Veeam V11 Hardened Linux Repository 配置指南 (Centos8)


Userlevel 2
Badge

                                                        Veeam SE 吴强

Veeam v11新功能Hardened Repository可实现对备份存储库的加固,有效防止勒索软件和恶意程序对备份文件进行加密和删除。

Veeam v11 Hardened Repository功能成功通过了全球金融行业最严格的数据防篡改认证SEC 17a-4(f), FINRA 4511(c) 和 CFTC 1.31(c)-(d) (合规性评估是由第三方机构Cohasset Associates完成) 。

本文的测试环境是 Veeam V11 版本, 作为Backup Repository的Linux版本是 Centos 8.3. 2011。

 

1. Centos 的环境准备

 

以下是Centos的具体kernel和release版本信息:

[root@CentOS8]# uname -r

4.18.0-240.el8.x86_64

[root@CentOS8 ]# cat /etc/centos-release

CentOS Linux release 8.3.2011

 

查看作为repository的磁盘:

[root@CentOS8 ~]# fdisk -l

Disk /dev/sda: 20 GiB, 21474836480 bytes, 41943040 sectors

Units: sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disklabel type: dos

Disk identifier: 0x5ea9c3d7

 

Device Boot Start End Sectors Size Id Type

/dev/sda1 * 2048 616447 614400 300M 83 Linux

/dev/sda2 616448 4810751 4194304 2G 82 Linux swap / Solaris

/dev/sda3 4810752 41943039 37132288 17.7G 83 Linux

 

Disk /dev/sdb: 80 GiB, 85899345920 bytes, 167772160 sectors

Units: sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

 

创建磁盘分区:

[root@CentOS8 ~]# fdisk /dev/sdb

 

Welcome to fdisk (util-linux 2.32.1).

Changes will remain in memory only, until you decide to write them.

Be careful before using the write command.

 

Device does not contain a recognized partition table.

Created a new DOS disklabel with disk identifier 0x2516c253.

 

Command (m for help): n

Partition type

p primary (0 primary, 0 extended, 4 free)

e extended (container for logical partitions)

Select (default p):

 

Using default response p.

Partition number (1-4, default 1):

First sector (2048-167772159, default 2048):

Last sector, +sectors or +size{K,M,G,T,P} (2048-167772159, default 167772159):

 

Created a new partition 1 of type 'Linux' and of size 80 GiB.

 

Command (m for help): w

The partition table has been altered.

Calling ioctl() to re-read partition table.

Syncing disks.

 

查看并确认磁盘分区已创建:

[root@CentOS8 ~]# fdisk -l

Disk /dev/sda: 20 GiB, 21474836480 bytes, 41943040 sectors

Units: sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disklabel type: dos

Disk identifier: 0x5ea9c3d7

 

Device Boot Start End Sectors Size Id Type

/dev/sda1 * 2048 616447 614400 300M 83 Linux

/dev/sda2 616448 4810751 4194304 2G 82 Linux swap / Solaris

/dev/sda3 4810752 41943039 37132288 17.7G 83 Linux

 

Disk /dev/sdb: 80 GiB, 85899345920 bytes, 167772160 sectors

Units: sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disklabel type: dos

Disk identifier: 0x2516c253

 

Device Boot Start End Sectors Size Id Type

/dev/sdb1 2048 167772159 167770112 80G 83 Linux

 

在刚创建的磁盘分区上创建xfs的文件系统:

[root@CentOS8 ~]# mkfs.xfs -b size=4096 -m reflink=1,crc=1 /dev/sdb1

meta-data=/dev/sdb1 isize=512 agcount=4, agsize=5242816 blks

= sectsz=512 attr=2, projid32bit=1

= crc=1 finobt=1, sparse=1, rmapbt=0

= reflink=1

data = bsize=4096 blocks=20971264, imaxpct=25

= sunit=0 swidth=0 blks

naming =version 2 bsize=4096 ascii-ci=0, ftype=1

log =internal log bsize=4096 blocks=10239, version=2

= sectsz=512 sunit=0 blks, lazy-count=1

realtime =none extsz=4096 blocks=0, rtextents=0

 

创建文件系统挂载目录并挂载:

[root@CentOS8 ~]# mkdir /mnt/veeamRepo

 

编辑/etc/fstab文件,添加刚创建的/dev/sdb1文件系统和/mnt/veeamRepo挂载点,由临时挂载改为永久挂载,即使重启OS后,该挂载依然生效。

