VeeamON 2024 - Use Code "COMMUNITY10" for 10% Off!
the earliest time for a new ISO is several months in future. The old ISO was built to get feedback and it makes no sense anymore to use it because of the changes that are needed. We are working to incorporate the feedback we got.
Thanks all! It would be nice if there is an approximate date. So I can decide to wait for the ISO or work on myself. If you ever built Ubuntu / Debian ISOs before, then I would suggest to do it yourself and just add the DISA STIG hardening scripts https://github.com/VeeamHub/veeam-hardened-repository (I built ISOs 12 years ago myself and remember it’s not that complicated. My colleague who built this one told me that it works still more or less the same)I guess a few things in the script need to be adjusted for Ubuntu 22.04, but most of the things should just work.
it would be one ISO and no choice for the customer which OS. Customers who want to select the OS, can continue without ISO. It’s an appliance - customers don’t need to worry about the OS :-)The ISO requires a version after 12.1 because 12.1 requires SSH for the initial connection. The ISO won’t have SSH.
Hello,please see my comment above… there is no link available until we release a new ISO :-)Thanks for your understanding,Hannes
sure, nothing is wrong with Ubuntu 20.04
Hello,unfortunately I don’t have a time frame right now. Some non-technical challenges came up to get the ISO officially supported. I’m working on finding solutions, but right now it’s hard to predict where it goes. We removed the old ISO, because the new ISO would not be on Ubuntu 20.04 and I don’t want people to waste time on reporting issues on something that won’t be used in future.Best regards,Hannes
Hello,not sure which advice I should give… if you want to do it now, then you must enable SSH. If you have time to wait for CP1, then you don’t need SSH.Best regards,Hannes
schlechte Nachrichten… es ist nicht gefixed in 12.1. Dima meinte “it’s complicated” :-(
Hello,interesting device and interesting error you ran into.The ISO formats everything it can see. Maybe we can add something that excludes USB drives. I will add it to the bugs list.Thanks for reporting! 👍Best regards,Hannes
Hello,yes, the script does not disable SSH. That’s manual steps as described in the blog posts mentioned earlier in this thread (yes, this thread is a mix of many topics and having one thread instead of a dozen is sub-optimal… we know)Errors sounds wrong, but I can say that we will continue work on the ISO / script after 12.1 is out. For now it would be great to hear if specific hardware works / does not work (we know that it works with VMs if system requirements are met :-))Best regards,Hannes
> For the FR on the r&d forum , do you need one FR per request? I mean coud i create a root FR for all or I would start with one thread in the VBR forums. A list of attributes that should be anonymized would be useful.For the database, that seems to open a can of worms. If foreign keys are involved, that would cost huge amounts of development resources.
I guess that shows the challenge… log bundles are often 5GB - 50GB, I even heard of 200GB. I’m also not a developer, so I’m technically not able to improve the code to make it faster.
yes, just create a new backup server and re-connect to the Hardened Repository.
@JMousqueton : it should be available from support by opening a ticket and asking for it. I know it existed some years ago. I’m not 100% it was adopted to V12.
Hello Bob,unfortunately I have no idea how to solve it with the ISO. But I put your configuration to the bugs list.https://www.veeam.com/blog/backup-repository-security-disa-stig-ubuntu-step-by-step-guide.html describes how to use the script manually.Best regards,Hannes
@BertrandFR :putting an official feature request to the R&D forums is a good idea. Currently there is only an internal thread that customers cannot add “plus 1” we have that feature request already tracked and I would add you to that request There is a support tool that does what you ask for. But it’s slow. So the main question is: how fast per GByte log files is that script?
if you rebooted, then you don’t have permissions to upgrade… To answer the question: it should work fine and not break anything. But it sounds like wasted time. The purpose of the current ISO is to get feedback. A later version would support smooth upgrades of course.
@Tyicus : hmm, that’s strange. Because efd121 reported above, that the R730xd installs fine. The problem he sees is that MAC addresses get duplicated with network bonding. And the reason for that is, that /etc/machine-id is identical on multiple machines.
that’s what I mean… the Hardened Repository in your case has access to two networks without any firewall in between. Why would you want to separate a few kbit/s management traffic if you have 10gbit/s+ anyway for data traffic? SSH is disabled, so that cannot be the reason.
For those that have tested on physical servers have you tried it with multiple networks - not bonding? I need to possibly test this with two different networks possibly where the repo is segregated from our typical VLANs. what do you mean with “multiple networks”? Multiple network cards in different networks? Meaning you would create a way around firewalls? We won’t support that for sure (bad design)
HI, I am new to VHR and Linux. but I was able to set up the VHR using installable ISO. Now I need to add more disk to Linux VM and set them up as VHR. Can you tell me the steps? Thanks. VMs are against the concept of Hardened Repository, because an attacker could simply delete the whole VM. Manually adding disks is possible because it’s a plain Ubuntu. Without Linux experience, I would not do that. The idea of the ISO is, that all disks exist before installation (like with a physical appliance). Then we will auto-detect the disks and format everything correctly. So my suggestion would be to just re-install the system (not repair).
I’ve been testing with some Dell Rx730’s and having issues with bonding. It appears its setting the same MAC address each time. Is there anything I can do before the 2nd reboot to prevent it or do I need to stay away from bonding? Dave it’s a clean Ubuntu 20.04 and everything that works with Ubuntu 20.04 can be done manually. My guess is, that the bonding technology is wrong. https://www.veeam.com/blog/installing-ubuntu-linux-veeam-hardened-repository.html has a short summary. I guess active-backup should solve the problem
Can now also report that the hardened ISO Installer also crashes on a brand new Dell R250 PowerEdge, in addition to the old R720 we had lying around that I tested earlier. It does progress further than it did on the R720 though, which crashed on the network setup screen. Now it crashes near the end of the configuration. So something about it does not seem to jive with Dell hardware - maybe it’s the hardware RAID card, or iDRAC controller? I’ve gone ahead and installed a vanilla copy of LTS 22 without issue. My question is can I run the hardening script on it, despite it being designed for LTS 20? I’m guessing not, and that I should just wait until work has been completed on 22 compatibility. Thanks for reporting the crashes. Yes, incompatible hardware is very likely the reason, because we did not change Ubuntu itself.For 22.04: probably some settings would fail. We can only start on 22.04 once DISA STGs are released for 22.04 (Canonical is working on it, but it will take time..
Hi, I'm currently playing with the VHR ISO on a physical server. Works perfect, but I also want to test single user mode if for some reason we need to do some troubleshooting. However, the GRUB menu doesn't show up (it boots directly into the OS), so I'm unable to edit the boot entry. Reading the blogpost this is a requirement by the hardening script. Following Hannes blog post (Ubuntu Linux Defense: Secure Boot & Single User Mode (veeam.com) we need to set a password for grub in order to be able to edit the boot entries. We need to configure this before the second reboot after VHR deployment, since after that the system is locked down. I'm wondering if we have a chicken and egg situation here. Is the hardening script executed during the second reboot? If so, doesn't the script then disable GRUB again so we still won't be able to access the GRUB menu to configure single user mode? Hello,could you maybe tell us what server you used? Just to know what works… the more hardware info
confirmed… we install on the smallest device no matter what. It’s noted as bug
Already have an account? Login
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.
Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.
Sorry, our virus scanner detected that this file isn't safe to download.
