• EN

Topics started by marcofabbri

109 Topics

marcofabbri
marcofabbriVeeam Legend
posted in Cyber Security Space

Learning corner: Free IT certifications and courses

This thread’ll be update through the year with FREE courses that lead to FREE certifications.If we all grow, we all improve. Please help keep this thread updated throughout the year. ***** Updated 02 October 2023 ***** [Veeam]Veeam University: Veeam surely.https://www.veeam.com/free-on-demand-trainings.html  [Kubernetes]Free Kubernetes Training by Veeam, with 3 badges after completation: Apprentice, Defender, Helmsmanhttps://learning.kasten.io/ Kyverno is a policy engine designed for Kubernetes. With Kyverno, policies are managed as Kubernetes resources and no new language is required to write policies. This allows using familiar tools such as kubectl, git, and kustomize to manage policies. Kyverno policies can validate, mutate, and generate Kubernetes resources. The Kyverno CLI can be used to test policies and validate resources as part of a CI/CD pipeline.https://learn.nirmata.com/courses/kyverno-fundamentals-certification/ [Cybersecurity]CYBER THREAT INTELLIGENCE 101The arcX Cyber T

79
marcofabbri
2 months ago
marcofabbri
marcofabbriVeeam Legend
posted in Discussion Boards

Windows 11 Veeam Agent 5.0.0.4301

I know this might be a superfluous post, but I write it anyway because I know that someone will do a google search about it.Windows 11 is out today (and if you are an IT you doesn’t install it today definitely in some production device, aren’t you?)Anyway Veeam Agent for Windows 5.0.0.4301 has issue with it, and it’s not supported.So.Please.Wait.As @MicoolPaul said:You want v11a which currently has “Windows 11 readiness” based on pre-release, still not officially supported of course! But v11a includes 5.0.1 KB4215: Release Information for Veeam Backup & Replication 11a

50
marcofabbri
2 years ago
marcofabbri
marcofabbriVeeam Legend
posted in Cyber Security Space

Hardening Veeam 12 Server: the definitive checklist

*UPDATED and REVISIONED APRIL 2024 - ver 12.1*Every day we wonder which are the best way to hardening a new installation of Veeam Backup & Replication 12.1.I wrote a *maybe* definitive community’s checklist: Domain or workgroup?There are two religions: mine is to keep the Veeam servers absolutely out of domain, in a workgroup environment. In an Enterprise level, a possible alternative is to create a separated domain dedicated exclusively to management. Decision is yours, according to your needs.Hacker’s perspective: domain solutions are vulnerabile to Responder attack. Remove Builtin\Administrators as Veeam AdministratorI think it’s better to assign specific roles to specific users rather than leaving access to all members of the Builtin\Administrators group, so it’s a good idea to create a new admin user and add it into security tab of console. Also, leaving the group doesn’t allow you to enable 2FA.Hacker’s perspective: managing single users is easiest to keep unwanted and vulner

42
Chris.Childerhose
16 days ago
marcofabbri
marcofabbriVeeam Legend
posted in Cyber Security Space

Ransomware but no backups

Let's think about a situation where we cannot access our backups, either because they are absent or, perhaps even worse, corrupts, out of date or encrypted. Exactly, we're trying to resolve a ransomware situation with no backup. What to do in these cases?I could say don't panic, but I'd be lying.The situation is critical, but with some precautions in my experience you can heavily limit the damage and, in rare cases, even resolve the situation.First of all we need to look at what can be recover. Shadow copies are essentials. It may happen that by a stroke of luck not all of them have been touched or, in other cases, a good part of them is still accessible. Here, the first thing to do is to save the savable by exporting it to a different disk than the starting one, because if you export into the original disk, you risk losing the present shadow. To do so, at first you must use the Microsoft explorer integrated tools, but if for an unfortunate reason it doesn’t works, there’s a tool calle

24
Chris.Childerhose
2 years ago
marcofabbri
marcofabbriVeeam Legend
posted in Blogs and Podcasts

One GREAT advantage about Veeam Community Edition

This morning I was thinking about various backup solution, and one thing cross my mind.One of great advantage about Veeam over other vendors(BEYOND THE FACT THAT THE BACKUP WORKS. ALWAYS. GOOD. EVERYWHERE.) (If you have used other solutions in the past you know what that means.)is that Veeam release a free Community Edition, an almost full feature version to be tested heavily in our lab so we can fully understand the product, and try on our skin basics about backup and recovery.It is taken for granted, but it is a significant added value to me.So, thank you Veeam.Have you ever thought about it?

