[RELEASE] Managed Hardened Repository ISO by Veeam

[fezzebru]

Hello HannesK / Gostev -
We have installed our large storage arrays and are beginning the POC, we would like very much to work together to try to assist you on this for multipath and SAN and large volumes. Next week we will start a 3x SOBR with 400TiB luns (400TiB just seems like a good number?) with 2 servers, so 2.4PiB (2x3x400TB) total, total array is 4.2PiB. We have 1 of them in 2 different locations.
We have POC for 30 days and can do multiple things to your liking.

Is there a way to try this and work together? We are willing to dedicate FTE to project for the betterment of the community and ourselves.

[HannesK]

@cmcawood welcome to the forums! I think there is good news... the next version of the allows to get root with four-eyes approval. Limiting sudo permissions to specific commands has challenges around these commands being mis-used. Instead of giving a "false sense of protection", the "root option" will make clear that one has full permissions now.

@fezzebru: thanks for the offer. Supporting SAN / multipathing storage is out of scope for V13, but I will reach out to you via email to look into some details how multipathing configurations could look like (different vendors have different settings from what I have seen so far)

[cmcawood]

Hi Hannes

That sounds awesome! Now the only question is... when can we get the new release

Looking forward to it!

C

[HannesK]

the Veeam Software Appliance was announced for Q3 and Veeam Data Platform V13 for Q4 at VeeamON

[dloseke]

Can confirm that the VHR ISO was able to be deployed to a Dell PowerEdge T160 with a 480GB RAID 1 BOSS-N1 card for the OS and (3) cabled 8TB drives in RAID 5 using a PERC H755 card for the repo. Processor is an Intel Xeon E-2468 2.6G 8C/16T and 1x 32GB DIMM. Makes for a nice little platform actually.

I will note that I learned something with this deployment in that I used a local keyboard and mouse when deploying the VHR ISO from a thumb drive, but then we placed the server on-site and tried to complete the deployment using the IDRAC console, the virtualized Dell IDRAC keyboard and mouse were blocked from use. I had to redeploy the VHR via the IDRAC to get past this. It's possibly noted somewhere that USBGuard is enabled in the VHR, but I wasn't aware of it until I ran into the issue, and others I've talked to about it weren't aware of this restriction as well. I'm assuming that devices present when the OS is deployed are whitelisted by default, so if deploying locally, I'd suggest noting that any out-of-band management (IDRAC, ILO, CIMC, IPMI, etc) be present and mounted up when deploying the ISO to prevent this issue in the future. Otherwise, I'm not sure if there's any inherent security risk in doing so, but it appears that rule matching can be enabled with USBGuard to allow any keyboard and mouse connected to be utilized.

https://unix.stackexchange.com/question ... -and-mouse
https://access.redhat.com/discussions/2 ... fd599242cd

[mengl]

I have recently installed a few more repository servers. In the process, I have noticed two further potential improvements.
1. It would be nice to have a quick menu item to display the current network configuration, especially regarding DHCP IP (on a temporary installation network).
2. NTP should be configurable without a functioning network. The use case is to install a server in the lab and use the network configuration of the customer environment (IP + NIC teaming). Since the NTP servers cannot be tested successfully in this way, the setup wizard seems to ignore the settings completely and leaves it at Rocky Linux default. A later configuration via the VHR GUI is unfortunately not possible, as the interface does not offer the option of configuring an NTP pool.

Do you also have plans to support a split network configuration? Eg to have a a 10G adapter for management/updates and a ~100G adapter as direct p2p connection to SAN proxy servers.

By the way: So far no problems on various HPE servers
DL345 Gen11: Smart Array p932, MCX6314LX 10/25G ns204i-u boot device
ML350 Gen10: Smart Array p408 + SAS expander, HP Ethernet 10Gb 2-port 530SFP+ Adapter, ns204i-u boot device
DL380 Gen10: Smart Array p408
Will have a HPE Alletra 4120 next days