[RELEASE] Managed Hardened Repository ISO by Veeam

[harbinger]

Correct, migrations cannot be done with the "repair" option and I will add you +1 to the existing feature request.

Please add me also to this feature request since we have some repositories running on Ubuntu 2004 we want to migrate. Is there a chance this will be released before the EOS of Ubuntu 2004 in April this year?
The last I've seen is that ubuntu 22.04 is still not officially supported with the Veeam Disa Stig profile.

[HannesK]

@BostjanUNIJA Thank you! And for those customers who want to control the operating system, they would use whatever Linux distro they like. The ISO is for customers who want Veeam to control the OS

@harbinger : I added you. And unfortunately there is no chance to get that released before April this year. Ubuntu 22.04 should have a STIG profile according to this blog post (I did not investigate further as our focus is on Rocky Linux since quite some time now).

[harbinger]

Thank you for the fast reply. Since we have Backup copies to other locations, it shouldn't be a problem to wipe the existing VHR and reinstall them with the new ISO.
Is it possible to link existing backup copy chains with a new primary backup chain?

[mengl]

Installed successful on an old HPE ML 350 Gen10 box.
I am very impressed that it combined both arrays to a single large lvm volume.
That ISO makes deployment easy and very fast. Thanks!

I am interested to see what the day-2 behavior looks like on a longer time frame.

HannesK: added HPE ML 350 G10 to the list

[HannesK]

@harbinger: No, mapping backup copies to backup jobs does not work today. To continue to get security updates, I would personally upgrade to Ubuntu 22.04. There is nothing wrong with Ubuntu 22.04. as far as I see.

@mengl: thanks for reporting I added the server to the list. Do you maybe some more details about RAID controller and network card that I could add to the list?

[stre1026]

Believe it or not, this is actually the first time I've heard of the hardened repository ISO. I have been running mine on Ubuntu. I would really like to migrate if at all possible. Is there a path to migrate or am I stuck rebuilding the servers from scratch? If so, can I keep my data somehow? They are used for my primary backup and the secondary offsite repos.

[HannesK]

Hello,
there are unsupported options for migration that we can discuss in a separate thread. It's fine to add feature requests here and I added you also +1 for "migration support", but let's put the "how to do unsupported things" into separate topics for readability of this topic.

I would link the new thread here later.

thanks,
Hannes

[AlexandreD]

Hello,

I have the following configuration :

Dell R760XD2
Mboss card 480 GB
Raid volume 24x20 TB RAID60
2x NVMe device 1.92 TB (the idea was to create a software raid with this 2 disks, and have a very fast backup repo). Unfortunately i read in the helpcenter that softraid is no supported.

At installation summary, i have the following error at installation destination level "Kickstart insufficient". I have no more info, and i cannot select manually disks.

Someone have also this error ?

Thank you
Alexandre

[chris.childerhose]

@HannesK - If we used the previous release of the ISO 0.17 can we use the new 2.0 to run a "repair" on the OS? It would be the same Rocky Linux. I understand migration from other Linux distros.

[MVanek]

Hello,
Mainly thank you for exceptional work!
Please is there or are you planning to provide possibility to edit /etc/hosts within provided user interface.
Within small environments i like to maintain static dns entries to keep backup world as independent as possible.

With dedicated network interfaces for backup purpose and hostnames usually related to production fqdns only is creating static dns entries in hosts files the only way

Thanks
Martin

[HannesK]

@AlexandreD: Yes, I have seen that error when there was an LVM created by Hardened Repository ISO and then RAID was re-configured (that can be fixed manually). But I guess that does not help, so please open a support case and post the case number for reference. The hardware you have is confirmed to work earlier in this thread. Disk selection is not allowed because it creates too many side effects. The hardware must meet the system requirements and then disk selection should not be needed.

@chris.childerhose : yes. Version 0.1.17 and 2.0 fall under "You can repair a hardened repository installed from the Veeam Hardened Repository ISO"

@MVanek: good idea, noted

[AlexandreD]

Hello HannesK,

yes, I open a Case #07592052

Thank you
Alexandre

[chris.childerhose]

Thanks for the clarity Hannes. Will try this option for existing VHR servers.

[BenM2024]

Hi Hannes

Just installed VHR 2.0.0.8 on a Dell R620, Dual Xeon Silver CPU, 144Gb RAM, Dell H710P Mini PERC, 8x900Gb HDDs, 1 120Gb SSD. Used a bootable USB created using Rufus DD (Thanks to this thread I caught that in time)

Installation went fine (second time - first time I was too eager and needed to adjust a few things hardware/UEFI BIOS wise) and the TUI works so I guess the respository is running... at least I can ping it.

However adding the repo as a Backup Respository to VB&R 12.3 seems tricky - mostly becasue I can't find the VHR documentation on the helpcenter. Any chance of a direct link to the docs? Even selecting all products and all document types I can't see VHR referenced anywhere.


