Configuring RHEL Server
For post-installation, do the following:
To avoid retention issues that may happen if your hardened repository runs out of space, configure a disk quota for the backup data file system:
- Boot the operating system into the single user mode.
- Open the /etc/fstab/ file and add the usrquota mount option:
# <file system> <mount point> <type> <options> <dump> <pass> UUID=<UUID> /mnt/backup xfs defaults,usrquota 0 0 |
- Remount the disk:
umount /mnt/backup mount -o usrquota UUID=<UUID> /mnt/backup |
- Add hard and soft limits for the disk. Note that limits will depend on the disk size. It is recommended to configure soft limit equal to 98% of the disk capacity and hard limit equal to 99%.
An example for a disk with 100 GiB capacity:
xfs_quota -x -c 'limit bsoft=98g bhard=99g user1' /mnt/backup |
Note |
The user you specify when you configure the limits must be the owner of the directory that you created for the backup data. |
- Check that quota is enabled and the limits are properly configured:
xfs_quota -x -c 'report -h' /mnt/backup |
To configure system settings, do the following:
- Connect to the server using the user account you created.
- For the separate directory that you created for the backup data, allow access only for the user account you created during the installation. Use the following commands:
- To assign the directory's owner:
chown -R owner:group <dir_path> |
Both owner and group must be the user account you created during the installation.
- To allow access to the directory only for its owner and the root account:
chmod 700 <dir_path> |
- Enable automatic security updates:
sudo dnf install dnf-automatic -y |
After you enable automatic updates, change the following parameters in the /etc/dnf/automatic.conf file:
- upgrade_type to security
- apply_updates = yes
- Enable download timers for the security updates:
sudo systemctl enable dnf-automatic-download.timer sudo systemctl start dnf-automatic-download.timer sudo systemctl enable dnf-automatic-install.timer sudo systemctl start dnf-automatic-install.timer |
- To reduce the risk of server timing and man-in-the-middle attacks, change the /etc/sysconfig/chronyd configuration:
# Command-line options for chronyd OPTIONS="-R -F 2" |
Restart the service:
sudo systemctl restart chronyd |
- By default, the user account you created during the installation is a member of the wheel group and has sufficient privileges to deploy and install the required Veeam Backup & Replication components. For more information, see Adding Hardened Repositories. After the repository is added, you must remove the user account from the wheel group and disable SSH access. To do this, perform the following steps:
- Allow the user account to reboot and shutdown the operating system:
sudo bash -c "echo 'user1 ALL = (root) NOEXEC: /usr/sbin/reboot' >> /etc/sudoers" sudo bash -c "echo 'user1 ALL = (root) NOEXEC: /usr/sbin/shutdown' >> /etc/sudoers" |
- Disable SSH access to the server and remove the user account from the wheel group:
sudo systemctl disable sshd sudo systemctl stop sshd sudo gpasswd -d user1 wheel sudo reboot |
Note that this user account will lose sudo permissions. if you need to execute commands as a privileged user, you must boot the operating system into the single user mode.