Encrypted backup and bare metal restore Linux

[JeWe]

Hi,

we backup a Ubuntu 22.04 server with VBR12, backups are encrypted. Now I have to restore this server with bare metal restore. Booted with the standard media 5.0-ISO from Veeam, I pointed to the backup file and have to type in the encryption password --> Wrong password? Doublechecked, triplechecked, multichecked, no success.

At the console I copied the backup file and imported it. Unencrypting with the above used password works, so the password is correct.

Ticket opened, case ID 07401694. Anyone else seen this?

Regards,
Jens

[PTide]

Hi,

That's something new - we've never seen anything like that before. Please stay in touch with the support engineer.

Thanks!

[JeWe]

Hi,

as support is doing its job, I need to restore the server. Is there a way to decrypt the backup on the backup server in Windows and restore this decrypted backup?

Regards,
Jens

[rovshan.pashayev]

Hello Jens,

I wonder, why you do not use latest version of ISO image (Veeam Recovery Media) for Linux: https://repository.veeam.com/backup/lin ... ery-media/

[JeWe]

Hi Rovshan,

I tried, but the system won't boot with this ISO: Kernel panic.

[rovshan.pashayev]

Hi Jens,

I would recommend to add this information into the case, if it is not done yet.

[JeWe]

Already did that, I still can backup the Linux system, now tried "1234567890". Set up a new encryption password, used this with the backup job. Tried to restore last backup, after entering "1234567890" I get "incorrect password, unable to import"

[rovshan.pashayev]

Hi Jens,

Have you tried booting from the latest ISO, which was published on August 28th, from this link: https://repository.veeam.com/backup/lin ... ery-media/? It's important to boot from the same version of Veeam Recovery Media (VMR) as the Agent.

However, you mentioned that you are encountering a "kernel panic" error during the boot process. There could be several reasons for this, such as insufficient memory.
See the System Requirements please.

[JeWe]

Hi Rovshan,

the version of MUST be the latest, at least in our case (VBR 12.2). Else the decryption will fail.

My problem: I can't boot this ISO, as I get a kernel panic message:
[Firmware Bug]: TSC_DEADLINE disabled due to Errate: please update microcode to version: 02x22 (or later)
Kernel Panic
...

[rovshan.pashayev]

Hi Jens,

Here are three possible solutions you can try:

- Boot with ACPI=off nomodeset line in GRUB section.
- Patch the microcode (BIOS) on your hardware.
- Patch the latest VMR ISO on a system with a relatively older kernel (4.x - 5.x), such as Debian 10-11.
- Follow the instructions provided in the section 'Some hardware is not recognized in the Veeam Recovery Media or you are unable to patch Veeam Recovery Media' on the Veeam KB article (https://www.veeam.com/kb4183).

[JeWe]

Hi Rovshan,

I got it working. The BIOS was too old, but I can't get a newer one.

Solution:
- I needed a most recent Linux installation
- From there: iucode_tool --write-earlyfw=/boot/intel-ucode.img /usr/lib/firmware/intel-ucode
- Took the intel-ucode.img and copied it into the ISO: /boot/intel-ucode.img
- Within the ISO, edited /isolinux/isolinux.cfg, take note of the two "initrd"-lines:
label veeam-recovery-6.1.0-23-amd64
menu label ^Veeam recovery 6.1.0-23-amd64
linux /vmlinuz-6.1.0-23-amd64
initrd /boot/intel-ucode.img,/initrd.img-6.1.0-23-amd64
append usbcore.autosuspend=-1 vga=773 video=auto boot=veeam-live quiet

label veeam-recovery-6.9.7+bpo-amd64
menu label ^Veeam recovery 6.9.7+bpo-amd64
linux /vmlinuz-6.9.7+bpo-amd64
initrd /boot/intel-ucode.img,/initrd.img-6.9.7+bpo-amd64
append usbcore.autosuspend=-1 vga=773 video=auto boot=veeam-live quiet

- Within the ISO, edited /boot/grub/grub.cfg, take note of the two "initrd"-lines:
menuentry "Veeam recovery 6.1.0-23-amd64" {
linux /vmlinuz-6.1.0-23-amd64 usbcore.autosuspend=-1 vga=773 video=auto boot=veeam-live quiet
initrd /boot/intel-ucode.img /initrd.img-6.1.0-23-amd64
}

menuentry "Veeam recovery 6.9.7+bpo-amd64" {
linux /vmlinuz-6.9.7+bpo-amd64 usbcore.autosuspend=-1 vga=773 video=auto boot=veeam-live quiet
initrd /boot/intel-ucode.img /initrd.img-6.9.7+bpo-amd64
}

- Save the changes and boot with the patched ISO

Maybe this helps someone else.

Thanks for your ideas and your help!

[rovshan.pashayev]

Thank you Jens for update!