Solved

Hardened repo access after upgrading to v12



Show first post

35 comments

Userlevel 7
Badge +14

I’m glad that it worked @dloseke! We have some great information on the hardened repository in the community, if you want to learn more about it (like the series from @vNote42) . And this article from @WorkingHardInIT has everything you need to know from Linux/Ubuntu to Veeam: https://www.starwindsoftware.com/blog/veeam-hardened-linux-repository-part-1

Userlevel 7
Badge +17

Awesome. Glad to hear Derek!

Userlevel 7
Badge +6

Thanks all, especially @regnor and @coolsport00 on this.  I added repouser to the sudoers, go things reconnected and removed it, and all is looking good.  Appreciate the quick help!

Userlevel 7
Badge +14

@dloseke Yes it is. The repouser needs to be in that group to install/upgrade the transport service. Afterwards you remove him from the group for security reasons as it doesn't need root/sudo permissions anymore.

Userlevel 7
Badge +10

Good thread here. I figured this would happen with the VHR on upgrades.

Userlevel 7
Badge +17

Hey Derek...yessir...remove the regular acct from sudoers:

sudo deluser repouser sudo

Userlevel 7
Badge +6

If it was setup correctly then probably the user ‘repouser’ has been removed from the sudo group. In order to upgrade the Veeam services you need to add it back to this group (temporarily). 

usermod -a -G sudo repouser

Afterwards enter the single use credentials again and see if it works.

 

Yes, repouser is not on the list of sudoers.  It’s only the admin account.  So the proper way to do this is to add repouser to the sudoers, and then once all is connected and working again, remove from sudoers?

Userlevel 7
Badge +17

If you ls -l on your /mnt folder, you should see repouser as both user & group owner of the /veeamrepo folder; if you go into /veeamrepo & run that cmd again, those same rights should also be down to /backups, and then on the files. The permissions on my folders/files within my /mnt directory are 755 (rwx-r-x-r-x). In implementing mine, I didn’t need to change file/folder permissions at all. Don’t think that makes a difference. Your repouser does need sudo permissions though as @regnor mentions. You can run sudo -l -U repouser to see if the user has sudo rights. The last line should say ‘run the following commands (ALL) ALL’ for that to be true. Let us know what you find.

Userlevel 7
Badge +17

When setting up the VHR, the ‘general user’, not root/admin, is the account which should have permissions on everything. Let me look at the permissions (user/group) on my folder structure and let you know what I find….

Userlevel 7
Badge +14

If it was setup correctly then probably the user ‘repouser’ has been removed from the sudo group. In order to upgrade the Veeam services you need to add it back to this group (temporarily). 

usermod -a -G sudo repouser

Afterwards enter the single use credentials again and see if it works.

Comment