19
HunterLAFR
1 year ago
marcofabbri
marcofabbriVeeam Legend
posted in Cyber Security Space

Decrypting Veeam password is possible, so VBR servers must be protected

While navigating into the web, I found this interesting article published by Scottie Austin as red team hacker. In his article, he show how can be a disaster if a malicious user gain access to the VBR server because decrypting Veeam credentials can be done.Based on Veeam documentation (https://helpcenter.veeam.com/docs/agentforwindows/configurator/encryption.html?ver=50), user credentials get encrypted before they’re stored into database and KB2327 (https://www.veeam.com/kb2327) says it’s used DPAPI crypto functions for encrypting and decrypting management data.So, exporting DPAPI keys from the VBR servers where the attacker got access before on the first phase of the attack, breaking into SQL and then applying that reverse function using mimikatz or SharpDPAPI, the password can be decrypted in steps, from encrypted to HEX to ASCII.This is an interesting example on why VBR servers must be protected from access, and how a malicious attacker can break that access.Source with more content

19
vNote42
1 year ago
marcofabbri
marcofabbriVeeam Legend
posted in Discussion Boards

Best practices: Synthetic or Active

I ask this question which I think is very important starting from the thread in the forum veeam .There is a best practices in a small environment (<4TB) about using only synthetic full backup, active full backup or both togheter alternating?What do Veeam recommend, since synthetic is selected by default?Use only Synthetic full lead to risks in terms of reliability and consistency of backups?On the other hand, using active full requires a lot of space in repository.I ask you Veeam gurus. 

18
Mildur
2 years ago
marcofabbri
marcofabbriVeeam Legend
posted in Discussion Boards

Customer don't want encryption enabled

Good morning Community!I’ve a question to you folks, based on a true story.Do you often have not enterpries customers that ask you to NOT enable backups encryption to avoid having to manage “keys” in case of recovery need?And if so, how do you handle it at the security level?Having them not encrypted need to make backup repositories super strong and access notifications enabled.But. Other than that?Do you guys have any other tips to share?

17
dloseke
1 year ago
marcofabbri
marcofabbriVeeam Legend
asked in VUG Italy

IT VUG - Troviamo una location per un meeting informale della community?

Organizziamo un tech meeting informale della VUG italiana, così da conoscerci e rilanciare questo gruppo e renderlo più attivo e numeroso? Una cosa informale, un light lunch o un’apericena dietro una birra tech.Ipotizzando Giugno come mese palpabile per l’evento, direi di iniziare a raccogliere l’interesse degli utenti e magari anche la location indicativa che sia il più confortevole per tutti. Quindi quando votate, oltre a segnare quello più vicino a voi, segnate anche quello “più lontano” al quale siete disposti partecipare.Lascio un paio di location, poi siamo liberissimi di modificarle/aggiungerle: 

16
marco_s
10 months ago
marcofabbri
marcofabbriVeeam Legend
posted in Blogs and Podcasts

Backup job issue, incorrect function with Synology backup repository

Problem: Like a shooting star, sometimes can happens that some backup job on a Synology NAS fails with this error:Error: Incorrect function. Agent failed to process method {ReFs.SetFileIntegrity}.with VB&R 11.0.1.1261 and DMS 7.0.1 with a SMB share.It seems to be related to “Fast clone” feature inside Synology control panel.  Solution: Adding this registry key in the VB&R machine seems to solve the issue[HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Backup and Replication]"UseCifsVirtualSynthetic"=dword:00000000 As reported in this thread, that registry key tweaks the full fast clone feature.https://forums.veeam.com/microsoft-hyper-v-f25/error-incorrect-function-agent-failed-to-process-method-refs-setfileintegrity-t68754.html  More about this topic:All said above, I found this topic on reddit where the issue is present on Veeam 9.5u4 and always a Synology NAShttps://www.reddit.com/r/Veeam/comments/omridr/synology_ds1821_and_veeam_95u4/What is Fast clone:https://kb.synology.com/en-id/

16
marcofabbri
9 months ago
marcofabbri
marcofabbriVeeam Legend
posted in Discussion Boards

