[RELEASE] Managed Hardened Repository ISO by Veeam

[miguel.salinas]

Is there a procedure to update a hardened repository without using the internet? maybe by adding the ISO? is it possible to update VHR offline?

[HannesK]

Hello,
I described the existing options here

Best regards
Hannes

[NewCom23]

Hi there,

after a little help from the veeam support I sucessfully installed the VHR on Intel S1200SPL < LSI MegaRAID SAS 9361-8i.

Two learnings I want to share.

1.) The ISO USB-Stick shouldn't be bigger than 100GB or it get's recognized as volume.
Maybe that's something for the prerequisites.
Mine was 128GB and it always said in the prechecks --> 3 volumes bigger than 100GB [SUCCESS]
Even though I just created 2 volumes on the RAID-Controller.
And the led to storage configuration failure.

2.) Consumer SSDs (Samsung 850 Evo left overs) for OS didn't have the same sector sizes as enterprise HDDs.
Samsung 850 Evo - logical sector size 512 / physical sector size 512
Seagate Seagate Exos X - X20 20TB - logical sector size 512 / physical sector size 4096

So I had a missmatch of the sector sizes, that led to storage configuration failure too.

I Switched to (Dell) Intel SSD DC S3510 (also left overs) - logical sector size 512 / physical sector size 4096
and everything worked just fine.

The missmatch of the sector sizes is already known (I just didn't see it, thanks to the veeam support), but it seems like Enterprise SSDs/HDDs have more likely the right sector sizes than a mix between enterprise and consumer grade hardware.

Best Regards,
Janek

HannesK: thank you, added to list

[Gostev]

Oh... that is super useful, thanks a lot for taking time to highlight these for the future readers, Janek.
Perhaps we can detect these situations and provide a meaningful error message at least.

These make great examples of the types of bugs that are hard to catch in the internal QA process

[HannesK]

Hello,
thanks for reporting back. It sounds like you talked to Veeam support... can you maybe provide the support case number? Especially for the USB stick issue that would be helpful.

1) that sounds like a bug. The installer should ignore all USB devices, SD cards and anything that is removable. We have also seen USB devices that pretend to be other device types which then can lead to issues. We built for example a specific exclusion for IODD USB devices which identify themselves as "not removeable". Can you maybe tell us which USB stick you used?

2) yes, we work on adding a check for the sector size mismatch.

Best regards
Hannes

[NewCom23]

Hi Gostev,

no problem, I really enjoy sharing techincal journeys and like you said, hopefully it can help others in the future.

This Thread and the old one from the earlier version helped me a lot too. So it's also giving back a little.

Hi Hannes,

1.) the case number is #07633598

2.) A message would be great like, sectore size missmatch --> Change sectors (with some harddrives it is possible with external software) or if not possible change hardware.

Best Regards,
Janek

[HannesK]

Hello Janek,
thanks for the case number. We will look into it and if information is missing from what we have in the support case, then I would reach out to you directly.

Best regards
Hannes

[fezzebru]

Hello,

I talked to Red Hat and the reason for that 1PB value is "operational reasons".

Yes, one can go higher and there is no technical limit that stops customers at 1PB. We have customers using more than 1PB for XFS (but not many because we also see customer preferring "manageable chunks" as mentioned for example here)

The main challenge would be that there is currently no online repair. Once there is online scrub / repair for XFS, that value would probably be increased for RHEL.

Best regards
Hannes

Hopefully that is soon, we have a meeting with the storage vendor as well as Veeam tomorrow and will reference these post. At this point is recommend to go with Ubuntu or Rocky? I've read the disa stig Rocky vs Ubuntu and seems that Rocky is the direction of the future, and I wish to align us with as close to your hardened repo tool as possible. We will be POCing this setup for around 45-60 days and would love to help with any enhancements that we both would consider useful.

Very good call out for the online scrub of XFS, that would be very helpful as well.

Thanks!

[Gostev]

Veeam standardized on [special version of] Rocky for future software appliances like Managed Hardened Repository discussed here, however we will continue supporting customer-managed Linux systems as per System Requirements, including but not limited to Ubuntu.

In other words:

- If you want to manage (secure/tune/patch/upgrade) the Linux systems running your backup infrastructure components, then you can choose any supported Linux distribution you're most comfortable with managing

- Alternatively you can let Veeam do all this for you, in which case you should not care what distribution Veeam is using in the first place because we take care of everything for you

[fezzebru]

Yes sir! Thank you, that's the plan! Let Veeam do all of this for us just need to get mulitpathing setup and large volumes with SAN we shall be good to go!

[massimiliano.rizzi]

Hello and good day,

a quick update here in order to report a successful fresh installation using the hardware below:

==================================================
- Lenovo ThinkSystem SR650 V2 server (Machine Type 7Z73) running the most recent firmware updates
- Boot Drive -> ThinkSystem M.2 SATA 2-Bay RAID Enablement Kit, using a couple of 480GB M.2 SATA SSDs
- LUN for the Veeam repository -> RAID 6 as the RAID level for 11 disk drives. Disk 12 has been used as a hot spare
- 2x Broadcom 57414 10/25GbE SFP28 2-port OCP Ethernet Adapter bonded using 802.3ad bonding
==================================================

Thanks!

Massimiliano

HannesK: thank you, added to list

[HannesK]

Hello,

1.) The ISO USB-Stick shouldn't be bigger than 100GB or it get's recognized as volume.

we confirmed the root cause: it's not about the size. It's about the USB stick identifying itself as not removable. One can check that with the following command on any Linux machine / live boot

Code: Select all

cat /sys/block/<device id, for example sdc>/removable

the result must be "1" to be excluded from the disk selection.

