /etc/systemd/system/mnt-datastore-$datastorename.mount  
mkdir -p "$Where"
echo "$What $Where $Type $Options 0 2" >> /etc/fstab  
mount -a

• Control if the drives are now correctly mounted
• Add a new Directory storage in pve/pbs using "where" as directory path

Zpool:

• run

zpool import

• Take note of the "pool" name and run

zpool import -f $poolname

• Add a new ZFS storage in pve/pbs

SOURCES:

https://pve.proxmox.com/wiki/Fail2ban
https://github.com/inettgmbh/fail2ban-proxmox-backup-server
https://forum.proxmox.com/threads/how-do-i-set-the-mail-server-to-be-used-in-proxmox.23669/
https://linuxscriptshub.com/configure-smtp-with-gmail-using-postfix/
https://suoption_pickedpport.google.com/accounts/answer/6010255
https://www.howtoforge.com/community/threads/solved-problem-with-outgoing-mail-from-server.53920/
http://mhawthorne.net/posts/2011-postfix-configuring-gmail-as-relay/
https://docs.oracle.com/en/cloud/cloud-at-customer/occ-get-started/add-ssh-enabled-user.html
https://www.noobunbox.net/serveur/monitoring/configurer-snmp-v3-sous-debian
https://github.com/DeadlockState/Proxmox-prepare
https://blog.lbdg.me/proxmox-best-performance-disable-swappiness/
https://gist.github.com/mrpeardotnet/6bdc4b504f43ce57fa7eaee96d376edf
https://github.com/DerDanilo/proxmox-stuff/blob/master/prox_config_backup.sh
https://pve.proxmox.com/wiki/Upgrade_from_6.x_to_7.0
https://wiki.debian.org/SSDOptimization
https://www.linuxtricks.fr/wiki/proxmox-quelques-infos
https://bobcares.com/blog/fail2ban-unban-ip/

TODO:

settings for zram -> https://pve.proxmox.com/wiki/Zram
PBS: add support for user creation and backup / restoration user creation fro PBS when available
make things stupid-proof (deny characters when numbers expected and so on)

Tonton Jo - 2022

proxmox_toolbox's Issues

Backup Config via Argument

Hello,

what argument do I have to use to Backup Configuration?

Thank you,

[FEATURE SUGGESTION] Enable IOMMU

Hi, I recently setup a second node and came across a few things that might be useful to add to the Toolbox

Third up, is enabling IOMMU. This differs for BIOS (Grub) and UEFI (systemd-boot).

Enable IOMMU For BIOS/GRUB

Reference:
https://pve.proxmox.com/wiki/PCI(e)_Passthrough

Follow the linked instructions.

For the kernel command line, add:

GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_DEFAULT} intel_iommu=on"

To a new file:

nano /etc/default/grub.d/iommu.cfg

Save, exit, and update grub

update-grub

Enable IOMMU For UEFI/Systemd-boot

Reference:
https://pve.proxmox.com/wiki/Host_Bootloader#sysboot_edit_kernel_cmdline
https://matthewdeporter.com/proxmox/proxmox-pci-passthrough/#iommu-systemd-boot

Add the ''intel_iommu=on'' ''iommu=pt'' settings to the Systemd-boot command line.

Edit the /etc/kernel/cmdline:

nano /etc/kernel/cmdline

Before modification:

root=ZFS=rpool/ROOT/pve-1 boot=zfs

After:

root=ZFS=rpool/ROOT/pve-1 boot=zfs intel_iommu=on iommu=pt

Update the Systemd-boot scripts:

pve-efiboot-tool refresh

Verify loaded kernel cmdline:

$ cat /proc/cmdline
initrd=\EFI\proxmox\5.4.73-1-pve\initrd.img-5.4.73-1-pve root=ZFS=rpool/ROOT/pve-1 boot=zfs intel_iommu=on iommu=pt

Verify that IOMMU is enabled and Virtualization Technology for Directed I/O:

$ dmesg | grep -e DMAR -e IOMMU -e AMD-Vi
[ 0.013784] ACPI: DMAR 0x000000007E2CAB18 000130 (v01 A M I OEMDMAR 00000001 INTL 00000001)
[ 0.155343] DMAR: IOMMU enabled

...

[ 1.474961] DMAR: Intel(R) Virtualization Technology for Directed I/O


Restore one cluster node

Hello, due to the grub/zfs non efi bug encountered now with pm 8.1 upgrade I have to reinstall one node after the other.
Does the restore process work on a member node?

