• EN

All-Demo Session & Installable ISO for Veeam Hardened Repository

All-Demo Session & Installable ISO for Veeam Hardened Repository
Show first post
This topic has been closed for comments

199 comments

wolff.mateus
Userlevel 7
Badge +11

I presume that you are running on a BIOS machine. Try the same on EFI like @coolsport00 said.

IT Lover | Veeam Vanguard | VUG Leader | Blogger
coolsport00
Userlevel 7
Badge +17

Ah, I see. Yeah...I just scanned through the script a bit. It’s pretty long. I’ve learned quite a bit of BASH this yr, but there’s quite a bit in it I’m not familiar with 😬

Shane Williford - Veeam VMCA/VMCE | Veeam Legend | VUG Leader | VCP-DCV | Twitter: @coolsport00
regnor
Userlevel 7
Badge +14

@wolff.mateus Take a look at the following article: https://www.veeam.com/blog/backup-repository-security-disa-stig-ubuntu-step-by-step-guide.html

Max M. | Systems Engineer @Veeam | VMCE/VMCA | former Legend & Vanguard
PHuber
Userlevel 1
Badge

Will sure try this out. But many of my customers use RedHat as their preferred Distibution.
So maybe it will make sense to do the same things with a RedHat .ISO ?:-)

 

Rick Vanover
Userlevel 7
Badge +10

Will sure try this out. But many of my customers use RedHat as their preferred Distibution.
So maybe it will make sense to do the same things with a RedHat .ISO ?:-)

 

We’ll see how this one goes before we engage with other Distros :)

Twitter @RickVanover | Email: rick.vanover@veeam.com
F
Userlevel 5
Badge

Hello,
could you maybe tell us what server you used? Just to know what works… the more hardware information you can provide, the better it is.

I think we should show the grub menu longer in a future version to avoid issues like that you cannot see it. That’s useful feedback! https://askubuntu.com/questions/1264119/how-to-change-grub-timeout-in-ubuntu-20-04 should work if you edit it before the system locks down itself during the second boot.

Some settings are applied before the first boot, some (like the sudo stuff) are applied at second boot. The script does not do anything around grub, because it requires manual user interaction which we wanted to avoid

Best regards,
Hannes

Hi,

it’s an HPE Proliant DL360 Gen10 Plus server

MarkBoothman
Userlevel 7
Badge +6

@Assalihin I used a VM and 2 disks for a POC peice of work we are doing. 100GB boot drive and 500GB data drive and the install took care of everything

VMCA2022 | VMCE2021 | Veeam Legend | Twitter: @Boothy71
F
Userlevel 5
Badge

If you enter the ‘normal’ command, the system reboots again. Right after pressing enter after typing the normal command press ESC multiple times until you see the grub menu.

see here:

https://askubuntu.com/questions/381613/how-to-return-from-grub-prompt-to-the-grub-menu

Rick Vanover
Userlevel 7
Badge +10

@mrizzi2I’m also no longer able to deploy the new ISO on a physical server. “sorry, there was a problem completing the installation”

@Rick Vanover@HannesKI’m not getting much out of the installer log/report. Can you reproduce the issue or can we provide you anything useful from the installer? 

I can look into this.

Twitter @RickVanover | Email: rick.vanover@veeam.com
mrizzi2
Userlevel 2

Hi there @Rick Vanover,

in our scenario, there is no way to boot the VM from the updated Veeam .ISO. Basically, after choosing the EFI VMware Virtual SATA CDROM Drive, the VM attempts to boot but then returns to the boot selection prompt:

As soon as we switch to the vanilla Ubuntu ISO, the VM boots successfully:

 

Please let me know if you need any additional information from our side.

Thanks !

Massimiliano

mrizzi2
Userlevel 2

@mrizzi2 did you check the md5 / sha265 sum? If it does not even boot, that’s odd

That’s strange indeed as the sha265 sum is matching:

UEFI secure boot option is enabled on the test VMs I am using:

@HannesK Would it be possible for you to kindly share a VeeamZIP of the VM you are using in order for me to restore it in our lab environment ? Thanks !

regnor
Userlevel 7
Badge +14

I’m sorry to post 3 times in a row, but just wanted to say everything’s working for me with the new ISO. Seems like it was the missing internet connection which let the installer fail; didn’t see this as a hard requirement.