I failed VMCE exam

Yes, as the title says, I failed the VMCE exam this morning.69% out of 70% to pass.I want to share my mistakes so whoever reads this post will be able to do better:If you're a Windows sysadmin like me, don't leave anything related to the Linux world behind. Almost 1/3 of my questions were about Linux. So, it's really really important to have a complete knowledge at 360°.Memorize various options in menus, where it says and what it says.Don't just focus on Veeam Backup and Replication, look at all our other products as well.Very important are @haslund videos: not to get the answer, but how to get the anwser. He does a great job to explains how to reason to solve questions.YT links: https://www.youtube.com/@RasmusHaslund/playlists Community links: https://community.veeam.com/search/activity/topics?userid=80Again, @haslund he's the man.You can even find three exam preps he prepared to help you “simulate” real exam (with obviously different questions).https://rasmushaslund.com/vmce-practice

16
daniel.silva
1 year ago
marcofabbri
marcofabbriVeeam Legend
posted in VUG Italy

Recap dell'evento virtuale 22 Febbraio 2024

Ciao a tutti,grazie a tutti coloro che hanno partecipato al nostro evento virtuale! Spero gli argomenti siano stati interessanti e se volete approfondire, questo è il luogo adatto.Per coloro che non hanno potuto partecipare, o per coloro che desiderano rivedere le informazioni, le slide dell'evento sono ora disponibili di seguito.Sessione 1 [Antonio D’Andrea] - Ottimizzazione della resilienza cibernetica: integrazioni e migliori pratiche con le soluzioni VeeamSessione 2 [Marco Fabbri] - Cyber Kill Chain, MITRE ATTA&CK e il nuovo Zero Trust Data ResilienceSessione 3 [Marco Luvisi] - Guida all'aggiornamento alla versione 12 di Veeam: tutto ciò che devi sapereSe avete domande o commenti, non esitate a contattarci! 

15
leduardoserrano
2 months ago
marcofabbri
marcofabbriVeeam Legend
posted in Discussion Boards

ChatGPT as Veeam VMCE and VMCA exam prep

Are you studying for the VMCE or VMCA exam?Did you know that ChatGPT can help you?I asked ChatGPT to create me an easy and an advanced level exam prep, this is what I got. 👦🏻 I'm studying to take the VMCE exam, give me a 10 question exam prep.🤖 Sure! Here are ten questions for Veeam Certified Engineer (VMCE) exam preparation:What is Veeam Backup & Replication? Explain the components of the Veeam Backup & Replication architecture. What is a backup repository in Veeam Backup & Replication and what role does it play? How does Veeam Backup & Replication use VSS technology? What is the purpose of the Veeam Backup & Replication proxy server? How does Veeam Backup & Replication handle data deduplication and compression? What is the difference between backup and replication in Veeam Backup & Replication? How can you restore a virtual machine using Veeam Backup & Replication? What is a SureBackup job in Veeam Backup & Replication and how does it work? How

14
coolsport00
1 year ago
marcofabbri
marcofabbriVeeam Legend
asked in Cyber Security Space

Question of the day 21/09, Cybersecurity Edition

DAY 18What is the wireless hack technique that changes the mac address of device assigned by manufacturer into new one random or choosen by attacker?MAC shifting MAC changing MAC spoofing MAC morphing MAC elusiving

13
marcofabbri
1 year ago
marcofabbri
marcofabbriVeeam Legend
posted in VUG Italy

24 Febbraio 2022 - Primio VUG meeting italiano

Signore e signori, ho il piacere di annunciarvi che in data24 Febbraio 2022 dalle ore 11.00 alle ore 12.30si terrà il primo meeting italiano di questa community. CLICCA QUI PER REGISTRARTI L’agenda sarà la seguente: •    Benvenuti al primo meeting italiano della Veeam Community•    Presentazione della Community di Veeam:         dalla Community pura per crescita e inclusività da tutto il mondo         alla R&D Forum e la vera forza della famiglia online di Veeam•    Quattro chiacchiere a tema cybersecurity sulla configurazione dei backup nelle PMI•    Le best practices più importanti nella configurazione di una infrastruttura Veeam•    Veeam Enterprise Manager: funzionalità e potenzialità dell'interfaccia di management unificata•    Sneak peek della versione 12 •    Domande, ringraziamenti e saluti finali Gli speaker saranno: Marco Luvisi ( @MarcoLuvisi )IT Support Specialist and Security Experthttps://www.linkedin.com/in/marcoluvisi/ Antonio D’Andrea ( @Andanet )Cloud & Enterp