Thank you.

Typo

“If you reveive this, it means your email configurations looks correct. Yay!”

reveive -> receive

It's a minor thing but couldn't help to notice. Love your work with this tool. It was so easy to set up email notifications :)

Send mail IPv4 - IPv6

Rebonjour
Suite à l'erreur (voir autre issue) sur PBE, je teste sur PVE.
Voici l'erreur que j'ai et que j'ai du mal à interpreter.
Je n'ai pas d'IPv6 configfuré sur mon serveur PVE (juste une IPv4 fixe locale)
IPv6 est tout de même activé sur mon réseau. PBE semble en ipv6 juste avoir son IP de loopback en fe80

`- Checking for known errors that may be found in logs
Nov 4 09:35:15 pve postfix/smtp[209517]: connect to mail.infomaniak.com[2001:1600:0:aaaa::1:2]:465: Network is unreachable
Nov 4 09:36:10 pve postfix/smtp[209792]: connect to mail.infomaniak.com[2001:1600:0:aaaa::1:1]:465: Network is unreachable
Nov 4 09:36:10 pve postfix/smtp[209792]: connect to mail.infomaniak.com[2001:1600:0:aaaa::1:2]:465: Network is unreachable

• Are you on IPv4 AND your host can resolve and access public adresses? y = yes / anything = no: ^C
  `

Comment puis-je en arriver là ?
J'ai indiqué yes dans la question mais cela ne semble pas améliorer la situation.
Pas sur que ça soit une issue rééelle, plutôt conf, mais dans le doute je poste quand même

EDIT :
Et la config du postfix généré par le script

`myhostname=XXXXX.XXXXXXXx

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

appending .domain is the MUA's job.

append_dot_mydomain = no

Uncomment the next line to generate "delayed mail" warnings

#delay_warning_time = 4h

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = $myhostname, localhost.$mydomain, localhost
relayhost =[mail.infomaniak.com]:465
mynetworks = 127.0.0.0/8
inet_interfaces = loopback-only
recipient_delimiter = +

compatibility_level = 2

smtp_use_tls = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_sasl_security_options = noanonymous
smtp_sasl_auth_enable = yes
sender_canonical_maps = hash:/etc/postfix/canonical
inet_protocols = ipv4
`

Option PVE & PBS on one server for backup

Hello,

thank you so much for this great script.

Could you please add an backup-and-restore option where PBS and PVE is installed on one server.

That would be great.
Thx

[FEATURE SUGGESTION] Bash Terminal Colours

Hi, I recently setup a second node and came across a few things that might be useful to add to the Toolbox

First up, is terminal colours! I'm not a fan of how stock Debian keeps everything the same, but I am a fan of how Turnkey Linux has theirs setup.

This can be done by editing bash.rc

nano /etc/bash.bashrc

Before: From Line 18

# set a fancy prompt (non-color, overwrite the one in /etc/profile)
# but only if not SUDOing and have SUDO_PS1 set; then assume smart user.
if ! [ -n "${SUDO_USER}" -a -n "${SUDO_PS1}" ]; then
  PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '
fi

After:

# set a fancy prompt (non-color, overwrite the one in /etc/profile)
# but only if not SUDOing and have SUDO_PS1 set; then assume smart user.
if ! [ -n "${SUDO_USER}" -a -n "${SUDO_PS1}" ]; then
    eval "`dircolors -b`"
    alias ls='ls --color=auto'
    alias ll='ls --color=auto -alF'
    alias la='ls --color=auto -A'
    alias l='ls --color=auto -CF'
    alias grep='grep --color=auto'
    alias fgrep='fgrep --color=auto'
    alias egrep='egrep --color=auto'

    # Set a terminal prompt style (default is fancy color prompt)
    PS1='${debian_chroot:+($debian_chroot)}\[\033[01;33m\]\u@\h \[\033[01;34m\]\w\[\033[00m\]\$ '
else
    alias ls="ls -F"
    alias ll='ls -alF'
    alias la='ls -A'
    alias l='ls -CF'
    PS1='${debian_chroot:+($debian_chroot)}\u@\h \w\$ '
fi

Restoration of a backup makes system unuseable

we had multiple crashed services after backup restoration.

