Failed to find IPS repository compatible with the distribution constructor configuration

[spacedoutcat]

Hi,

Using Veeam agent for Solaris, we are attempting to create Veeam Recovery Media at command line using command:

veeamconfig createIso --output /b01/backup/veeam_recovery_media/vrm-sdt-rbedb01.iso --overwrite

This gives us the error:
"Failed to find IPS repository compatible with the distribution constructor configuration"

Although we have raised a call it is taking quite a long time to be looked at so I thought I would post here.
Call number: 05908654

Many thanks, Daniel

[HannesK]

Hello,
and welcome to the forums.

I read through the support case and my understanding is, that the server has access to the IPS repository.

My suggestion would be, to use the "talk to manager" button in my.veeam.com to escalate the case.

Maybe also add the output of "pkg publisher"

Best regards,
Hannes

[spacedoutcat]

They have come back to me and advised that apparently Veeam will only create recovery media if the IPS package repository uses http. It doesn't support https.
This is ridiculous as effectively Veeam are saying to go against recomended Oracle setup & to compromise security to achieve what should be a basic function.

The final comment on the call is that the developers are looking at fixing this, the implication being that the Solaris agent has been rolled out in an as yet unready state. It is very disappointing.

[HannesK]

Hello,
agree, requiring HTTP instead of working with HTTPS looks not so great. On the other hand, Solaris should verify signatures of all packages per default. By doing that, it's irrelevant, whether the transport is via HTTP or HTTPS, because all modifications would be detected anyway when checking the signature. Signature checks are the reason why some Linux distros still use HTTP per default. HTTPS is not offering additional security from a package manager perspective.

just to re-confirm: is the workaround with uncommenting the HTTP source in /etc/veeam/builder-config.yml working?

Best regards,
Hannes

[spacedoutcat]

No, the package repository is https so that is not possible unfortunately.
We have to wait until Veeam fix this in a later release.

[HannesK]

Hello,
well, it might take long time (if ever) to fix that. The Solaris Distribution Constructor (which we use) has some limitations around HTTPS and we cannot really do anything about that.

As all packages are signed anyway, I'm not really sure, how HTTPS is increasing security. My Solaris 11.4 is using HTTP per default.

Best regards,
Hannes

[spacedoutcat]

Thats a really unhelpful and strange response. We are not using a non-standard setup so either Veeam works for Solaris or it doesn't. You seem to have it working for some sites and not others by this reckoning.

And if there's nothing Veeam can do about it, why did the support engineer advise me it would be resolved in a later release? It seems more likely that it is 'difficult' rather than not possible. And difficult should not stop a major software supplier from fixing an issue.

Thanks, Daniel

[PTide]

Hello,

Our tool that creates custom ISO invokes distribution-constructor (Oracle’s tool), and so far it seems that the constructor ignores SSL key which required to connect to SRU (you can see the key if you run pkg publisher).

We are currently working with Oracle representative to figure out the reason why it happens.

As for the support response that the issue will be fixed - I think an internal miscommunication took place as it's still not clear what's the root cause.

Thank you!

[spacedoutcat]

Thanks ptide. Its helpful to know it is being looked at. Thanks again.

[spacedoutcat]

Hi, just for info, I have decided to have a look at the Distribution-Constructor and when running this, it actually does access the IPS using http

Code: Select all

Snippet from log:
17:06:07    Creating IPS image
17:06:35    Installing packages from:
17:06:35        solaris
17:06:35            origin:  http://pkg.oracle.com/solaris/release/
17:10:08    The following licenses have been accepted and not displayed.
17:10:08    Please review the licenses for the following packages post-install:
17:10:08      release/notices
17:10:08    Package licenses may be viewed using the command:

[PTide]

Huh, that's funny, because I was just about to offer you to do what you've done!

Anyway, I'll update this thread once we get a meaningful reply from Oracle.

Thanks!

[spacedoutcat]

Unfortunately we cannot even test now. We have just migrated our test server to new hardware and now the command doesnt run properly:

Code: Select all

root@sdt-rbedb01:/etc/veeam# veeamconfig createIso --output /b01/backup/veeam_recovery_media/vrm-sdt-rbedb01.iso --overwrite
Unknown argument: [createIso].

NB as part of this process, we had to re-register the server with Veeam as none of the backups were working. But now everything else is working apart from this command.

[PTide]

It's hard to guess what could be the reason without seeing the product logs.
Our support team is probably your best bet at this point as we don't normally do deep troubleshooting on the forum.

Thanks!

[spacedoutcat]

Yes we have indeed raised a call on this -

By the way, my colleague installed an x86 Solaris instance at home so that he could test some things. It was a basic vanilla install but connects to IPS using https as per our on-site server.
He initially had the same issue as us and so uncommented the three lines in the 'repository' section of /etc/veeam/builder-config.yml. The result was that the Veeam Recovery Media creation tool started working.

We couldnt get the same result with our on-site server so we are now curious as to why my colleagues home install worked. We cannot see any specific differences at the moment.