{"id":60063,"date":"2024-01-16T09:00:47","date_gmt":"2024-01-16T08:00:47","guid":{"rendered":"https:\/\/nolabnoparty.com\/?p=60063"},"modified":"2024-01-16T09:22:30","modified_gmt":"2024-01-16T08:22:30","slug":"veeam-linux-hardened-repository-using-iscsi","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/veeam-linux-hardened-repository-using-iscsi\/","title":{"rendered":"Veeam: Linux Hardened Repository using iSCSI"},"content":{"rendered":"

\"linux-hardened-repository-using-iscsi-01\"<\/p>\n

If no physical server is available and a NAS device is the only repository installed<\/strong>\u00a0in your network, you can configure a VM Linux as a Hardened Repository<\/a> using iSCSI to make backups immutable.<\/p>\n

Using a supported Linux distribution, it is possible to map a LUN via iSCSI<\/strong> to a Linux VM in your virtual infrastructure and use it as backup repository<\/strong> for your Veeam backup infrastructure. <\/p>\n

The storage device used in this procedure is a Synology NAS<\/strong> and the OS installed on the VM is a Linux Ubuntu 22.04.3 LTS<\/a>.<\/p>\n

 <\/p>\n

Configure a Linux Hardened Repository using iSCSI<\/h2>\n

Before starting the configuration of the Linux VM, you need to create an iSCSI Initiator as well as a LUN that will be used to store backups.<\/p>\n

 <\/p>\n

Configure the iSCSI Initiator<\/h4>\n

To configure an iSCSI LUN in Linux Ubuntu, make sure the open-iscsi package<\/strong> is installed in the system in use.<\/p>\n

# sudo apt -y install open-iscsi<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-02\"<\/p>\n

Enable the iSCSI service each time the server boots.<\/p>\n

# sudo systemctl enable open-iscsi<\/span>
\n# sudo systemctl enable iscsid<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-03\"<\/p>\n

Edit the \/etc\/iscsi\/initiatorname.iscsi<\/em> file to specify the correct iSCSI Initiator.<\/p>\n

# sudo vi \/etc\/iscsi\/initiatorname.iscsi <\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-04\"<\/p>\n

The system is configured with a default InitiatorName setting<\/strong>\u00a0that needs to be adjusted.<\/p>\n

\"linux-hardened-repository-using-iscsi-05\"<\/p>\n

Retrieve the configured IQN<\/strong> from the storage device used as backup repository.<\/p>\n

\"linux-hardened-repository-using-iscsi-06\"<\/p>\n

Replace in the \/etc\/iscsi\/initiatorname.iscsi<\/em> file the default InitiatorName<\/strong> with the IQN configured in the storage and save the file.<\/p>\n

InitiatorName=iqn.2000-01.com.lab:NAS-DS918BCK.Target01<\/em><\/p>\n

\"linux-hardened-repository-using-iscsi-07\"<\/p>\n

If the iSCSI connection requires authentication<\/strong>, edit the file \/etc\/iscsi\/iscsid.conf<\/em>.<\/p>\n

# sudo vi \/etc\/iscsi\/iscsid.conf<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-08\"<\/p>\n

Enable the automatic startup.<\/p>\n

node.startup = automatic<\/em><\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-09\"<\/p>\n

Enable and configure authentication settings<\/strong>.<\/p>\n

node.session.auth.authmethod = CHAP<\/em><\/span>
\nnode.session.auth.username = username<\/em><\/span>
\nnode.session.auth.password = password<\/em><\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-10\"<\/p>\n

Restart the iSCSI service.<\/p>\n

# sudo systemctl restart iscsid open-iscsi<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-11\"<\/p>\n

 <\/p>\n

Discovery and login to target<\/h4>\n

Run the following command to discover the iSCSI Target. The configured iSCSI Target iqn.2000-01.com.lab:NAS-DS918BCK.Target01<\/em> has been discovered successfully (in the example, two iSCSI Targets have been discovered).<\/p>\n

# sudo iscsiadm -m discovery -t sendtargets -p 192.168.10.31<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-12\"<\/p>\n

Now login to the target.<\/p>\n

# sudo iscsiadm --mode node --targetname iqn.2000-01.com.lab:NAS-DS918BCK.Target01 --portal 192.168.10.31 --login<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-13\"<\/p>\n

Check if the connection has been established<\/strong> to the storage device.<\/p>\n

# sudo iscsiadm -m session -o show <\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-14\"<\/p>\n

 <\/p>\n

Create a new partition and file system<\/h4>\n

After connecting the iSCSI disk, check the configured partitions in Ubuntu. A new disk sdb<\/strong> is displayed.<\/p>\n

# cat \/proc\/partitions <\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-15\"<\/p>\n

Retrieve the list of installed <\/strong>disks <\/strong>in Ubuntu to identify the disk used as repository.<\/p>\n

# sudo fdisk -l<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-16\"<\/p>\n

Since the partition to create is bigger than 2 TB<\/strong>, it is necessary to configure a GPT partition<\/strong>.<\/p>\n

