Configuring RHEL Server
To configure system settings, do the following:
- Connect to the server using the user account you created.
- For the separate directory that you created for the backup data, allow access only for the user account you created during the installation. Use the following commands:
- To assign the directory's owner:
chown -R owner:group <dir_path> |
Both owner and group must be the user account you created during the installation.
- To allow access to the directory only for its owner and the root account:
chmod 700 <dir_path> |
- Enable automatic security updates:
sudo dnf install dnf-automatic -y |
After you enable automatic updates, change the following parameters in the /etc/dnf/automatic.conf file:
- upgrade_type to security
- apply_updates = yes
- Enable download timers for the security updates:
sudo systemctl enable dnf-automatic-download.timer sudo systemctl start dnf-automatic-download.timer sudo systemctl enable dnf-automatic-install.timer sudo systemctl start dnf-automatic-install.timer |
- To reduce the risk of server timing and man-in-the-middle attacks, change the /etc/sysconfig/chronyd configuration:
# Command-line options for chronyd OPTIONS="-R -F 2" |
Restart the service:
sudo systemctl restart chronyd |
- By default, the user account you created during the installation is a member of the wheel group and has sufficient privileges to deploy and install the required Veeam Backup & Replication components. For more information, see Adding Hardened Repositories. After the repository is added, you must remove the user account from the wheel group and disable SSH access. To do this, perform the following steps:
- Allow the user account to reboot and shutdown the operating system:
sudo bash -c "echo 'user1 ALL = (root) NOEXEC: /usr/sbin/reboot' >> /etc/sudoers" sudo bash -c "echo 'user1 ALL = (root) NOEXEC: /usr/sbin/shutdown' >> /etc/sudoers" |
- Disable SSH access to the server and remove the user account from the wheel group:
sudo systemctl disable sshd sudo systemctl stop sshd sudo gpasswd -d user1 wheel sudo reboot |
Note that this user account will lose sudo permissions. if you need to execute commands as a privileged user, you must boot the operating system into the single user mode.