Configuring RHEL Server

For post-installation, do the following:

  1. Configure mount options.
  2. Configure system settings.

Configuring Mount Options

To avoid retention issues that may happen if your hardened repository runs out of space, configure a disk quota for the backup data file system:

  1. Boot the operating system into the single user mode.
  2. Open the /etc/fstab/ file and add the usrquota mount option:

# <file system>    <mount point>       <type>   <options>         <dump> <pass>

UUID=<UUID>        /mnt/backup         xfs      defaults,usrquota 0      0

  1. Remount the disk:

umount /mnt/backup

mount -o usrquota UUID=<UUID> /mnt/backup

  1. Add hard and soft limits for the disk. Note that limits will depend on the disk size. It is recommended to configure soft limit equal to 98% of the disk capacity and hard limit equal to 99%.

An example for a disk with 100 GiB capacity:

xfs_quota -x -c 'limit bsoft=98g bhard=99g user1' /mnt/backup

Note

The user you specify when you configure the limits must be the owner of the directory that you created for the backup data.

  1. Check that quota is enabled and the limits are properly configured:

xfs_quota -x -c 'report -h' /mnt/backup

Configuring System Settings

To configure system settings, do the following:

  1. Connect to the server using the user account you created.
  2. For the separate directory that you created for the backup data, allow access only for the user account you created during the installation. Use the following commands:

chown -R owner:group <dir_path>

Both owner and group must be the user account you created during the installation.

chmod 700 <dir_path>

  1. Enable automatic security updates:

sudo dnf install dnf-automatic -y

After you enable automatic updates, change the following parameters in the /etc/dnf/automatic.conf file:

  1. Enable download timers for the security updates:

sudo systemctl enable dnf-automatic-download.timer

sudo systemctl start dnf-automatic-download.timer

sudo systemctl enable dnf-automatic-install.timer

sudo systemctl start dnf-automatic-install.timer

  1. To reduce the risk of server timing and man-in-the-middle attacks, change the /etc/sysconfig/chronyd configuration:

# Command-line options for chronyd

OPTIONS="-R -F 2"

Restart the service:

sudo systemctl restart chronyd

  1. By default, the user account you created during the installation is a member of the wheel group and has sufficient privileges to deploy and install the required Veeam Backup & Replication components. For more information, see Adding Hardened Repositories. After the repository is added, you must remove the user account from the wheel group and disable SSH access. To do this, perform the following steps:
    1. Allow the user account to reboot and shutdown the operating system:

sudo bash -c "echo 'user1 ALL = (root) NOEXEC: /usr/sbin/reboot' >> /etc/sudoers"

sudo bash -c "echo 'user1 ALL = (root) NOEXEC: /usr/sbin/shutdown' >> /etc/sudoers"

  1. Disable SSH access to the server and remove the user account from the wheel group:

sudo systemctl disable sshd

sudo systemctl stop sshd

sudo gpasswd -d user1 wheel

sudo reboot

Note that this user account will lose sudo permissions. if you need to execute commands as a privileged user, you must boot the operating system into the single user mode.

Page updated 9/13/2024

Page content applies to build 12.3.0.310