# sudo parted \/dev\/sdb mklabel gpt<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-17\"<\/p>\n

Now create the partition using the entire disk formatted XFS<\/strong>.<\/p>\n

# sudo parted -a opt \/dev\/sdb mkpart primary xfs 0% 100%<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-18\"<\/p>\n

To check the just created partition, run the command:<\/p>\n

# lsblk<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-19\"<\/p>\n

Check the installed disks once again. Now the new \/dev\/sdb1<\/em> partition is displayed.<\/p>\n

# sudo fdisk -l<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-20\"<\/p>\n

To leverage the Fast-Clone technology<\/strong> in Veeam Backup & Replication<\/a>, we need to enable reflink and CRC<\/strong> formatting the partition with the following command:<\/p>\n

# sudo mkfs.xfs -b size=4096 -m reflink=1,crc=1 \/dev\/sdb1 -f -K<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-21\"<\/p>\n

 <\/p>\n

Mount the file system<\/h4>\n

Once the partition has been formatted, we mount the file system for use.<\/p>\n

If you want to mount the partition under \/mnt\/veeamrepo<\/em>, create the directory using mkdir<\/em>.<\/p>\n

# sudo mkdir -p \/mnt\/veeamrepo<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-22\"<\/p>\n

Mount the file system with the command:<\/p>\n

# sudo mount -o defaults \/dev\/sdb1 \/mnt\/veeamrepo<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-23\"<\/p>\n

Run the following command to check the file system:<\/p>\n

# df -Th<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-24\"<\/p>\n

Now retrieve the UUID<\/strong> of the new partition to be configured in the \/etc\/fstab<\/em> file.<\/p>\n

# sudo blkid \/dev\/sdb1<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-25\"<\/p>\n

Update the\u00a0\/etc\/fstab<\/em> file with the new UUID\u00a0to mount the filesystem automatically<\/strong> each time the server boots.<\/p>\n

# sudo vi \/etc\/fstab<\/span><\/p>\n

UUID=88d1bd31-1996-4545-9e5a-2b410364f13a \/mnt\/veeamrepo xfs _netdev 0 0<\/em><\/p>\n

Adding the value _netdev<\/strong>, the mount point will be mounted only after the network starts correctly.<\/p>\n

\"linux-hardened-repository-using-iscsi-26\"<\/p>\n

Restart the server and make sure the iSCSI LUN is m<\/strong>apped<\/strong> after booting.<\/p>\n

# sudo reboot
\n# df -Th<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-27\"<\/p>\n

 <\/p>\n

Create the Veeam user<\/h4>\n

You need to create a dedicated Veeam user with the correct permissions so that the Veeam Transport Service<\/strong>\u00a0has the correct rights to the Veeam mount.<\/p>\n

Create a\u00a0new account<\/strong> and create the password.<\/p>\n

# sudo useradd locveeam --create-home -s \/bin\/bash<\/span>
\n# sudo passwd locveeam<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-28\"<\/p>\n

To install the required Veeam components, we need to temporarily assign the just created user to the sudo<\/em> group to execute the commands as root<\/strong>.<\/p>\n

# sudo usermod -a -G sudo locveeam<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-29\"<\/p>\n

 <\/p>\n

Assign permissions to the mount point<\/h4>\n

Assign permissions to access the\u00a0\/mnt\/veeamrepo<\/em>\u00a0folder to the\u00a0locveeam<\/em> account and check assigned permissions.<\/p>\n

# sudo chown -R locveeam:locveeam \/mnt\/veeamrepo\/<\/span>
\n# sudo chmod 700 \/mnt\/veeamrepo<\/span>
\n# ll \/mnt<\/span><\/p>\n

\"linux-hardened-repository-using-iscsi-30\"<\/p>\n

 <\/p>\n

Test the Hardened Repository<\/h2>\n

Assigned the correct permissions, it's time to test the Hardened Repository<\/a> using iSCSI.<\/p>\n

 <\/p>\n

1. Create the new Hardened Repository using iSCSI in Veeam<\/strong><\/p>\n

Open the Veeam Backup & Replication console and configure the new Hardened Repository<\/strong> (follow this step-by-step procedure<\/a>).<\/p>\n

\"linux-hardened-repository-using-iscsi-31\"<\/p>\n

 <\/p>\n

2. Create a Backup Job<\/strong><\/p>\n

Create a Backup Job specifying the just created Hardened Repository to store the backup (follow this step-by-step procedure<\/a>).<\/p>\n

\"linux-hardened-repository-using-iscsi-32\"<\/p>\n

 <\/p>\n

3. Run the Backup Job<\/strong><\/p>\n

Run the Backup Job.<\/p>\n

\"linux-hardened-repository-using-iscsi-33\"<\/p>\n

 <\/p>\n

4. Check Immutability<\/strong><\/p>\n

Try to delete the just created backup to test if the backup is immutable. As expected the backup can't be deleted<\/strong> due to its immutability status.<\/p>\n

\"linux-hardened-repository-using-iscsi-34\"<\/p>\n

 <\/p>\n

Secure the Hardeneded Repository<\/h2>\n

Once the configuration and backup tests have been successfully completed, the Hardened Repository using iSCSI must be secured to avoid unauthorized accesses<\/strong>:<\/p>\n