[RELEASE] Managed Hardened Repository ISO by Veeam

[HannesK]

Searching for ISO in the top left search of helpcenter in the Veeam Backup & Replication guide shows the link I posted above as answer for the same question

[ITP-Stan]

Thanks!
So, I see the installer uses all the large disks it finds together as 1 large volume (no mirror).
That's fine for my simple test PC.

I've re-read your reply about the disk requirements.
I don't understand why my first test with 1x 240GB SATA SSD and 1x 4TB HDD failed.
But that's not really important, as just testing this.

I must say the whole process is pretty smooth, nice job.
Just 1 gotcha, do not switch USB keyboards, mice or hubs after the install, USBguard blocks them

[HannesK]

yes, mirroring (or whatever redundancy) is done by the RAID controller (system requirement, but we don't enforce specific RAID controllers because we don't want to block VMs, although not recommended in general)

thanks for heads up on the USBguard. I will see where we can add that to the documentation (it's a feature that comes with the DISA STIG security profile)

[bgenner]

Hi, I just deployed this as a test and I had no opportunity to add a username and password. Now the linux server sits at the login screen and I have no credentials.

[bgenner]

I too have no info on username and password after I installed the Rocky ISO.

[HannesK]

Hello,
and welcome to the forums. As the same question about the password came up 3x already in this thread (links to the answer are also above), we will think about built-in hints at the login screen.

username: vhradmin
password: vhradmin

Best regards
Hannes

[johannesk]

@cmln: it will fail if it's detected as multipath device (which I assume the setup will be)

Will multipath devices be unsupported in future releases of the ISO?
And will this limitation/feature currently prevent LUN's from a multipath device to be presented after the installation of the ISO?

regards,
Jóhannes

[HannesK]

Hello,
there are currently no timelines for multipathing support, but I add you +1 to the request.

If you get root after a successful installation, then you can do everything. There is nothing in the software that blocks multipathing. It's just in the installer.

Best regards
Hannes

[jortie]

I deployed this ISO in a Hyper-V VM. When I connect Veeam to the repo and accept SSH thumbprint I get this error:

CSshShellStreamRebex

Ant thoughts?

[Gostev]

Perhaps some old VBR version is used. Or VBR has some reg mods applied to modify its default SSH client.

By now the ISO is so widely adopted that any issues encountered can only be environment-specific, so you should always open a support case for troubleshooting the environment instead of asking here. As we're well past common issues affecting multiple customers.

[BrianBuchanan]

I initially created the bootable usb stick using Rufus in the default "ISO Image" mode. This resulted in an installer that booted and appeared to work just fine. I was able to setup the network and NTP. But, when I clicked to start the install, it progressed through the first few steps before failing with an "unknown error". Fortunately, I found a forum post here that clarified that "DD Mode" is required when using Rufus. Given how popular Rufus is, and the fact that the non-working mode is the default, I think it would be nice if the documentation had a warning note. It would also be great if the installer could detect that it was improperly created and give a more informative error.

Code: Select all

Creating xfs on /dev/mapper/datavol-veeamrepository01

Running Pre-installation tasks
An unknown error has occurred

Thanks for the tip! I was struggling with the "unknown error" pop-up until I saw your comment. Rewrote the ISO in DD mode with Rufus and it worked fine. (Just learning the ISO on an Optiplex 3070, nvme, sata ssd, usb hdd, and wifi which is so far from normal that DD mode wasn't even a thought)

[cmln]

I'm assuming that you're using an HBA355e SAS HBA to connect to the array? In that case, you'd just create a volume on the array, create a server using the SAS HBA ID and map the volume to the server like one would normally do. Once that is done, boot up the ISO and if all is well you should see the local storage/volume as well as the volume you've mapped to the server. I'm assuming that you're using local storage for the OS, but if not, I would assume you could create two volumes, one at around 100GB for the OS, and then a second larger volume for the repo and the installer with some luck would find both of them.

