Linux agent on debian

[matteu]

Hello,

For the first time, I try to backup Debian 11 and Ubuntu 22.04 LTS.
Not an excellent experience

For it to work, I need to install the OS then :

Code: Select all

Install debian 11
apt-get update
apt-get upgrade
Install agent -> failed. linux-headers missing
apt-get install linux-headers-amd64
Install agent -> failed. linux-headers missing
apt-get install linux-image-amd64
reboot
Install agent -> OK

The agent is now installed, I tried to create backup job managed by server but here I have the error about snapshot volume ... I can see in lots of posts here.
After some search, I find it's because I have secure boot enabled (of course I have it ! ) . I tried to disable it -> it works now.

But fortunately, I don't want to disable secure boot on all my VM and I see it's possible to avoid it signing the module and enroll the key to the system as explained here : https://www.veeam.com/kb2260

How do I have to do it ?
Is there an other way to solve it and keep secure boot enabled ?

I want to be sure to understand all the options I have to better give these to my customers.

Thanks !

[rovshan.pashayev]

Hello,

Try to do following steps in order archive Secure Boot:

- Instal Ubuntu in UEFI Secure Boot enabled.
- Do not set Secure Boot password during installation https://ibb.co/fvT0R2P
- After system boot, install dkms package with all its dependencies
- During installation of dkms it should prompt and ask you Secure Boot password https://ibb.co/KWSkMMw
- After setting password, reboot the system and enrol MOK, before system auto boots, just like in the User Guide (blue screens): https://helpcenter.veeam.com/docs/agent ... tml?ver=60
- Once system booted install blksnap and veeam packages in order https://helpcenter.veeam.com/docs/agent ... ver=60#deb

Regarding missing packages, usually (depending on OS version) during blksnap install, apt-get install gives error of dependency and provides command with all necessary arguments to rerun and install all needed.

Rovshan

[matteu]

Thanks for your answer but generally customer have already existing servers...
How is it possible to manage thel without disabling sécure boot ?

Your procedure works for news servers only

[rovshan.pashayev]

Hello,

I tested your scenario in the lab just now and all worked:

• Installed 6.2.0-36-generic Ubuntu 22.04.3 LTS with Secure Boot enabled, hence having machine with Secure Boot just like you have.

• Installed dkms and made sure required dependencies: https://helpcenter.veeam.com/docs/agent ... tml?ver=60

• Installed blksnap and veeam https://helpcenter.veeam.com/docs/agent ... n---ubuntu

• Simple directory backup with snapshot function worked, see https://ibb.co/jVhpFRP

Rovshan

[matteu]

Hello,
Sort for my extremely late answer but I don t forget your help.
I try to test it soon and Keep you informed

[matteu]

I just test now but it doesn't work for me...

I deploy ubuntu
apt-get update
apt-get install linux-headers-6.2.0-37-generic dkms perl libpq5 isolinux
Create protection group in VBR server and let it deploy Veeam agent automatically
restart linux
Create backup job with /roo folder to backup

Test it again -> same error.

Can you maybe say me what are the exact steps you're doing ?

[rovshan.pashayev]

Hello Matteu,

Here are detailed steps:

- Installed Ubuntu 22.04.3 LTS with 6.2.0-37-generic, UEFI Secure Boot enabled.
- Installed necessary dependencies like, linux-headers, dkms, libfuse2, libmagic1 etc.
- Installed blksnap:

Code: Select all

dpkg -i blksnap_6.0.3.1221_all.deb

- After installation you should get information and prompt, asking provide Secure Boot password, see https://ibb.co/QFBzBqD
- Reboot the system and enrol MOK key management, as described in the User Guide: https://helpcenter.veeam.com/docs/agent ... management Note that you must catch the "blue screen" before it boots to the OS automatically.
- After reboot install veeam package itself:

Code: Select all

dpkg -i veeam_6.0.3.1221_amd64.deb 

- Standalone (CLI) and VBR (after adding server into the PG) backup jobs ran successfully (as your example /root directory): https://ibb.co/CHd1FKh and https://ibb.co/6mRK4Zv

I hope these steps will be helpful for you.
Rovshan.

[matteu]

Hello,

Thanks for your answer.
That means you don't install Veeam agent from B&R but manually on each VM right ?

[rovshan.pashayev]

Hello,

Yes, you will need to reboot and enrol MOK for each instance.

Rovshan.

[matteu]

OK, that's probably why it's not working on my side. I install it from VBR server with protection group deployment... I will try it manually today or tomorow (if I have time) and keep you informed !
Thanks

[rovshan.pashayev]

Hello matteu,

With the release of the latest version of Veeam Agent for Linux 6.1, please take note of the following:

Starting from Veeam Agent for Linux version 6.1, for size optimization purposes, Veeam Agent for Linux installation packaging has been reconfigured and now includes the additional veeam-libs package that must be installed before the veeam package.

User Guide: https://helpcenter.veeam.com/docs/agent ... n---ubuntu

Rovshan

[matteu]

Hello,
That mean I just have to install the agent from prote tion group and test again ?