13
Andanet
2 years ago
marcofabbri
marcofabbriVeeam Legend
posted in Cyber Security Space

Question of the day 01/09, Cybersecurity Edition

Today we inaugurate a new "Question of the day" that will last throughout the month of September. Cybersecurity talking, of course.We have to thank @Geoff Burke  who inaugurated this trend on the community.Every day I'll share a question and, to answer it, you'll have to comment with the answer you think is correct and, if you like, why you thought so.The ultimate goal is to bring valuable content to this community.Hope you will enjoy.Let's start. Which of these tools provides, with a GET request to a webserver, the minimum amount of information related about the source client without any configuration?netcat curl wget mfsconsole burpsuite  

12
Chris.Childerhose
1 year ago
marcofabbri
marcofabbriVeeam Legend
posted in Cyber Security Space

How to check if links are safe before clicking with online free tools

Thanks to @MicoolPaul topicI’d like to talk about received suspicious links and how to handle them, before clicking on it.There are indeed various online tools for pre-checking links, these are the ones I suggest.If you know others, share them with us! :) The first one is URL2PNG and what it offers is really simple: it capture in an instant of time snapshots of any website. Super useful with strange urls. And it's free for occasional searches.https://www.url2png.com/ Another one and very famous is virustotal: it doesn’t only check if some malware hides in the target of the link, but it’s pretty useful even to check shorten link (like, you know, linkedin urls...) and their true destination.https://www.virustotal.com/gui/home/url The third link is very similar to virustotal, but less well known. Allows you to check if the link is safe or if it contains a malicious target. But I personally don't like searches being made public in some sort of timeline. In this screen I had to hide the pub

11
dips
11 months ago
marcofabbri
marcofabbriVeeam Legend
posted in Cyber Security Space

RANSOMWARE KILL CHAIN, MITRE ATTA&CK and ZERO TRUST DATA RESILIENCE: YOUR NEXT ULTRA-SECURE VEEAM SOLUTION

There's a famous quote used in the videogaming industry: "Kept you waiting, huh". Well, I tried to write a white paper to improve everyone's knowledge of cyber resilience and be ready for 2024, combining the three pillars: cyber kill chain, mitre attack framework, and the new zero trust data resilience. Sort of an introduction to go deeper into these resources.I hope this can be useful for the community, and hoping to get some feedback to make a better one.Let's say this is a 1.0 version. 😀 IntroductionThe year 2024 will be a challenging one for businesses. Cyber risks are becoming more sophisticated, targeted and widespread. In this context, it is crucial to have an effective data protection strategy. It is time to abandon the old strategies that have served us well and rediscover the next generation of frameworks and tactics. This white paper will guide you through the implementation of a more secure and reliable data protection structure. More cyber resilient. To do this, we are go

11
marcofabbri
2 months ago
marcofabbri
marcofabbriVeeam Legend
asked in Cyber Security Space

Question of the day 24/09, Cybersecurity Edition

Sorry, I was missing for some days. Personal business.To apologize, these questions will remain open until Friday the 30th. DAY 21Linux talking, this line of code search into the machine exeguible commands runable as root without be root.find / -type f -perm -u=s 2> /dev/nullWhat is the function of this piece of code?2> /dev/null Does nothing, it's an error Bypass any Unix filters Search for administrators group permission in files Redirect errors by ignoring them Search in subfolder

10
marcofabbri
1 year ago
marcofabbri
marcofabbriVeeam Legend
posted in VUG Italy

Cosa ti piacerebbe vedere nel prossimo meeting?

 Il primo meeting è andato e come la prima pietra va a costruire qualcosa di più grande, noi siamo qua a chiedervi feedback di cosa vi è piaciuto, di cosa no, di cosa vorreste vedere nel prossimo meeting e di cosa non vorreste vedere.Perchè se il primo è stato molto introduttivo e della durata di 1 ora e mezza, nulla ci vieta di renderlo un appuntamento fisso mensile, magari più corto o più tecnico o più teorico o perchè no, più pratico con delle live demo.Questi sono solo esempi, la differenza la potete fare voi.Facciamo crescere il gruppo italiano di questa community.Fate sentire la vostra voce. 