Hannes
Best regards

[karsten123]

Hi,
is it possible to add disk space afterwards and what is the procedure?
Thx

[dennism82]

Installed the januari 2025 ISO on 2x:

Dell T360 Tower model.
Specs: Xeon E2468 - 64GB - Boss-N1 Controller 1 2*480GB M2 for OS - 8* Dell 16TB drive for backup repo on a PERC H755 - 2x LOM + Broadcom 5719 4* 1GbE - iDrac Enterprise

Is on RHEL HCL and works flawlessly, used at a medium sized business for both on-site and off-site backups (1 unit is offside and backups over Site-to-Site VPN).
Very smooth install also, fully done over iDrac virtual console.

HannesK: thank you, added to list

[NightBird]

One big question, will be this version 2.0.0.8 upgradable to JeOS ?

I hope so !

[HannesK]

@dennism82: thanks for reporting

@NightBird: JeOS is just a different term for "Rocky Linux provided by Veeam" which is what Hardened Repository ISO is built on. We have plans for a migration path from V12 [2.0.0.8] to V13, yes.

[karsten123]

Hi,
is it possible to add disk space afterwards and what is the procedure?
Thx

[Gostev]

@karsten123 this was already discussed at least a few times in this thread, was literally one of the first questions see the first page.

[karsten123]

Hi Anton. You are right but not i was hoping for.

[Gostev]

Keep in mind this offering is purpose-built to simplify converting storage servers (i.e. servers with chassis optimized for high density storage) into hardened repositories. From performance perspective (IOPS) you always want to use all spindles the chassis can fit, and you determine required HDD size based on your usable storage needs. The use case where only part of drives are populated first and more are added later is therefore almost non-existent and it hasn't been a priority.

[anpa]

Is there any plan to add support for server management software? I was thinking primarily HPE AMSD, but there may be other flavours as well.

I know it could potentially open up for communications not desired for security reasons, but it would be good to get some reports from OS into server management (OneView etc.) and firmware/driver patching (ISUT).

[HannesK]

Hello,
as far as I see, that HPE agentless management software connects to HPE iLO ports. That means there should be nothing needed from Veeam side. Or do I misunderstand how it works?

Firmware updates would be done outside the operating system / Veeam. I remember HPE has bootable ISOs for that or maybe there are also more modern ways. We don't plan firmware updates from inside the operating system.

Best regards
Hannes

[AndreB]

Hello,

i can confirm that the installation works without any problems on the following systems.
In particular, the 16-port RAID controller is not yet on the list.

HPE DL360G10 < HPE Smart Array P816i-a SR Gen10

Best regards
André

HannesK: thank you, added to list

[andre.simard]

Hi,

is there a way to see firewall rules or firewall logs? I would like to troubleshoot an issue where traffic that is coming from a proxy that is not in the same VLAN as the VHR is blocked.

Is it block by desing?

Thank you

[HenkeZan]

Hello. I tried search this thread, but I could not find answer to if the network config supports tagged vlans.
Thanks for awesome product!

Regards

[Outlaw]

Hello

Some question/feature request
To install, you need 2 devices (sda/sdb), it would be nice to make it possible to install with one device on which to make 2 partitions (sda1/sda2).
I have to allocate 2 disks to a separate raid group, which is not very good for free space. For example, if I had a server with 8 disks, I would just make 7 disks with raid6 + spare, but now I have to make 2 disks raid 1 + 5 disks raid6 + spare.

[HenkeZan]

Hello. I tried search this thread, but I could not find answer to if the network config supports tagged vlans.
Thanks for awesome product!

Regards

Not sure how to edit a post, but the installer certainly supports tagged vlans since its the regular one I found out.

[EviLin]

Hello,

I cant seem to find the specific firewall ports opened for the Veeam Hardend repo version 2.0 ?

Our setup is:

VBR server.
VHR (Veeam hardend repo) server.
Veeam Data Cloud vault.

We need to setup the Veeam cloud vault as a scale-out-repo for the Veeam hardend repo.
In below link it mentions "Backup repository (Linux)", is this the ports needed from/to the Veeam hardend repo?
As far as I remember, it also needs to be able to get updates from a public veeam update repo on port 443, but that is not mentioned in the below article?

https://helpcenter.veeam.com/docs/backu ... r=120#repo

[HannesK]

Hello,
and welcome to the forums.

Yes, the Linux Repository ports apply. Hardened Repository (ISO) is "Linux (Hardened Repository)" in the "managed server" section in the Veeam Backup & Replication Console.

Yes, repository.veeam.com is missing with 443 in that list and I will ask tech documentation team to add it. It's currently only mentioned here. Thanks for bringing it up!

Best regards
Hannes

[cmcawood]

Keep in mind this offering is purpose-built to simplify converting storage servers (i.e. servers with chassis optimized for high density storage) into hardened repositories. From performance perspective (IOPS) you always want to use all spindles the chassis can fit, and you determine required HDD size based on your usable storage needs. The use case where only part of drives are populated first and more are added later is therefore almost non-existent and it hasn't been a priority.

@gostev I disagree, I can think of at least 2 situations where this would be necessary (one which affects me right now). 1 - You grow out of your storage and have to replace the drives and resize the volume - how do you then increase this on the Hardened Repository side? 2 - We are running containerised Hardened Repositories in VMs for customers who have their own Veeam license to offsite backup to our hosted environment - we can't just allocate ALL the disk space, but considering we sell the space per TB, we can't need to increase space and suddenly we have to reinstall and ship the clients entire backups again!

I have seen plenty of discussion around how to resize the partitions in a normal Linux installation, but the Hardened Repository is locked down (for obvious reasons). Would it not just be as simple as allowing us sudo access to the various functions required to resize partitions - from what I've read growpart, resize2fs and parted might all be needed?

Thanks again!