HannesK: added Dell R620 to the list

[chris.childerhose]

@BenM2024 - here is a link to the documentation for configuring the VHR as a repo - https://helpcenter.veeam.com/docs/backu ... ml?ver=120

[BenM2024]

@Chris.childerhose - Thanks for that - everything seems to be working
@hannes - Server definitely worth adding to the unofficial "works with VHR ISO" servers list.

[AlexandreD]

Hello HannesK,

yes, I open a Case #07592052

Thank you
Alexandre

Hello
So i had a doubt yesterday and this is confirm this morning when i remove the 2 nvme drive of the server. Installation is now runnning.
Finally, for the installation, we have to delete the unused disks and leave only two volumes, the OS and the DATA. I will add the nvme disks after the installation.

[chris.childerhose]

@Chris.childerhose - Thanks for that - everything seems to be working
@hannes - Server definitely worth adding to the unofficial "works with VHR ISO" servers list.

Great to hear. Glad to have helped.

[omsaay]

I used the repair option to upgrade from version 0.1.17 to version 2.0.0.8 and it did it without problems, when It finished, I could see my backups made in the previous version and they are perfect, question, how can I verify that I am indeed in the new version?

[HannesK]

In /etc/os-release there is the VARIANT_ID="2.0.0.8" which identifies the installation version of the ISO. The easier way is to ping the machine. Version 0.1.17 drops ping.

[jb16wer]

Great to see V2!
I have a couple of questions from a customer regarding maximum number of workloads / capacity. I know what the recommendations are for a normal repository but wanted to check here to see if there were any variations for the VHR.

[Gostev]

Right, absolutely no difference. We're merely simplifying many things here, but the end result is no different from a backup repository that was self-provisioned on a fresh Rocky or RHEL OS install.

[mra]

Successful Installation on Cisco UCS C240 M5, FW 4.3, 12G MRAID, Intel X550 Nics - Bonded: Round Robin

[HannesK] thank you, added Cisco C240M5 to the list

[palmo26]

Documentation says internet access isn't needed for installation, but I can seem to get it connected to my vbr until I run an update on it. Does anyone have good documentation on setting up an http proxy for patching an system that can't directly access the internet?

[HannesK]

Hello,
and welcome to the forums. I run (and we test) Hardened Repository ISO without internet connection. It does not require internet to get it connected with VBR. We have one open case (not in this forum thread) where adding Hardened Repository to VBR fails where we still investigate why that happens. Do you also have a case open so that we can check whether it's the same error.

Besides of the user guide, I'm not aware of HTTP proxy documentation. Do you try to use an HTTPS proxy? If yes, did you use the following format: http://proxy.dns.or.ip.address:port ? It needs to have http (without s) as prefix. And second question if you use an HTTPS proxy: is the certificate signed by your enterprise CA? Because that enterprise certificate authority would not be trusted and the connection would fail.

Summary: it works without internet in general and if not, then we need to check with support why that is (please post the case number, so that I can check with the other case)

Best regards
Hannes

[sig]

hi all,
have you experiences with XFUSION - FUSIONSERVER 2288H V7?
We are thinking to buy it in order to install Hardened Repository (with product ISO) and we cannot find any news/issues/info about...

thank you

[Dynamic]

Hi Hannes,
we have a customer who think about switching to VHR.
Currently his concern is, that this environment is in a blacksite. So further updates would be only possible from within the customers network.

Is there any option to apply updates offline?
Currently only by the repair option, with latest ISOs?

The customer has a lot of RHEL servers, and they get their updates from a distributon server within the network.

Thanks and best regards Markus

[HannesK]

Hello,
as of today there is no built-in option for offline updates other than "repair" from the latest ISO, correct. There are plans on adding a distribution server to the product, but there is no timeline available and I added you +1 to the existing feature request

Depending on the knowledge a customer has, one could work around it as described here.

Best regards
Hannes

[HannesK]

Hello,

At installation summary, i have the following error at installation destination level "Kickstart insufficient". I have no more info, and i cannot select manually disks.

Thanks for your patience in the support case. The reason for the error in this case was mismatching sector size of the NVMe drives and the RAID. The system tries to create one logical volume of all drives that are not "smallest disk" and for that all volumes must have the same sector size. We will add that to the system requirements and investigate whether we can add that as a pre-check to the installer.

Probably there is an option to change the sector size in the settings and then it should work.

In general: please keep in mind that mixing non-RAID disks adds risk of data loss because the system creates one volume of "everything it finds". Also having a mix of flash and spinning disks will lead to inconsistent performance behavior.

Best regards
Hannes

[Dynamic]

Thanks Hannes for your answer regards the Blacksite.

I have another question, in a similar direction like VK-DMX:
A customer has some Windows Repositories with local integrated RAID disks and also some external SAS connected Shelfs (DAS). Currently they are integrated within VBR as SOBR extends.

If this customer is planning to switch from these Windows Repository to the VHR approach, it's not a problem to use the internal Disks for Capacity for sure.
But how we could add the other DAS Shelfs, to also consume them as a SOBR? Is there any option, something on the roadmap or should we go with another Distribution like Ubuntu?

Thanks and Best regards, Markus