Hello dloseke,
I did the installation as you describe and it was successful
Install Powervault
Create Host in powervault
Create volume and publish in Powervault
Then on the server I started with the ISO file and during installation I get 3 disks.
1 OS of 450GB and 2 disks “128TB” from the Powervault.
After installation I opened a Putty session and did a df -h and there I could see a mount point of 245TB
Cheers

[Everl0ng]

Monitoring and Alerting

We have been using these hardened appliances for a couple years using the Ubuntu and Veeam best practices. One of the integrations we have is for our Splunk environment to monitor/alert off of any unknown activities (Logins, SSH enable, files deletions...). I just built out our first hardened appliance using this ISO and we are doing some testing with this new install. One of the questions that came up is how we can integrate into Splunk to get similar alerts. Do we have the capability to integrate into a Splunk like system? Just looking to see what is recommended for monitoring/alerting with this new build out.

Thanks

[HannesK]

Hello,
and welcome to the forums.

As of today, there is no syslog support for Hardened Repository ISO. While you could technically add it by adding whatever monitoring agent you had before, that could cause issues if you ever need to open a support case, because modifying the appliance is forbidden.

If you have the knowledge how to do all these things, then the recommendation is to continue using that. The ISO is mainly targeted for customers that do not have such knowledge.

Having that said: I add your request +1 to the existing feature request "syslog support for alerting"

Best regards
Hannes

[HannesK]

Hello,
I’m happy to announce the availability of Hardened Repository ISO 2.0 with the following new features and changes:

Repair mode
• Re-installs only the OS while keeping the data partitions intact.
• Please note that repair functionality cannot be used for migrations from Ubuntu or any other Linux distributions. The system will fail to boot and you would need to fix /etc/fstab manually.

Live boot
• Provides a live system for troubleshooting. It's mainly built for use by Veeam support, however experienced Linux users can also use this for example for performance testing with fio or iperf.
• There are three scripts to mount data disk, operating system disk and collect hardware information in the home directory of vhradmin.

Fully automated installation / Zero-touch installation
• This uses regular kickstart and was designed to allow mass deployments or unattended (lab) installations. Public documentation can be created depending on demand. In general, the kickstart documentation from Red Hat can be used.
• To get "zero touch installations" working, add auto=1 to the kernel parameters in the grub bootloader. In the ks.cfg ensure to set keyboard layout, time zone and disable the cdrom installation source.

The following other changes were implemented in version 2 which are not really “features”
• System requirements change: the operating system disk must be the smallest disk. This is to ensure “repair” deletes the right disk.
• IPv6 DHCP support (UDP port 546 is open now).
• Allow "ping" with rate limit of 5 pings per second for easier troubleshooting.
• Additional warnings before installation / repair formats disks.
• Help text was adjusted.
• Network configuration is now mandatory.
• The "installation destination" button is non-clickable anymore to avoid confusion with that wizard.
• The "pre-release" warning was removed.
• the faillock configuration was changed so that a locked user will get unlocked automatically after 1min

Best regards
Hannes

P.S. The documentation in https://helpcenter.veeam.com has already been updated

[Seve CH]

Create Host in powervault
Create volume and publish in Powervault
Then on the server I started with the ISO file and during installation I get 3 disks.
1 OS of 450GB and 2 disks “128TB” from the Powervault.
After installation I opened a Putty session and did a df -h and there I could see a mount point of 245TB
Cheers

Hi Chris

Are you using multipath? or using only one target/SP?
If using multipath, is Linux using the multipath device or it's using one of the single devices?

Example using lsblk:

sdc and sdm are the two paths used by mpathb.
sdd and sdo are the two paths used by mpathc.
LVM is using mpathb and mpathc for vg_R01-lv_R01, mounted on /mnt/R01.

Code: Select all

sdc                         8:32   0 116.4T  0 disk
└─mpathb                  253:1    0 116.4T  0 mpath
  └─vg_R01-lv_R01         253:11   0 440.2T  0 lvm   /mnt/R01
sdd                         8:48   0  58.2T  0 disk
└─mpathc                  253:3    0  58.2T  0 mpath
  └─vg_R01-lv_R01         253:11   0 440.2T  0 lvm   /mnt/R01
sdm                         8:192  0 116.4T  0 disk
└─mpathb                  253:1    0 116.4T  0 mpath
  └─vg_R01-lv_R01         253:11   0 440.2T  0 lvm   /mnt/R01
sdo                         8:224  0  58.2T  0 disk
└─mpathc                  253:3    0  58.2T  0 mpath
  └─vg_R01-lv_R01         253:11   0 440.2T  0 lvm   /mnt/R01

This is in fact just an LVM setting (device priority on discovery). If it is not implemented, I think it would be easy to implement for the next release

I am a "box hugger" and I prefer having dedicated storage instead of internal storage. It makes server and storage scaling and migration much easier.
I prefer to implement a server + MSA/PowerVault with SAS attachment per repo instead of the Apollo-like "one all-in-one big server".