We did a reinstallation and wont use the backup feature again.
Just wanted to let you know that it is currently unusable.

valeur de swappiness perdue au reboot de proxmox

Hello,
Pour commencer, un immense merci pour ton script qui facilite bien la vie.
J’ai constaté un petit problème, lorsque l’on change la valeur de swappiness à zéro par exemple, c’est effectif tant que proxmox ne redémarre pas. Après un reboot, la valeur revient à celle par défaut: 60.
J’ai testé ça sur plusieurs hosts avec la dernière version à ce jour de Proxmox, la 7.0.-13

Problème d'envoi d'emails

Bonjour, merci pour ce script fort utile et bien réalisé :)
J'ai tout de même un problème avec la configuration des notifications emails voici le log :

Jul 26 15:30:01 pve postfix/smtp[4074964]: 92D543404C5: to=[email protected], relay=mail.s.fr[xx.xx.xx.x]:25, delay=219299, delays=219295/0.04/2.9/0.94, dsn=4.1.8, status=deferred (host mail.s.fr[xx.xx.xx.x] said: 450 4.1.8 [email protected]: Sender address rejected: Domain not found (in reply to RCPT TO command))

Je précise que j'auto-héberge mon serveur de messagerie en passant par un relais smtp (mailjet, port 465)

Merci par avance pour votre retour
Sylvain

portability with shellcheck

hi @Tontonjo

apt update
apt install shellcheck
shellcheck proxmox_toolbox.sh

see what happen

regards,
nGadmini binti nGadimin

problème : tout accès ssh perdu

Bonjour TontonJo,
Merci pour ton travail que je suis depuis quelques mois.
Je viens de mettre à jour mon PM en V7 sans soucis grâce à ton tuto et je viens aussi d'utiliser ton toolbox.
Par contre je viens de faire une bêtise avec que je ne comprends pas et je ne m'en sors plus.
J'avais déjà un compte root sans autorisation en ssh et un compte que j'appelerai ici perso@pam autorisé en ssh.
j'ai lancé l'option 4) security pour activer fail2ban et j'ai dû ensuite faire une erreur dans les réponses suivantes (je ne voulais pas créer d'autres comptes) car je n'ai plus d'accès ssh avec mon compte "perso" (ni root bien sûr).
je peux toujours me connecter à la GUI (en root et en perso) et à l'intérieur à la console >_shell de proxmox pour rentrer des commandes.
ça fait 4h que je cherche sur internet comment réautoriser mon compte perso@pam en ssh et je n'y arrive pas. Pourrais-tu m'aider ?
Merci d'avance.
Fabrice

Upgrade From 7 to 8 ?

Hi
Is it planed to have update from PVE 7.x to 8.x ?

After running update host I still get the no-subscription message

As the the title says the no-subscription message doesn't get removed after running update host. Tried running it a couple of times and also rebooted the server but I still get the no-subscription message.

[FEATURE SUGGESTION] Additional Packages

Hi, I recently setup a second node and came across a few things that might be useful to add to the Toolbox

Second up, is additional packages.

• lshw for identifying hardware
• lm-sensors for additional sensor information for fan control scripts etc
• corosync-qdevice needed for having a third 'qdevice' node in even numbered clusters. Often a SBC.

I'll add others as I think of them.

[FEATURE SUGGESTION] CPU Governor

Hi, I recently setup a second node and came across a few things that might be useful to add to the Toolbox

Third up, is CPU governor.

I generally change this to ondemand on a new install which reduces power consumption but doesn't seem to affect performance.

I do this with the below command:

# echo "ondemand" | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Then add a cron job to run at each boot:

crontab -e

@reboot echo "ondemand" | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor >/dev/null 2>&1

Change E-Mail From Name

Hey,
Thanks for the script!

Today i have a question about the SMTP Module.
I have configured it, but the emails always arrive as root <[email protected]>.
Is there a way to change the root part to something else?

I allready tried to edit the canonical file and make a postmap but that didn't work as expected.

PBS - Send mail error

Bonjour Tonton Jo
Voici le log d'erreur suite utilisation du toolbox sur un PBS lors d'un test d'envoi.
PBE fraichement installé et mis à jour avec ta toolbox en 2.0.12

- What is the recipient email address? :
[email protected]
- An email will be sent to: [email protected]
proxmox_toolbox/proxmox_toolbox.sh: line 554: mail: command not found
- Email should have been sent - If none received, you may want to check for errors in menu 3

Je n'ai aucune erreur dans le menu 3

`- Checking for known errors that may be found in logs

• No configured error found - nothing to do!

`