+1I have veeam latest version v12.3 and an existing redhat 9.3 server which I want to convert to a hardened repo. I know there are steps to setup a new server but this is an existing OS with the storage mounted already.
I need to add all the STIG hardening etc so can someone share these steps before I add it as a hardened repo.
thanks.
Best answer by Chris.Childerhose
This is actually the page I was referring to about the script as it tells you how to download it, etc - Backup Repository Security: A Guide to DISA STIGs
+21Hi
Here are the steps for Redhat, as well as configuring DISA STIG, which is quite extensive. The DISA settings Veeam shares are for Ubuntu though. They don’t share for Redhat.
https://helpcenter.veeam.com/docs/backup/vsphere/hardened_repository_rhel_configure.html?ver=120
Found a blog for Redhat and DISA STIG:
https://www.veeam.com/blog/install-disa-stig-red-hat-veeam-repository.html
That should get you going.
Best. 😊
+21There is also a script that you can run to apply the DISA STIG hardening I believe in the blog post Shane shared.
+21If not in the blog just search for it as it could be a KB.
+21The only github script I was able to find on this was for Ubuntu only:
https://github.com/VeeamHub/veeam-hardened-repository/blob/master/veeam.harden.sh
Further searching turned up this Veeam KB:
This was tested on v12.0 and v12.1 only, so if using another Veeam version you might wanna test it.
Best.
+21This is actually the page I was referring to about the script as it tells you how to download it, etc - Backup Repository Security: A Guide to DISA STIGs
+21This is actually the page I was referring to about the script as it tells you how to download it, etc - Backup Repository Security: A Guide to DISA STIGs
Ah, ok; but that post and the script as well (via the URL Hannes provided), is Ubuntu-specific. My guess is it’s the same (ish) as the Github link I shared above. One could use it I guess...but would have to change all the pkg installer cmds to reflect Redhat (yum vs apt).
+10I should suggest to move (if company policy allows it) to Rocky Linux.
With the launch of JEOS (based on Rocky) upgrading should be easy using the ‘repair’ function.
+9We have own security policy (we use redhat as well). If you have as well. Then you can check as i have checked STIGS on https://helpcenter.veeam.com/docs/backup/vsphere/hardened_repository_ubuntu_configuring_stig.html?ver=120, what is sharing above coolsport00 already, what is already by our policy and what not.
+21I should suggest to move (if company policy allows it) to Rocky Linux.
With the launch of JEOS (based on Rocky) upgrading should be easy using the ‘repair’ function.
As this is a “manually-created” Hardened Repo, Rocky isn’t required for such components outside of VBR and EM in v13.
https://forums.veeam.com/veeam-backup-replication-f2/system-requirements-for-our-2025-release-t97086.html
The only requirement for Rocky Linux with VBR components such as the Proxy and Repo is with the “software appliance” install. Also, with software appliance installs, there is a requirement to have Repo storage be local disks/direct-attached...not external storage (i.e. SAN via iSCSI or FC), although it’s unknown what the author above has setup specifically as it’s not shared...so appliance install may not be a choice.
That said, and to your point Kristof...I’m sure Veeam will be moving toward a single OS (so long flexibility in that regard) for all Veeam components, and eventually will probably remove the “manual install” option altogether and only have software appliance-based installs. Just my opinion/guess there...nothing Veeam-official or anything 😊 Not sure if you’ve heard anything from them in that regard?
+21We have own security policy (we use redhat as well). If you have as well. Then you can check as i have checked STIGS on https://helpcenter.veeam.com/docs/backup/vsphere/hardened_repository_ubuntu_configuring_stig.html?ver=120, what is sharing above coolsport00 already, what is already by our policy and what not.
Yeah...that link doesn’t apply here because it’s Ubuntu. Redhat-based URLs were provided above.
+9yes, but there is just basic configuration, in case of all cases, its good to read ubuntu and check if such thing is suitable for redhat as well and try to apply … this was my use case.
+21Hi
Just following up to see if you still have questions regarding steps to add a RH Linux Hardened Repo. Let us know if the info/links provided helped or if you still have questions.
Best.
+1thanks for the comment Shane. The best answer was this link:
https://www.veeam.com/blog/backup-repository-security-disa-stig-ubuntu-step-by-step-guide.html
I ended up performing a fresh install with Redhat 9.6. Applied all settings as per the link. Its all ready to go for the client now.
+21Great...glad to hear. Thanks for sharing what worked best for you. 👍🏻
+21Glad to hear you were able to get things working with a fresh install and the settings.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