Best regards
Seve

[cmln]

Hello Seve,

It's a sealed Rocky Linux provided by Veeam, there is almost no posibility to use command line.
The service account that is used has also no root access, that is also a feature that needs to be added.

Regards
Chris

[NightBird]

Always on experimental support ?

[Gostev]

Worst case only until V13.

[Dynamic]

Hello,
I’m happy to announce the availability of Hardened Repository ISO 2.0 with the following new features and changes:

Repair mode
• Re-installs only the OS while keeping the data partitions intact.
• Please note that repair functionality cannot be used for migrations from Ubuntu or any other Linux distributions. The system will fail to boot and you would need to fix /etc/fstab manually.
......
Best regards
Hannes

P.S. The documentation in https://helpcenter.veeam.com has already been updated

Thanks Hannes and team for the new update!
just some question from my side:

- related to current installations on (i think it was 0.1.17): can we update them to 2.0 by the built-in update function, or should we go with the Repair option? (sorry i cannot find an updated documentation on https://helpcenter.veeam.com for the VHR itself, maybe its mentioned there)

- we talked about a while about a Repair function to switch or migrate from Ubuntu to the Veeam ISO version. Currently, as far as i understand it's only for Repair or new Install of Rocky itself. Is this still planned / on the roadmap? Manually fix the fstab wouldn't be my first joice


Thanks, Markus

[HannesK]

Hello,
to get changes to the operating system (ping, faillock configration, DHCP v6), the only way is "repair". The question is, whether it's worth it. Repair is described here. There are no changes to the configurator except that the license agreement was added. The Configurator would be updated automatically (or by clicking "update all").

Correct, migrations cannot be done with the "repair" option and I will add you +1 to the existing feature request.

Best regards
Hannes

[chris.childerhose]

I am interested in the update feature as well with 2.0 and will be testing it next week. Looking forward to the changes.

[axemann]

hi, is there a way of expanding the data-volume? for example if disks are added (or in my test-szenario, the virtual disk is expanded?)

This was asked some time ago, but I didn't see an answer. Is this / will this be possible?

Thanks!

[Gostev]

The answer is in the next immediate post

[mrmagicman]

Does the system *require* an internet connection? Obviously for updates but if we want to upgrade to a new version offline in the future we can just load up a newer version of the ISO and upgrade?

[HannesK]

Hello,
and welcome to the forums. No, internet connection is not needed (see initial post) for install / repair / live boot (as you say, updates from repository.veeam.com won't work without internet). That was the strongest feedback we got long time ago when the first build required internet.

Best regards
Hannes

[IanBolton]

Just having a play with this on a VM for now (testing only!)

Everything is installed as per the guides, but when I come to create the repo, it tries to install the required components.

Infrastructure item save failed Error: Single-use credentials require Veeam Data Mover service installed.
I know the SSH creds are correct, is there anywhere I can look for any specific information to troubleshoot?

It *feels* as if there is something missing on the build which the 'add linux server' thing is expecting. Or have I missed a step without realising?

[HannesK]

Hello,
please open a support case for investigation. We don't have any Veeam Backup & Replication components pre-installed on any of the ISOs today.

Best regards
Hannes

[axemann]

The answer is in the next immediate post

Ha! Looks like it's time for me to get some new eyeballs, or learn how to read again...

[BostjanUNIJA]

Hi.
Just tried the latest ISO of hardened linux Veeam repository in my LAB and worked like a champ.
I was strugling first to deploy it on ProxMOX lab server but got stucked with Secure boot.
I have deployed this on Hyperv 2025 evaluation as a VM and works as expected.
Nicely done.
Although in the production we would probably go with different linux distro, to have more control of the OS, but nevertheless I like Rocky (luckily have some knowledge with CentOS 6&7).
Just wanted to say thumbs up!