10
B
1 year ago
marcofabbri
marcofabbriVeeam Legend
posted in Cyber Security Space

Use powershell to track Windows Registry changes

Did you know that you can use Powershell to track registry changes? Well, it does.There’s a function that create a snapshot of the current HKLM and HKCU registry keys to use them to compare with future snapshots. To create a Windows Registry snapshots, use the following PowerShell commands in a Windows PowerShell (Admin) prompt to make sure you can access all of the registry keys: dir -rec -erroraction ignore HKLM:\ | % name > Base-HKLM.txtdir -rec -erroraction ignore HKCU:\ | % name > Base-HKCU.txt It’ll be generated a Base-HKLM.txt and Base-HKCU.txtOn freshly installed versions of Windows 11 and Windows 10, these snapshots’ sizes are about:HKEY_LOCAL_MACHINE (HKLM): 82 MBHKEY_CURRENT_USER (HKCU): 3 MB After some time, if you need to compare the Windows registry with your base snapshots, you can create new snapshots using these following commands in an admin PowerShell prompt:dir -rec -erroraction ignore HKLM:\ | % name > Current-HKLM-$(get-date -f dd-MM-yyyy).txtdir -rec -er

10
BertrandFR
1 year ago
marcofabbri
marcofabbriVeeam Legend
posted in Discussion Boards

Problem restoring backups from multiple RDX tapes

I see a interesting thread on Veeam Forumhttps://forums.veeam.com/vmware-vsphere-f24/case-05192176-problem-restoring-backups-from-multiple-rdx-tapes-t78398.htmlwhere they’re trying to restore .vkb from RDX and got this error:  From your experience, what do you guys think it can be?In my opinion, the RDX device was broken BEFORE the backup job, or it is a known bug due to the missing update KB4025334 and ReFS enabled on Windows Server 2016.And above all, RDX in nearly 2022? What do you think?Let’s flow this thread with our experience in cases like this one, and just leave real solutions on R&D Forums.

10
StephenM
2 years ago
marcofabbri
marcofabbriVeeam Legend
posted in Cyber Security Space

Anatomy of a targeted attack to Veeam server

DISCLAIMERThis analysis is not made with any intent of promoting illegal activity, defamation or any kind of business loss. This analysis is solely made for educational and demonstration purposes, I’m not responsible of any unethical activity performed by any individual or group. By proceeding further to read this analysis you are giving your concern that you are solely responsible for any unethical action that you perform later on and the author has nothing to do with it. In this light analysis we’re going to look at what are, in a simplistic way, the steps taken by a threat actor in a targeted attack to a Veeam backup server, not for the purpose of replicating it, but to know basics and learn to defend against it. The analysis environment will be equivalent to a small business.As shared by Madi, you can watch a webinar where a ransomware attack is analyzed:https://community.veeam.com/blogs-and-podcasts-57/webinar-anatomy-of-ransomware-attack-preventing-attacks-on-your-backup-infrastr

10
vAdmin
9 months ago
marcofabbri
marcofabbriVeeam Legend
posted in Blogs and Podcasts

Veeam: inline deduplication

While I was studying for the VMCE, a detail on deduplication caught my attention.I’m talking about inline deduplication. What's about?Inline deduplication is a feature offered by Veeam B&R and it’s used to reduce the amount of storage space required to store backup data by removing duplicate data. One of the main benefits of inline deduplication is in fact that it can significantly decrease the amount of storage space, amount of time and resources required for backups and this can be especially beneficial for organizations that generate a large amount of data on a regular basis.   Another advantage of inline deduplication is that it can improve the efficiency of backups, ‘cause backups can be completed faster and the amount of data that needs to be transferred and stored is reduced.  An example?An immaginary company named CatsFood has a file server that contains 10 terabytes of data and the organization wants to create a backup of this file server using, proudly, Veeam. Without inl

10
dloseke
1 year ago
marcofabbri
marcofabbriVeeam Legend
posted in Cyber Security Space

CVE-2022-43549 for Veeam Product: for Google Cloud

Good morning everyone!Today I’m here to share a relatively new CVE, related to Veeam Backup for Google Cloud v1.0 and v3.0, published on 5 December. Maybe someone missed it.It has 9.8 as CVSS V3 score, so it’s a critical one.BUT DON’T PANIC.Continue to read to find the solution.It’s about an improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 that allows attackers to bypass authentication mechanisms.Veeam already published update to solve this CVE, and you just must look at the version of the product. As cited by KB4374: For most users, no actions will be needed, as the Veeam Updater component will have automatically installed this fix during its daily check for updates. After the fix has been installed, the Backup Appliance will be restarted automatically. For environments where the Veeam Backup for Google Cloud backup appliance does not have access to repository.veeam.com, the fix will have to be manually deployed or internet access configured to allow access to th

9
Link State
1 year ago

Badge winners

Show all badges
Terms & Conditions