Category: VUG Spain

In a previous post, we saw how to deploy the packaged Ubuntu VHL, which applies the default hardening and script settings, including stronger user permissions.

If you want to install Ubuntu Server yourself and then apply the hardening, here are screenshots of a standard installation followed by the script.

Our Ubuntu Server has been hardened, and we can now follow the next article to add the repository to Veeam B&R v12 and make it immutable, starting with adding the repository to VBR v12.

Regards.

(Veeam Hardened Repository)

Hi! Today I finally got around to deploying and testing Veeam’s excellent VHR project, the VHR “Veeam Hardened Repository.”

It is a packaged Ubuntu Server deployment that has been hardened using DISA STIG security guidelines.

You can install the OS yourself and then run the Hardened script, but I was more interested in trying this “packaged” deployment.

I’ll share screenshots and a few comments; the process is very simple.
For this test, I deployed it as a virtual machine. However, VHR is designed to run on a physical server, not a VM.

You can find all the information and downloads here!

Let’s get started:

As a prerequisite, the installer looks for the smallest disk for the OS and the largest disk for the repository. I used a 20 GB disk and a 100 GB disk, and both were detected automatically.
For a physical server deployment, a RAID controller is recommended: a small RAID 1 for the OS and RAID 5 or 6 for the repository.

Now return to the VHR server we deployed to finish hardening it!

To troubleshoot, reboot and sign in to the server as root in standalone mode from the GRUB boot menu, since root is disabled and our user only has reboot and shutdown permissions.

I hope you found this useful and that it helps you deploy this great option.
I run it in my lab. As the documentation says, use it at your own discretion. It is unsupported, so you cannot open a support ticket for it!

To monitor the disks for failures, configure your server’s ILO, IPMI, DRAC, or equivalent, since the VHR OS does not send notifications.

Regards.

In the previous post, we saw how to create a replica in Veeam B&R v12.
Now I’ll briefly show you how to bring that replica into production if needed, and we’ll discuss a few use cases.

Let’s go!

Let’s briefly explain the two features I use most.
Failover now ->: Veeam starts the replica on the host we configured. This is the usual option if production is lost or stopped.
Planned failover ->: Safely shuts down the source and starts the replica without data loss, although there is an outage while the source powers off and the replica powers on.
You can use it to test replicas or run a VM on another host if you don’t have vMotion or something similar.

In our example, we’ll simulate a production outage, so choose “Failover now” and continue.

Once the machine is running as a replica, these are the final options:
Permanent failover: the replica remains as the VM.
Undo failover: discard all changes made to the replica and power it off.
Failback to production: copy changes made to the replica back to the production VM, then power off the replica and start the “original.”

If we lost the source machine or its storage, Permanent Failover is the better option. If we only lost connectivity to the storage array, we can use Failback to Production once connectivity is restored, copy over the changes, and continue as usual.

Let’s run Failback to Production to restore the original setup, copy changes from the replica back to production, and resume normal operations.

As a final step, after failing back the replica to production, we need to commit the operation. This completes the process, applies all changes, and returns the machines to their production and replica states.

Regards.

Join us for this session with Jose Maria, Senior Systems Engineer at Veeam. We’ll focus on protecting Kubernetes workloads with Kasten 10,
along with a brief introduction to the community and a demo!

First, this is just for fun and was set up in my lab for testing.

I’d been thinking about this for a while. Email notifications are fine, but when your inbox is full and you receive 100 or more messages a day, important ones can get missed. I wanted a way to receive important alerts outside of email, which is how I came up with the idea of getting Veeam notifications through Telegram!

