Nutanix AHV KB 4433 is nebulous and vague

[tgx]

I have run into a significant roadblock deploying the Veeam Nutanix AHV Proxy since
my certificates are self-signed. The procedure outlined for exporting them is quite vague.
Assuming I have exported the correct certificates, I have uploaded them to the proxy using
the installed user account per the KB. https://www.veeam.com/kb4433

The next step calmly states, in fine print:

"Only the root user has write access to this folder. You must first upload the certificates to your
user's home directly, then copy them to the folder using the command line."

That's fine except there is no mention anywhere I can find as to what the root password might be
so I cannot sudo mv the files. I did not assign a root password during the deployment and the password associated with
the newly created user account is insufficient.

Any clarification would be helpful.
Thanks.

[Gostev]

Hello, all support KB articles are created and maintained by our Technical Support organization which is separate from R&D. Could you please share this feedback with them directly using the Send Article Feedback link at the bottom of the KB page? Or if you need help implementing this, then just open a support case normally and they will guide you through the process. Thanks

[ronnmartin61]

@tgx you do not need the root account password to the appliance. The account created at appliance initialization has sudo elevation enabled so you should be able to simply "sudo mv ..." just fine with your appliance login account password. If this is not working of course you'll need to contact support.

[tgx]

Yah but that's the issue. Sudo asks for a password.

[tgx]

Case Number 07173946

[tpayton]

Based on KB feedback received, https://www.veeam.com/kb4433 was updated to state:

Only the root user has write access to this folder. You must first upload the certificates to your user's home directly, then use 'sudo cp' to copy them to the folder.

Also, regarding:

Yah but that's the issue. Sudo asks for a password.

sudo is prompting for the password of the user account you are logged in as, not the root user.

[HYF_JE]

Just chiming in that I have used that KB in the past across our environment as we also have a private PKI and while I certainly have issues with setting up AHV proxies, I have not had issues following that KB.

[tgx]

Thanks Tyler but this was not the case with this installation nor subsequent attempts. There is apparently a flaw where the newly created user was not added to sudoers as
ronmartin60 had alluded to, which meant it was not possible to 'sudo cp' as it would not accept the command even with the password given which is why I thought it may need
the root password. I did follow KB4271 and assign a new root password which then allowed the 'sudo cp' to work.

The correct resolution is to maintenance boot the proxy, then issue sudo usermod -aG sudo <username> which gives the user
sudo ability.

In the end it all turned out to be unnecessary as the problem I was trying to solve was caused by another undocumented issue and not the certificates.

[aaron.grenier]

Hello,
Wanted to chime in here about the sudo privs...The account you use (whatever it is named) is in the veeam-admins group. The veeam-admins group is in the sudoers.

Example:

admin@proxy-v5:~$ id
uid=1000(admin) gid=1000(admin) groups=1000(admin),1001(veeam-admins),1002(veeam-users)


%veeam-admins ALL=(ALL:ALL) ALL


You shouldn't have to add the account explicitly to the sudo group unless something went wrong with the account somewhere, which would require investigation.

[tgx]

The proxy was clean installed 5 different times and each time the end result was a user that was not
a part of sudoers. Thanks.

[tgx]

nutproxy@nutproxyproxy-v5:~$ id
uid=1000(admin) gid=1000(admin) groups=1000(admin),1001(veeam-admins),1002(veeam-users)

veeam-admins1001:nutproxy
%veeam-admins ALL=(ALL:ALL) ALL

Looks the same but failed to work until I followed KB4271.

[aaron.grenier]

If there are issues with sudo not working immediately after deployment, I'd recommend a support case to determine the issue. You should not have to reset the password for root as your account clearly shows sudo permissions. As well, if sudo isn't working, your backup jobs will fail too as sudo is used for snapshot operations so definitely should get that checked out.

[tgx]

That is is exactly what has happened. Case has been closed.
The resolution was manually executing the command to add
the user to the sudoers group. It is unknown why this occurs.

[aaron.grenier]

Odd...I tested in the lab 3 more times (along with the many other times I've worked on this proxy) and can't reproduce the issue. Maybe submit another case and request further investigation (reference your prior case as well as this forum link). Perhaps a network issue is causing issue with cloud-init at deployment.