Configuring Ubuntu Linux Server

When you configure system settings, consider the following Veeam recommendations:

• To be compliant with DISA STIG UBTU-20-010009, set a password for GRUB. To configure the setting manually, do the following:

1. Create a password using the grub-mkpasswd-pbkdf2 command:

2. Add a user name and a password hash at the end of the /etc/grub.d/40_custom file:

3. To disable asking for credentials after rebooting the system and require them only when editing boot menu entries, open the /etc/grub.d/10_linux file and add the --unrestricted parameter to the CLASS variable:

4. Update the GRUB configuration:

• To be compliant with DISA STIG UBTU-20-010455, disable all wireless network adapters, as described in this DISA STIG article.
• If you do not use the proxy server and the Linux server has outgoing HTTP internet access allowed, limit outgoing HTTP traffic to the Ubuntu servers only or use an internal Ubuntu mirror. To receive Linux security updates, there must be the access to the Linux distribution security update servers.
• For the separate directory that you created for the backup data, allow access only for the user account you created during the installation. Use the following commands:

• To assign the directory's owner:

Both owner and group must be the user account you created during the installation.

• To allow access to the directory only for its owner and the root account:

• To be compliant with DISA STIG UBTU-20-010012, you must have only two users:

• The root account. Note that by default the root account has a blank password and cannot be used for connection.
• The user account you created during the installation. This account will be used to connect to the Linux server and deploy required Veeam Backup & Replication components including persistent Veeam Data Mover, or transport service. For more information about Veeam Data Movers, see this section.

By default, the user account you created during the installation is the member of the sudo group and has enough privileges to deploy and install required Veeam Backup & Replication components. In that case, when you add a Linux server as a hardened repository to the backup infrastructure and specify single-use credentials, you do not need to enter the password for the root account. After the repository is added, you must remove the user account from the sudo group to make it a non-root account. To do this, perform the following steps:

1. Allow the user account to reboot and shutdown the operating system:

2. Remove the user account from the sudo group:

Note that the next time you log in with this user account, it will lose sudo permissions. if you need to execute commands as a privileged user, you must boot the operating system into the single user mode.