[root@CentOS8 ~]# vi /etc/fstab

 

v2-b1be755a0c3907bccda4fd6963f5ab8a.jpg

 

运行mount -a 重新挂载/etc/fstab里的所有设备

[root@CentOS8 ~]# mount -a

 

查看并确认挂载文件系统:

[root@CentOS8 ~]# df -hT

Filesystem Type Size Used Avail Use% Mounted on

devtmpfs devtmpfs 1.8G 0 1.8G 0% /dev

tmpfs tmpfs 1.9G 0 1.9G 0% /dev/shm

tmpfs tmpfs 1.9G 10M 1.9G 1% /run

tmpfs tmpfs 1.9G 0 1.9G 0% /sys/fs/cgroup

/dev/sda3 xfs 18G 4.5G 14G 26% /

/dev/sda1 xfs 295M 174M 122M 59% /boot

tmpfs tmpfs 371M 1.2M 370M 1% /run/user/42

tmpfs tmpfs 371M 5.7M 366M 2% /run/user/1000

/dev/sdb1 xfs 80G 604M 80G 1% /mnt/veeamRepo

 

添加Harden Linux Repositoy的专属用户并设置权限:

[root@CentOS8 ~]# useradd -d /home/VeeamRepo -m VeeamRepo

[root@CentOS8 ~]# passwd VeeamRepo

Changing password for user VeeamRepo.

New password:

Retype new password:

passwd: all authentication tokens updated successfully.

[root@CentOS8 ~]# chown VeeamRepo.VeeamRepo /mnt/veeamRepo

[root@CentOS8 ~]# chmod 700 /mnt/veeamRepo

 

查看并确认/mnt/veeamRepo的权限:

[root@CentOS8 ~]# ls -l /mnt

total 0

drwxr-xr-x. 2 root root 6 Feb 27 13:57 hgfs

drwx------. 2 VeeamRepo VeeamRepo 6 Feb 27 14:34 veeamRepo

 

 

 

通过visudo添加VeeamRepo用户的elevate root权限:

[root@CentOS8 ~]# visudo

……

root ALL=(ALL) ALL

VeeamRepo ALL=(ALL) ALL

……

 

2. 添加Hardened Linux Repository

 

v2-64f017fa540504a5ab1f30877c55e84d.jpg

 

 

 

v2-f173ee79a2f8e0de1ce90ecbce2b07bd.jpg

 

 

 

v2-70e187446bc1fa94f787db3927c75142.jpg

 

 

 

v2-26d9b8ba06bb141e063533d602487b68.jpg

 

点击Add New…按钮

 

v2-e75b05a2d5d361f34c07cf43f15de7e2.jpg

 

 

输入要添加的Repository的Linux Server的IP:

 

v2-e45d2edb0eec4d746887c57ef8374ccc.jpg

 

选择“Single-use Credentials for hardened repository”选项,

 

v2-009e986677b114669476386b4fee78e0.jpg

 

输入之前创建的专属用户名/密码,其它都是缺省设置,“Elevate account privileges automatically“的选项缺省是打勾的。

 

v2-ab349bd2572b77593ce7294fbdefc179.jpg

 

点击Yes按钮

 

v2-e735e50c31a5d72b131614946aceba95.jpg

 

 

 

v2-f861d6e0708536091f2554bc7c1340f5.jpg

 

添加New linux Server成功,

 

v2-c0619dfc0ca9bca326084f874a8ee95d.jpg

 

 

 

v2-df821d170d6f6f468c2dea0f53b0b45d.jpg

 

自动跳回到New Backup Repositoy的界面,

 

v2-f3b03919ec409ccc500e670e1f017f97.jpg

 

 

点击populate按钮,可以看到之前创建的/mnt/veeamRepo文件系统信息,点击next按钮

 

v2-f5f7a8181ea14bba83f16aa350a02e34.jpg

 

 

 

v2-deb0987286902ef959617952d204b3b0.jpg

 

 

选择Repository的位置路径,把”Use fast cloning on XFS volumes(recommended)”选项打上勾,”Make recent backups immutable for .. days” 缺省是打勾的,且是7天,可以根据实际需求手工调整该值,但最小值是7天,Veeam Harden Linux Repsitory只支持forward incremental backup的备份方式,点击advance按钮。

