Does anyone have recommendations for time settings on a Veeam hardened repo? After researching, I’m seeing conflicting recommendations from use the internal CMOS clock, use an internal NTP server, or use an external NTP server. Just wanted to see what some of the Veeam experts recommend.
Solved
Hardened Repo Time/NTP Settings
Best answer by coolsport00
Glad you initially found the article before posting. Understood….and true, things can change in such a time. Again, I haven’t heard Hannes have a change in stance on that article, and have been in at least a few sessions where he’s talked about the Hardened Repo. I would agree with you in choosing the internal CMOS for NTP….to keep all unneeded external avenues closed on it.
Best.
+21That’s an interesting question
Let me see if I can find something in some of my notes or otherwise...
+5As mentioned in this article, “it’s okay to use the local clock of a server as time source for Veeam Hardened Repository.”
The minimum immutability setting is 7 days, and your internal clock on a modern server should never be out by that much.
If you must use NTP though, follow the recommendations in that article to secure it.
+21I believe when setting this up via the ISO file it has you use an external NTP server. I am testing the Beta v13 and the JEOS ISO which allows you to deploy a VHR and it asks for external NTP for that so I would assume that is the preference.
+21Ok
Have you seen this blog article by one of Veeam’s PMs who has spear-headed the Hardened Repo, and more specifically, the ISO installer? I think this should provide you with some details on how to get NTP setup:
https://www.veeam.com/blog/securing-hardened-repository-against-remote-time-attacks.html
+21
It would yes. I am just stating what is being used during initial setup and with the new v13 stuff since Veeam manages updates it would require external access.
If you set up an internal NTP server then that would work too but it would need to get the time externally so maybe segragated networks?
+21
Glad you initially found the article before posting. Understood….and true, things can change in such a time. Again, I haven’t heard Hannes have a change in stance on that article, and have been in at least a few sessions where he’s talked about the Hardened Repo. I would agree with you in choosing the internal CMOS for NTP….to keep all unneeded external avenues closed on it.
Best.
+9Hi
https://www.rfc-editor.org/rfc/rfc5905.html
some clock sources and implementation model.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.