[RELEASE] Managed Hardened Repository ISO by Veeam

[musicwallaby]

I wanted to say a massive thank you to Veeam for providing this ISO.

I have a few customers who have spare hardware laying around but they don't have super deep pockets and this has made a really easy way to get an additional set of backup copies in place that are immutable and where we don't have to manage Linux systems in depth to do it.

Really impressed.

If I was to offer one tiny criticism it's the disk requirements. I get why it's done the way it is but it would be great if there was a way to partition a one disk system because that single disk might be a 50TB hardware RAID6/60/10 whatever volume underneath.

Jas

[Gostev]

Why would you want to further divide such already small disk?

[musicwallaby]

Hello

Some question/feature request
To install, you need 2 devices (sda/sdb), it would be nice to make it possible to install with one device on which to make 2 partitions (sda1/sda2).
I have to allocate 2 disks to a separate raid group, which is not very good for free space. For example, if I had a server with 8 disks, I would just make 7 disks with raid6 + spare, but now I have to make 2 disks raid 1 + 5 disks raid6 + spare.

It's this sort of thing mate.

With some enterprise servers like Dell you can only make virtual disks from physical disks so if I have a spare server with 8x2TB drives and I want to repurpose for this, without buying extra drives (and the chassis having space) I need to use at least 1x2TB drive just for the boot disk of the repo so I can "only" use 7x2TB to hold backups.

It's not a massive issue just something that would be nice if with a single 8x2TB RAID6 disk the installer could create the boot volume and then use the rest for storage.

Hope that makes sense.

Jas

[HannesK]

Hello,
yes, it makes sense.

As of today, the solution would be to use self-managed Linux distros (Ubuntu, Rocky, etc.). The background of the decision to require two disks was to have a simple implementation option for a "repair" mode (which just deletes the smallest disk and re-installs the operating system on that smallest disk).

Best regards
Hannes

[musicwallaby]

Thanks and yes from that perspective it makes sense.

I'm happy to lose the capacity it's just something for the "nice to have" list maybe.

But I far prefer just using the Veeam supplied ISO

[Nas]

How do I avoid the JeOS installer from coupling the remaining disks into a single logical volume?

My Dell R740xd2 has the following disk layout.
1x Dell BOSS RAID1 virtual disk 480GB <- for system
1x Dell PERC RAID6 virtual disk 280TB <- for repository
2x Non Raid direct attach 480GB SSD

During installation, JeOS automatically chose RAID1 as system disk which is expected, but it also also created LVM combining RAID6 + the Non Raid SSD.

[Gostev]

Disconnect it before deploying.

[JaySt]

Deployed the VHR ISO on a HPE DL380 Gen12 with a 10Gb 2-port SFP+ BCM57412 adapter.
It has trouble with the network interface activation and/or configuration. I can't get it to work.

[Nas]

Using the latest VIA ISO to deploy VHR, there is mandatory step to configure MFA for the repository, would it be possible to skip this MFA thingy during the initial setup wizard like the previous VHRv12?

[Nas]

Deployed the VHR ISO on a HPE DL380 Gen12 with a 10Gb 2-port SFP+ BCM57412 adapter.
It has trouble with the network interface activation and/or configuration. I can't get it to work.

Are you using Cisco ACI in your networking?

[JaySt]

No.
I think it's just kernel / driver related here.

[Gostev]

I'm positive that we have HPE DL380 Gen12 in our labs since summer and that there are no issues with the system, however knowing our QA labs networking it's likely fitted with BCM57416.

[JaySt]

ah yes. That's the BASE-T model. But in that case, i would not expect that much difference in handling then. Strange.
I'll see what i can test more.

[Gostev]

Exactly my thoughts too. It appears to be a fairly old adapter that has been used in HPE systems for a while, so something is off.

[JaySt]

any suggestions for a distro i could use to troubleshoot this more on the cli? One that is closest to the one the ISO is using right now? Rocky, some version i think?
as i can't do anything on the VHR in that regards.

[Gostev]

VHR V2 uses more or less vanilla Rocky AFAIK.

[JaySt]

ok that "narrows" it down to Rocky Linux 9.0 to 9.6
if 9.x was used offcourse..

[matteu]

Hello,

I'm not sure to understand what can I use for v12 and what can I use for v13.

I guess Jeos is only since v13 but maybe I missunderstood something.

I have a v12.3 installation and I need to change architecture.
1) I would like to know what is the recommended way for Hardened linux repository for it ?
I knew the ISO v1 and v2 for HLR but now, is it v2 I need to use or something else ?

I understand the Veeam BR appliance is just since v13 and same for Enterprise manager.

2) Then, to connect repository to VBR server, what is the way to use ? I didn't find a way with the jeos ISO installation to use single use credential on the repository but only the ssh key because of the new package included.
I see this on the documentation for v12: https://helpcenter.veeam.com/docs/backu ... ml?ver=120

Thanks for your help.

[Gostev]

1/ You can only download V2 so don't worry about getting a wrong version.

2/ Yes, just follow the manual you linked. You won't be able to register a hardened repository other than by using single-use credentials.

[matteu]

@Gostev

thanks for your answer.

That mean for V12 installation, I need to use the V2 HLR linux iso (and connect it with single credential) and for V13 installation I can use the infrastructure appliance iso (and connect it with certificate) right ?

[Gostev]

Yes.

[matteu]

Thanks for your answer.
Last question : Is it recommended to set an NTP server or not for security reason ?
If yes, what should it be ? External or internal ?
Thanks

[Gostev]

Google AI overview says:

Yes, it is recommended to set an NTP server for security reasons, but running your own internal NTP server is better than using public ones. While using public NTP servers is common, it creates security risks by requiring your network to open a channel to the internet, which can be exploited for Denial-of-Service (DoS) attacks and other vulnerabilities. An internal NTP server eliminates these risks by keeping time synchronization internal to your network.

[matteu]

For sure I don t want an AI answer....
I ask it because if an attacker is in the environment it will try to destroy active directory server and can change the time. Domain controllers servers are often used as ntp server on my customer and I asked it because AI is rarely the best friends when you need answer about some specific scenarios
However, because there is a tipe shift detection (and protection) with vbr it s maybe not so much important the source used I Guess...

[Gostev]

It's not an "AI answer" in a classic sense. Google AI overview merely summaries the top search results, which for technical queries are related discussions on various technical communities. It saves me a ton of time which was previously spent clicking through and reading all those Reddit threads

As for domain controllers, since they are just as often used also as DNS servers, it means that if they are taken over by an attacker, then in theory they can also control the NTP server you're ultimately connecting to, even if you use an external one?

So I did more Googling and apparently there are boxes that provide a hardened internal NTP server for just a hundred bucks.

[JeineAnz]

Hi, I'm trying to download the ISO of the Veeam Hardened repository, but I can't find it anymore . Is it still possible to download it?

[Dima P.]

Hello Jeine,

Stating from v13 release Veeam Hardened Repository is deployed from Veeam Infrastructure Appliance image (there is a corresponding option in the GRUB menu when you load it). Please go to MyAccount > My Products and image will be at the bottom of the page under additional downloads: https://my.veeam.com/my-products

Thank you!

[Gostev]

@Dima P. please make sure VHR ISO V2 is still available for V12 users to download. To avoid confusion, we can have it under the Previous Versions tab only.

[Dima P.]

Sure, already asked web folks to keep it under Previous Versions.

[EviLin]

Is it understood right, that now we can upgrade current working V2 Veeam hardend repos with the new Veeam Infrastructure Appliance V13 iso?
And it keeps all the backups etc.?

Of course after VBR v12 is upgraded to v13.