[rovshan.pashayev]

Hello,

In order to solve your initial request (Debian and Ubuntu with EFI Secure Boot), you still have to follow steps which I have provided; standalone installation and key enrollment.
I just wanted to inform you that the installation steps for the standalone agent have slightly changed in the latest version.

Rovshan.

[matteu]

Ok so now to install agent manually I just need 1 command and not 2 !
Thanks

[matteu]

So I do new tests

The thing I need to do is :

Get the latest veeamsnap package from veeamrepo (here for debian distribution)
wget https://repository.veeam.com/.private/d ... 98_all.deb

Install it to add the key for secure boot
dpkg -i veeamsnap_6.1.0.1498_all.deb

After this, I can install the Veeam agent from the veeam server and not at standalone -> better when you have lots of physical server

Thanks for your help

[matteu]

These are exactly all the steps done after the Ubuntu 22.04 installation :

apt-get update
apt-get upgrade -y
apt-get install -y

apt-get install dkms gcc make libncurses5 libpq5 isolinux xorriso -y

Go to https://repository.veeam.com/.private/deb/veeamsnap and copy the link for the last veeamsnap .deb and use it on next step
wget https://repository.veeam.com/.private/d ... 98_all.deb
dpkg -i veeamsnap_6.1.0.1498_all.deb
Set password , reboot and enroll mok key (qwerty keyboard on this step)
Deploy veeam agent from Veeam console

[rovshan.pashayev]

Hello Matteu,

Glad that solution worked for you.

In addition, in case of Debian, if you go on with blksnap package installation, as Debian does not prompt password prompt as Ubuntu, manual request the enrollment of the public key might be needed:

Code: Select all

mokutil --import /var/lib/dkms/mok.pub

Then reboot and MOK Enrollment steps at boot.

Rovshan.

[matteu]

Thanks for your answer.
There is probably something I need to understand :

veeamnsnap package installation is the old way to go and not anymore recommended right ? (if linux kernel version is compatible with blksnap).
I would like to understand better how does it really works....
I install prerequesites for Veeam agent installation, but how do I find the cert needed for UEFI to start with the blksnap kernel ?
When I install veeamAgent, it uses blksnap but there is nothing on path /var/lib/dkms/mok.pub .
Where can I find the public key I need to import with mokutil ?

Thanks

[rovshan.pashayev]

Hello Matteu,

veeamnsnap package installation is the old way to go and not anymore recommended right ? (if linux kernel version is compatible with blksnap).

Yes, VAL 6 has introduced the blksnap kernel module, designed for compatibility with more recent Linux kernels. See the https://www.veeam.com/kb2804.

When I install veeamAgent, it uses blksnap but there is nothing on path /var/lib/dkms/mok.pub .

As I noted in the previously, example Debian 12, once you install dkms and blksnap packages, new blksnap DKMS files will be created:

Code: Select all

# apt-get install dkms
# dpkg -i blksnap_6.1.0.1498_all.deb

Example:

Code: Select all

# ls -l /var/lib/dkms/
total 12
drwxr-xr-x 3 root root 4096 Dec 10 12:37 blksnap
-rw------- 1 root root 1704 Dec 10 12:36 mok.key
-rw-r--r-- 1 root root  811 Dec 10 12:36 mok.pub

Rovshan.

[matteu]

Oh ok !
On debian 11 how does it work ?
Because when I installed veeam agent linux from vbr server it install with blksnap but nothing on the folder.

[rovshan.pashayev]

Hello Matteu,

Which exact version of VBR are you using in this scenario?

Rovshan.

[matteu]

Hello,

12.0.0.1420 P20230718

Thanks

[rovshan.pashayev]

Hello Matteu,

In that case (Debian 11), you need to either sign the module on your own and register the key with system or disable the Secure Boot feature.

Rovshan.

[RandomTrooper]

I'm still struggling with this. I entered

`mokutil --import /var/lib/dkms/mok.pub`

It asked for password input (2x) and I did so, then rebooted and reran backup job. As before it failed. What am I missing? The logs show noting helpful



Thank you.

[rovshan.pashayev]

Hello,

After reboot, did you run these steps: https://helpcenter.veeam.com/docs/agent ... olling-mok ?

If not, run mokutil command & reboot, so you get to that step again.

[matteu]

To be honest, the step by step are not really good on it because it always depend on the version of the OS...

[rovshan.pashayev]

Hello,

What do you mean exactly? All steps which I have provided to you, are tested on the exact OS and Kernel version of yours.

[matteu]

I give up for debian because I never had :
mokutil --import /var/lib/dkms/mok.pub

the mok.pub didn't exist.

Maybe I'm wrong, but I think I never have it to work on debian.
But to be honest, the biggest issue is probably because I'm bad with linux system and I don't understand exactly what I'm doing with these commands.

[rovshan.pashayev]

Hello,

If you are still using Debian 11, I would suggest to upgrade OS, as general best practice.

[matteu]

It s not for myself but for my customers and sometimes they need to stay on the v11 for some reason. If I could help them it s better than not

I was just asking for a working step by step but I m not surre it s easy