Proxmox VE guide (2): the first things to do after installing

Where this guide comes from: at work I administer a Proxmox VE cluster every day, with Ceph storage and backups to Proxmox Backup Server. This series is the version for starting from scratch at home, with a single server, and follows the official Proxmox VE 9.2 documentation.

In part 1 we got Proxmox installed. Before creating machines, it’s worth getting four things right: updates, users, security and networking.

1. The “No valid subscription” notice

Every time you log in, Proxmox shows a notice saying you have no subscription. It’s normal and doesn’t limit anything. Proxmox is free; the subscription is for companies that want support and the “enterprise” repository.

Online you’ll find tricks to remove the notice by editing Proxmox files. I don’t recommend it: they’re undone by every update and you’re touching system files. Click OK and move on.

2. Update repositories

Freshly installed, Proxmox points to the enterprise repository, which requires a subscription. If you try to update like that, it fails with access errors. You need to switch to the no-subscription repository, which is free and what nearly everyone uses at home.

The easy way: from the web UI

1. Select your server (the node) → Updates → Repositories.
2. Select the Proxmox enterprise repository and click Disable. Do the same for Ceph enterprise.
3. Click Add and choose No-Subscription.

What happens underneath (new format)

Proxmox 9 uses the deb822 format for repositories: .sources files with fields, instead of the old one-line deb ... entries. Many older guides tell you to edit sources.list: that no longer applies.

The free repository looks like this, in /etc/apt/sources.list.d/proxmox.sources (or whatever name the web UI gives it):

Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

And to disable a source, you add one line to its file:

Enabled: false

trixie is the codename of Debian 13, which Proxmox 9 is based on.

3. Update (properly)

From Updates → Refresh then Upgrade, or from the console (Shell in the web UI):

apt update
apt full-upgrade

Note: full-upgrade, not upgrade. Proxmox recommends it because when dependencies between packages change, upgrade can leave things half-done. If the kernel is updated, reboot.

4. A non-root user, with two-factor auth

Using root for everything is convenient, but if someone gets that password, they get everything. The recommended approach:

Enable two-factor for root

Datacenter → Permissions → Two Factor → Add → TOTP. Scan the QR code with an authenticator app (Aegis, Google Authenticator, Bitwarden…). From then on, login will also ask for the 6-digit code.

Keep the recovery codes. If you lose your phone without them, you’re locked out.

Create your own admin user

1. Datacenter → Permissions → Users → Add. Choose the Proxmox VE authentication server realm (Proxmox’s own users, independent of Linux).
2. Datacenter → Permissions → Add → User Permission: path /, your user and the Administrator role.
3. Enable two-factor on it too and use that user day to day.

5. Understanding the network: vmbr0

Under your node → System → Network you’ll see:

• Your physical card, for example enp1s0.
• vmbr0, a bridge created by the installer, holding the server’s IP.

Think of vmbr0 as a virtual switch plugged into your home network. Every VM you attach to vmbr0 appears on your network like any other computer: it asks the router for an IP, sees other devices, and so on.

To start with you don’t need to change anything else. Later you can create extra bridges with no physical card (vmbr1) for isolated internal networks, ideal for networking labs.

6. Storage

Under Datacenter → Storage you’ll see two, if you installed with ext4:

Storage	What it holds
local	ISOs, container templates and backups (files)
local-lvm	Virtual machine and container disks

With ZFS they’re called local and local-zfs, split the same way.

Checklist

• No-subscription repository added and enterprise ones disabled.
• System updated with full-upgrade and rebooted if there was a new kernel.
• Two-factor enabled for root.
• Your own user with the Administrator role and two-factor.
• You know what vmbr0 is and where ISOs go.

In part 3 we create the first virtual machine, with Linux and with Windows, plus the settings that make a real difference to performance.