Configuring Ubuntu Linux Server

For post-installation, do the following:

1. Configure mount options.
2. Configure system settings.

Configuring Mount Options

To avoid retention issues that may happen if your hardened repository runs out of space, configure a disk quota for the backup data file system:

1. Boot the operating system into the single user mode.
2. Open the /etc/fstab/ file and add the usrquota mount option:

3. Remount the disk:

4. Add hard and soft limits for the disk. Note that limits will depend on the disk size. It is recommended to configure soft limit equal to 98% of the disk capacity and hard limit equal to 99%.

An example for a disk with 100 GiB capacity:

5. Check that quota is enabled and the limits are properly configured:

Configure System Settings

When you configure system settings, consider the following Veeam recommendations:

• To be compliant with DISA STIG UBTU-20-010009, set a password for GRUB. To configure the setting manually, do the following:

1. Create a password using the grub-mkpasswd-pbkdf2 command:

2. Add a user name and a password hash at the end of the /etc/grub.d/40_custom file:

3. To disable asking for credentials after rebooting the system and require them only when editing boot menu entries, open the /etc/grub.d/10_linux file and add the --unrestricted parameter to the CLASS variable:

4. Update the GRUB configuration:

• To be compliant with DISA STIG UBTU-20-010455, disable all wireless network adapters, as described in this DISA STIG article.
• If you do not use the proxy server and the Linux server has outgoing HTTP internet access allowed, limit outgoing HTTP traffic to the Ubuntu servers only or use an internal Ubuntu mirror. To receive Linux security updates, there must be the access to the Linux distribution security update servers.
• For the separate directory that you created for the backup data, allow access only for the user account you created during the installation. Use the following commands:

• To assign the directory's owner:

Both owner and group must be the user account you created during the installation.

• To allow access to the directory only for its owner and the root account:

• To be compliant with DISA STIG UBTU-20-010012, you must have only two users:

• The root account. Note that by default the root account has a blank password and cannot be used for connection.
• The user account you created during the installation. This account will be used to connect to the Linux server and deploy required Veeam Backup & Replication components including persistent Veeam Data Mover, or transport service. For more information about Veeam Data Movers, see this section.

By default, the user account you created during the installation is the member of the sudo group and has enough privileges to deploy and install required Veeam Backup & Replication components. In that case, when you add a Linux server as a hardened repository to the backup infrastructure and specify single-use credentials, you do not need to enter the password for the root account. After the repository is added, you must remove the user account from the sudo group to make it a non-root account. To do this, perform the following steps:

1. Allow the user account to reboot and shutdown the operating system:

2. Remove the user account from the sudo group:

Note that the next time you log in with this user account, it will lose sudo permissions. if you need to execute commands as a privileged user, you must boot the operating system into the single user mode.