Posted on by Luis Freixas

Installing and Integrating Veeam Hardened Repository in VBR 12

(Veeam Hardened Repository)

Hi! Today I finally got around to deploying and testing Veeam’s excellent VHR project, the VHR “Veeam Hardened Repository.”

It is a packaged Ubuntu Server deployment that has been hardened using DISA STIG security guidelines.

You can install the OS yourself and then run the Hardened script, but I was more interested in trying this “packaged” deployment.

I’ll share screenshots and a few comments; the process is very simple.
For this test, I deployed it as a virtual machine. However, VHR is designed to run on a physical server, not a VM.

You can find all the information and downloads here!

Let’s get started:

As a prerequisite, the installer looks for the smallest disk for the OS and the largest disk for the repository. I used a 20 GB disk and a 100 GB disk, and both were detected automatically.
For a physical server deployment, a RAID controller is recommended: a small RAID 1 for the OS and RAID 5 or 6 for the repository.

Boot the ISO.
Network configuration: a bond using two network cards is recommended and easy to set up with the wizard.
In my lab, I used a single DHCP-configured network card.
If you use a proxy server for internet access, be sure to configure it, since the installer downloads security updates during setup.
WARNING! This will erase all data on the disks and install the OS and repository.
If you are reinstalling the OS because of a failure, do not do this or you will lose everything.
Create a user.
Here we go!
The updates are running.
That’s it. Now reboot.
On first boot, sign in with the user you created earlier…
Read the disclaimer carefully: after this initial setup and reboot, the OS will be hardened and all commands will be disabled for this user except reboot and shutdown!
Make any adjustments before rebooting, and add the server to Veeam VBR first!
In VBR, open the wizard to add a backup repository.
HARDENED!!!
Add the VHR server you just deployed.
Use single-use credentials; otherwise, the connection will fail. This is a hardened repository, so every detail should be as secure as possible!
Continue through the wizard.
Select the drive where you want to store the backups: the repository drive!
Set the immutability period in days. I left the default at 7 days!
Continue with the usual repository configuration.
Done!

Here is our immutable repository, ready to use independently, as a SORB, and so on…

Now return to the VHR server we deployed to finish hardening it!

As you can see, we’ve added it to VBR. Now reboot the server. The hardening script will run, leaving the user with only the shutdown and reboot options.
Done! The disclaimer confirms that hardening has been completed.
Everything is ready to use the repository on our secure server.

To troubleshoot, reboot and sign in to the server as root in standalone mode from the GRUB boot menu, since root is disabled and our user only has reboot and shutdown permissions.

I hope you found this useful and that it helps you deploy this great option.
I run it in my lab. As the documentation says, use it at your own discretion. It is unsupported, so you cannot open a support ticket for it!

To monitor the disks for failures, configure your server’s ILO, IPMI, DRAC, or equivalent, since the VHR OS does not send notifications.

Regards.