Applying ZTA on Proxmox reddit / selfhosted ---------------------------------------------------------------------- Historical-Noise8148 · 2023-12-19 10:31 I want to apply Zero Trust Access (ZTA) paradigm on Proxmox, do you know any solution how to do it ? Other than cloudflare and paid solutions. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-19 10:47 As you are on self-hosted, how about OpenZiti - https://github.com/openziti? It's a free and open source zero trust overlay networking which is described by a large US defence contractor as providing the best adherence to [NIST 800- 207](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800 -207.pdf). If you are looking for SaaS rather than self-hosted and open source, CloudZiti free tier is an option. I would also suggest Twingate if you only want 'north-south' ZTA across the WAN. I personally would not suggest other overlays, their implementation of ZT principles (least privilege, micro-segmentation, strong identity, posture checks etc) are not as strong or existent. ---------------------------------------------------------------------- Reverent · 2023-12-19 11:44 If you're going to peddle your shit on reddit, at least [be transparent about it](https://www.softwaredefinedtalk.com/358). Anyway, the answer is read up on the new software defined network capabilities of proxmox. It's complicated but it's built into proxmox itself. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-19 12:07 Fair, I have edited my post to be clear I work on the project. I was not aware of Proxmox's new SDN capabilities. Thanks for sharing. While using SDN allows you to implement Micro-Segmentation, it does not necessarily map to NIST 800-207 3.1.2, as it requires implementation of a PEP, which I do not think Proxmox SDN is doing. From my brief reading, it does not look like it is enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised. You are correct that it is a philosophy. That is backed by principles and reference architectures (e.g., from [NIST](https://nvlpubs.nist.go v/nistpubs/SpecialPublications/NIST.SP.800-207.pdf)), as well as maturity models (e.g., from [CISA](https://www.cisa.gov/sites/default/ files/2023-04/zero_trust_maturity_model_v2_508.pdf)), which provides a framework of capabilities. If a product allows you to easily meet those capabilities, then it provides a means to quickly implement zero trust as an operating model. Ziti most definitely does not implement every aspect of zero trust, as it is across pillars incl. devices, networks, applications, data, cross-functional etc. It does provide optimal maturity in the network pillar as well as contribute to optimal in many of the other pillars. To be optimal across all areas, it needs to be used in tandem with other tools. ---------------------------------------------------------------------- nerdyviking88 · 2023-12-19 13:33 You'd have to be a bit more specific on how you want to add ZTA to Proxmox. Do you want it to the host? The vms themselves? Management? Api? From tehre, we can branch out ---------------------------------------------------------------------- Historical-Noise8148 · 2023-12-19 13:47 To them Vms and cluster inside the Node yes, and eventually between nodes too. Hope it's clear ---------------------------------------------------------------------- nerdyviking88 · 2023-12-19 13:48 Ah. As mentioned above, this is something you'd need to get your entire infra setup to do correctly