Proxmox Infrastructure Management with LoboGuard-DC

Alejandro Pasquín · Director Consultoría y Gestión Sociolaboral

At Consultoría y Gestión Sociolaboral, we work with a Proxmox-based infrastructure that currently consists of four clusters, two of them on-premise and two others hosted in OVH.

These clusters host our customers’ machines. Normally, each customer has their own machine and accesses it through a VPN to use the software they need.

Until now, the infrastructure has worked correctly, but as it has grown, we have also encountered the problem of having to manage many things independently. As we did not have a tool that allowed us to have a more global view, for certain tasks we had to go into the different clusters and check everything separately.

One of the best examples was checking the backups. For us, it has always been important not to simply rely on knowing that a backup has been completed successfully, but to know that, when the time comes, we can actually recover the machine. The problem is that properly checking this takes time. Our machines have an average of approximately 500 GB of data, and a full recovery, together with the subsequent checks and the documentation of the evidence, takes quite a lot of time per machine.

Previously, we could carry out these checks at most approximately once every three months, because it was difficult to find the hours needed to repeat the process for all our customers. Since this is something that is so important to me, having so much time between one check and the next always left me feeling uneasy.

Now we no longer depend on having to find a suitable time to do it. We schedule it, it runs and, when it finishes, we receive the result directly by email.

Even the email subject itself is very practical, because it tells us what action was performed, which machine it was performed on and whether the result was successful or failed. If everything is fine, just by looking at it we know that the task has been completed correctly. And if there is a problem, then we go in and check what happened.

The report also provides us with much more information than a simple “everything is OK”, which is exactly what we need. We can see the recovery evidence, the services that were running on the recovered machine and even a screenshot of the console. This evidence is also signed through a trusted timestamping authority, which we thought was a really good feature. If at any point we need to present this information to an auditor, we have the corresponding documentation without having to spend the hours of work that it used to take us.

Another thing we have incorporated is the vulnerability scanner, taking advantage of the fact that this module is included in the license we have purchased. In this case, the analysis is carried out at cluster level, which allows us to have an overall view of the environment. We can establish different schedules depending on the criticality and exposure of each environment.

We are also using the anti-ransomware protection, which is another of the points we find interesting, even though we already have other security tools such as Bitdefender GravityZone. It is not based on a single layer, but has different mechanisms working in parallel. On the one hand, there is the protection at virtual machine level, if we choose to enable it, with automatic isolation and forensic snapshots, and on the other hand we have Tor outbound blocking and cluster-level threat blocking using the FireHOL Level 1 reputation list.

Having these layers working together gives us additional protection that is worthwhile. The more protection, the better.

In the end, what we have noticed most with LoboGuard-DC is a change in the way we work. Before, many of these tasks depended directly on us and on finding the right time to do them. Now we can establish how we want them to be carried out and how often, leave them scheduled and receive the result afterwards.