Panel login: a password on its own is not a defence

A password is put on the panel and people believe the job ends there. But a password is a single line of defence, and its strength is not something that can be verified: it can only be assumed.

Three things actually change the outcome.

One: an attempt limit

A password's strength only means something if guessing is expensive. Given unlimited attempts, every password turns into a matter of time; the only difference is how long it takes.

An attempt limit does not make the password stronger. It makes guessing costly. Those are two different things, and the second one is in your hands.

Two: where the session lives

After you log in, what carries you is not the password but the session. So the real question is: where does that session live, and who can reach it?

The session should sit somewhere in the browser that scripts cannot read, and it should be marked so that a page on another site cannot send requests on your behalf. Otherwise a tab you left open can act with your authority.

Three: a second step

This is the only measure that does not let a leaked password survive. A password can be stolen, guessed, or arrive from a leak on some other site. A second step prevents none of that, it only makes sure that on its own it is not enough.

Turn it on for accounts that can change things. For accounts that only look, it is a matter of preference.

The assumption that costs the most: "I am on the local network"

This sentence is the most repeated and the most wrong thing on the security side.

Count what is on your local network: the wireless connection you gave your guests, a smart device that has not been updated in years, the children's computer, and every virtual machine you run on your own server.

That last one is the most overlooked. When you run software you downloaded from the internet inside a virtual machine, that machine is on your local network and can reach the panel's login page.

So "I did not expose it" does not mean "nobody can try". It only means "not everyone on the internet can try". The difference is who is close enough to try.

What to do, in order

Do not expose the panel directly to the internet. If you need remote access, put a layer in between.

Make sure there is an attempt limit. Without one, guessing passwords from the local network is free.

Put a second step on accounts that can change things.

Stop doing daily work with the most privileged account. This has its own article in this wiki and counts as the continuation of this one: even if the login is protected, how much the person who logs in can change is a separate question.

What Atlas does

Atlas's login gate has an attempt counter, and the counter is kept per source address. If there are ten wrong attempts within a five minute window, that address is blocked for fifteen minutes.

Why this exists is written in the code's own comment and is exactly this article's subject: Proxmox already has its own delay, but it has to be stopped at the agent's gate too, otherwise guessing passwords from the local network is free.

On the session side two markings are used together. The session identifier is kept in the browser in a form scripts cannot read, and it is marked so it is not sent along with requests coming from another site. So a page in another tab you left open cannot make your browser use your session.

An honest limit: none of this makes your password stronger. It makes guessing expensive and takes the session out of the stealable category. The password itself is still your choice, and so is whether to turn on the second step.