Let’s take it step by step. First, we’ll create a Telegram bot to receive messages, then route them to a group chat or somewhere else:

In Telegram:

1. Type @BotFather in the Telegram search bar.
2. Choose the first option, marked with a red verification check (this confirms it is Telegram’s official bot).
3. Click START
4. Type the command /newbot or click it in the list of commands shown in the chat.
5. Next, enter a name for your bot and press Enter (for example, Telegram_Notifier).
6. You’ll now be asked to set a username, which must end in “bot” (for example, telegramnotifierBot).
7. Done! Save the token somewhere safe; we’ll need it for authentication later. Click the link to your new bot to open its chat.
8. Now we need our Telegram ID, so we’ll use another bot:
   Open IDbot and enter the /getid command.
   It will reply with your ID: …
   Make a note of it too.

In Windows, I created a PowerShell file called telegram.ps1 with the following content:

Function Send-Telegram {
Param([Parameter(Mandatory=$true)][String]$Message)
$Telegramtoken = "AQUÍ DEBEIS PEGAR VUESTRO TOKEN"
$Telegramchatid = "AQUI EL ID"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$Response = Invoke-RestMethod -Uri "https://api.telegram.org/bot$($Telegramtoken)/sendMessage?chat_id=$($Telegramchatid)&text=$($Message)"}

$A = Get-WinEvent -MaxEvents 1  -FilterHashTable @{Logname = "Veeam Backup"}
$Message = $A.Message
$MachineName = $A.MachineName
$Source = $A.ProviderName

Send-Telegram $Message

Save it wherever you like. Edit it to include your TOKEN and ID!

Next, we’ll use Windows Task Scheduler. I’ll include screenshots to make it easier.

Everything is configured. Let’s run a quick test. Open Veeam B&R, if it isn’t already open, go to Configuration Backup, and increase the configuration backup retention by one day. You should receive a notification in Telegram:

Configuration job has been modified.

If you start a backup job, you’ll receive a notification like this:

From here, fine-tune the events you want to receive from Veeam B&R through Telegram in Task Scheduler.

I hope this is useful.
I’m no programmer, so if you improve it (which I’m sure you will), get in touch so we can update the post and make the Telegram notifications even better!

Regards.

We’ll use screenshots to create our first backup job for a virtual machine, and then continue exploring.

Open the Veeam console home screen and go to Backup Job > Virtual machine (since we’ve already added the ESXi server).

Next time, we’ll look at restoring data from a Veeam backup: both a full machine restore and recovery of a single deleted file.

Regards.

Here are a few screenshots of the new installer for VBR 12.0.0.1402.

I have to say, they’ve made it look great and made installation easier than before…

Once the ISO is downloaded, open it and start the installation. Let’s follow the screenshots…

Here are a couple of screenshots showing the specifications of the machine where I installed Veeam v12, for your reference.

I usually create two partitions: one for the OS and Veeam database, and another for Veeam’s indexes, metadata, and local repository. The installer assigns the partitions automatically. I like to keep them separate so space issues on one volume don’t affect the OS, and vice versa.

We’ve installed Veeam B&R v12.

Now let’s go through the initial setup and review the general options before moving on to more advanced topics, such as backup and replication jobs.

Let’s start with General Options.

Let’s review the options and I’ll explain what I usually change.

This is where things get interesting: email settings for notifications and reports.

Now let’s move on to Configuration Backup.

An important point: for now, we’ll configure it to use the local repository, though we can change that later. We’ll also enable encryption for this backup and set a password so that the credentials we add later are saved in the backup:

Now let’s look at the Inventory tab, where we’ll add the machines to protect with our backup and replication jobs.

Here we can see both virtual machines and physical machines with the Veeam Agent installed and connected to this server.

Next, go to Backup Infrastructure. You’ll see the local repository and can add backup repositories. I also have a post showing how to create an S3 cloud repository with Wasabi; adding it is straightforward.

In future posts, we’ll look in more detail at adding local, CIFS, NFS, and S3 cloud repositories.

For now, we’re ready to create our first SIMPLE backup job.

Here’s a screenshot walkthrough showing how to add Wasabi S3 storage to VBR v12.

Important: v12 supports backing up directly to cloud S3. You don’t need intermediate storage to upload backups to S3.

For the immutable bucket, follow the same steps, then enable the option when prompted…

Now we can select them as backup destinations.