 

v2-c6637c510edc705bc9e82fd233ffda5c.jpg

 

以下是advanced设置选项,

 

v2-42964325b42607a5626e230198efdef6.jpg

 

 

 

v2-f904fd1e203d3ceaaedd976013b2a071.jpg

 

 

 

v2-b31ca82f8746e3f2b05e5fc25fe63432.jpg

 

添加Hardened Linux Repository成功结果截图

 

v2-cbc71b8ccf1c318f0a95b2cc0397e9be.jpg

 

 

 

v2-245a7d60c722ad03b9281819cb993858.jpg

 

回到Linux Repository server,使用visudo命令,把“VeeamRepo ALL=(ALL) ALL“行开头添加#号,即禁掉VeeamRepo用户 ” Elevate to root”功能。

[root@CentOS8 ~]# visudo

 

v2-576e73f7977c3e2b2143ad9e92e7f9e7.jpg

 

 

运行命令查看并确认veeam transport进程信息:

[root@CentOS8 ~]# ps aux | grep veeam

 

v2-79f361869669372406ddd81e008c84ca.jpg

 

 

3. 发起备份作业并确认结果成功

 

 

v2-5002cc2c6031ee104193288cceace16c.jpg

 

 

v2-51f01eff8430d636a864dc0489fb751f.jpg

 

 

 

v2-cff1c34a89a80007278d8719ed2f019b.jpg

 

选择之前刚创建的Hardened repository: Backup Repository 1作为备份存储库

 

v2-23adb2acb653a7052d64f397c6feaeda.jpg

 

 

 

 

 

v2-8857e6b04aeb75d011c8768ff24dc09d.jpg

 

 

 

v2-905487563de777ce855669d26aedd9d3.jpg

 

 

 

v2-74b08f04d8b739b94da87e74d029724e.jpg

 

以下是备份作业成功结果截图:

 

v2-f99a1b2276b4b75e041e677e50ac7b1c.jpg

 

 

在Linux repository的/mnt/veeamRepo/Agent/Backup Job 1/192.168.249.111的具体该备份作业的目录下,使用lsattr -a命令查看,备份文件都是“i“, 表示是” immutable“。

 

v2-10a1c2b3b77561f0d5391f4b9ba7d2d4.jpg

 

在VBR console里尝试针对该备份作业的machine执行“Delete from disk“操作

 

v2-3ab84049d659df3df7de8b5b5f4e581e.jpg

 

选择Yes按钮

 

v2-261fee945fe4cf86f49edf1870c39d7b.jpg

 

结果显示是warning,具体信息是“unable to delete 1 immutable backup files”, “backup file can be deleted after 2021/3/7”, 即该备份文件是无法篡改或删除的,备份文件要7天之后才可删除。

 

v2-fd0ebc9a2eb0a374c6a0e0e5a98ebe8a.jpg

 

至此,表明Veeam V11 Hardened Linux Repository 配置成功。


3 comments

这个加固备份存储库(HLR)的目的地址必须是一台Linux OS(例如这里的CentOS)、但源地址可以是任意的只要安装了VeeamAgent的OS、无论是Windows、Linux还是MacOS,又或者是VBR可以接管的VM虚拟机是吗?

 

Userlevel 2
Badge

Hi yy,fu,

目前,加固的Linux备份存储库的OS目前支持如下的OS版本:

CentOS 8.2 and 8.3, Debian 10.x, RHEL 8.2 or later, SLES 15 SP2, Ubuntu 18.04 LTS and 20.04 LTS

https://helpcenter.veeam.com/docs/backup/vsphere/overview.html?ver=110

 

加固的Linux备份存储库目前支持以下备份作业类型:

  • VMware, Hyper-V VM backup jobs and backup copy jobs created by Veeam Backup & Replication
  • Backup copy jobs created by Veeam Backup for Azure, Veeam Backup for AWS and Veeam Backup for Google Cloud Platform
  • Physical machines backup jobs created by Veeam Agents (Windows, Linux, MAC, AIX, Solaris)
  • vCD VM backup jobs
  • VeeamZIP backup jobs
  • Nutanix AHV VM backup jobs created by Veeam Backup for Nutanix AHV

https://helpcenter.veeam.com/docs/backup/vsphere/hardened_repository.html?ver=110#jobs

 

谢谢Richard、很全、非常赞!

Comment