Internet connection (HTTP to the Ubuntu update servers for automatic security updates)

 

Max M. | Systems Engineer @Veeam | VMCE/VMCA | former Legend & Vanguard
H

Hello,
First of all an great job on providing this ISO and information. 
When installing the iso on a VM (for test) I got the following error:

 

My vm  is running on vmware (vsphere 7 ), UFI and secure boot enabled.
disk1 = 100GB disk 2=150 GB 1 NIC
thanks in advance

No idea so far on this one. it’s not the classic “no internet connection” problem. 

the error about dependency issues is clear, but no idea where it comes from

Got the same error with my test vm, but in my case it was the classic “no internet connection” problem. First try was in a VLAN without internet, cause the backup server hardware i want to use, will be also without internet connection and i got the error above.
Then i tried a VLAN with internet connection and oberserved the installation progress. Setup seems to download the packages. Installation worked fine.
No idea how to investigate that, since i’m one of thoses windows guys … but internet seems necassery.

Rick Vanover
Userlevel 7
Badge +10

Hey @rladrak → That is an interesting idea, like a pre-requisite checker. Our goal was to have the installer be as limited as possible, but this may make sense. I’ll relay this idea to the QA resource.

Twitter @RickVanover | Email: rick.vanover@veeam.com
J
Userlevel 1

@JavierLarrea : could you maybe tell us, what type of server / model / configuration you used? I’m trying to create a list of “configurations that work”.

yes, we are discussing a configuration tool that allows to configure network and some other settings. 

 

 

Hi, We are running our hardened repo in an old IBM xSeries model 3550M3 with a 4 cores Xeon E5630 processor and 8GB RAM. The network connection is a IBM Intel X540-T2 Dual Port 10GBaseT Adapter LP configured as a LACP bond, and the storage HBA is a Qlogic QLE2562 8 GB Dual port card. It is a decomisioned IBM 2805-MC5 System Storage Productivity Center.

You may see the specs in this link https://www.ibm.com/common/ssi/ShowDoc.wss?docURL=/common/ssi/rep_sm/4/877/ENUS2805-_h04/index.html&lang=en&request_locale=en

The only change is the dual port 10G NIC

regnor
Userlevel 7
Badge +14

the new feature is: it works offline. No other changes :-)

Just deployed it without network/internet connection and it just works 😅

Max M. | Systems Engineer @Veeam | VMCE/VMCA | former Legend & Vanguard
T

@Tyicus : hmm, that’s strange. Because efd121  reported above, that the R730xd installs fine. The problem he sees is that MAC addresses get duplicated with network bonding. And the reason for that is, that /etc/machine-id is identical on multiple machines.

When i use the VHR iso, it doesnt even get to the Network configuration screen, so there isnt a network bond present for the MAC address to get duplicated, Unless im misunderstanding how this issue is happening. In the standalone Ubuntu 20.04 LTS install, i have a network bond configured and did not encounter the MAC duplication Issue.

H
Userlevel 5
Badge +2

if you rebooted, then you don’t have permissions to upgrade… 

To answer the question: it should work fine and not break anything. But it sounds like wasted time. The purpose of the current ISO is to get feedback. A later version would support smooth upgrades of course.

keiranshelden
Userlevel 4
Badge +1

This is an awesome addition. Thanks for all the team effort you guys put in to make it so much easier! 

vExpert ‘14-‘23 | NSX ‘18 | Drummer | @Techfieldday delegate | @tech4breakfast Australian Sr. Field Correspondent
Chris.Childerhose
Userlevel 7
Badge +20

if you rebooted, then you don’t have permissions to upgrade… 

To answer the question: it should work fine and not break anything. But it sounds like wasted time. The purpose of the current ISO is to get feedback. A later version would support smooth upgrades of course.

Thanks Hannes.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
Chris.Childerhose
Userlevel 7
Badge +20

@Chris.Childerhose Ubuntu 20.04 LTS is supported till May 2025. So from a security perspective it's not necessary to upgrade.

Thanks Max. I was just asking in case I get asked about it when we start deployment of these. 😉

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
Chris.Childerhose
Userlevel 7
Badge +20

Yes need to add the VHR before reboot two otherwise no go.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
G

The installer errors out as soon as I reach the network config screen early in the setup process.

Trying to install it on a Dell PowerEdge R720 we had lying around.  Downloaded the latest Ubuntu Server 22 LTS and it works fine, so not sure what is wrong with this install image for this particular hardware?

N

I want to install Ubuntu Hardened repository on open stack cloud based on KVM.

With normal ISO downloaded from ubuntu, i dont see an option to boot with H/W Kernel during boot phase from ISO

can we use this custom hardened ISO for Cloud based on KVM ? please confirm

H
Userlevel 5
Badge +2

the HWE kernel requires UEFI. I guess that’s the reason (I don’t have OpenStack / KVM in my lab). The ISO requires UEFI and might even require “UEFI secure boot” in future. If OpenStack can do that, then it should work.

Please remember: The ISO is designed for hardware to avoid an attacker simply deleting the VM. Virtual machines are only for test / lab and not for production.

Terms & Conditions