{"id":1138,"date":"2025-03-22T09:47:41","date_gmt":"2025-03-22T09:47:41","guid":{"rendered":"https:\/\/virtualall.sk\/?p=1138"},"modified":"2026-09-11T14:45:12","modified_gmt":"2026-09-11T14:45:12","slug":"lab-ubuntu-24-04-hardened-repository-pre-veeam","status":"publish","type":"post","link":"https:\/\/virtualall.sk\/en\/2025\/03\/lab-ubuntu-24-04-hardened-repository-pre-veeam\/","title":{"rendered":"Ubuntu Hardened Repository Veeam"},"content":{"rendered":"\n

Ako vyzer\u00e1 m\u00f4j home veeam hardened repository server?<\/h2>\n\n\n\n

Pri budovan\u00ed LAB infra\u0161trukt\u00fary pre testovanie a simul\u00e1ciu r\u00f4znych scen\u00e1rov z\u00e1lohovania pomocou Veeam som sa rozhodol vyu\u017ei\u0165 star\u00fd stoln\u00fd po\u010d\u00edta\u010d zna\u010dky Fujitsu<\/strong>, ktor\u00fd u\u017e d\u00e1vno stratil svoje miesto na stole ako be\u017en\u00fd desktop. Napriek svojmu veku sa v\u0161ak uk\u00e1zal ako \u00faplne posta\u010duj\u00face rie\u0161enie pre Veeam Hardened Repository<\/strong>.<\/p>\n\n\n\n

Hardv\u00e9r, ktor\u00fd e\u0161te nepatr\u00ed do \u0161rotu<\/h4>\n\n\n\n

Tento stroj je obsahuje procesor Intel Pentium G4400 @ 3.30GHz<\/strong>, ktor\u00fd s\u00edce dnes nikoho neoh\u00fari v\u00fdkonom, no pre potreby repozit\u00e1ra sl\u00fa\u017ei spo\u013eahlivo. K dispoz\u00edcii m\u00e1 8 GB RAM<\/strong>, \u010do je viac ne\u017e dos\u0165 pre jednoduch\u00fd Linuxov\u00fd syst\u00e9m ur\u010den\u00fd v\u00fdhradne na ukladanie z\u00e1loh.<\/p>\n\n\n\n

\u00dalo\u017eisko<\/h4>\n\n\n\n

Z\u00e1kladn\u00e1 syst\u00e9mov\u00e1 in\u0161tal\u00e1cia je na 500 GB disku Toshiba DT01ACA0<\/strong>, kde s\u00fa part\u00edcie rozdelen\u00e9 nasledovne:<\/p>\n\n\n\n

    \n
  1. \/dev\/sda<\/code> \u2013 463.8 GB pre syst\u00e9m, d\u00e1ta, logy a konfigura\u010dn\u00e9 s\u00fabory<\/li>\n<\/ol>\n\n\n\n

    Hlavn\u00e9 \u00falo\u017eisko pre z\u00e1lohy zabezpe\u010duj\u00fa dva 4 TB disky typu WD Gold<\/strong>:<\/p>\n\n\n\n

      \n
    1. \/dev\/sdb<\/code> \u2013 WDC WD4003FRYZ<\/strong><\/li>\n\n\n\n
    2. \/dev\/sdc<\/code> \u2013 WDC WD4003FFBX<\/strong><\/li>\n<\/ol>\n\n\n\n
      \"\u00dalo\u017eisko\"<\/figure>\n\n\n\n
      \"\u00dalo\u017eisko<\/figure>\n\n\n\n

      In\u0161tal\u00e1cia ubuntu<\/h2>\n\n\n\n

      Ako opera\u010dn\u00fd syst\u00e9m som si zvolil Ubuntu Server<\/strong>, konkr\u00e9tne jeho minim\u00e1lnu in\u0161tal\u00e1ciu<\/strong> bez grafick\u00e9ho prostredia. Tento v\u00fdber nebol n\u00e1hodn\u00fd \u2013 Ubuntu Server je dlhodobo overen\u00e9 rie\u0161enie s v\u00fdbornou komunitnou podporou, jednoduchou spr\u00e1vou a skvelou kompatibilitou s n\u00e1strojmi ako Veeam Backup & Replication<\/strong>. In\u0161tal\u00e1cia prebehla na star\u0161\u00ed 500 GB disk, ktor\u00fd som vy\u010dlenil v\u00fdhradne pre syst\u00e9mov\u00e9 \u00fa\u010dely. V r\u00e1mci in\u0161tal\u00e1cie som zvolil pou\u017eitie LVM (Logical Volume Manager)<\/strong>, \u010do mi umo\u017e\u0148uje flexibilnej\u0161ie pracova\u0165 s diskov\u00fdm priestorom v pr\u00edpade potreby (napr. zmeny ve\u013ekosti part\u00edci\u00ed, snapshoty apod.).<\/p>\n\n\n\n

      Konfigur\u00e1cia syst\u00e9mu je \u0161tandardn\u00e1 \u2013 root part\u00edcia, swap a boot. Na disku z\u00e1rove\u0148 ost\u00e1va dostatok miesta na pr\u00edpadn\u00e9 logovanie alebo pomocn\u00e9 skripty, ktor\u00e9 m\u00f4\u017eu by\u0165 v bud\u00facnosti vyu\u017eit\u00e9 pri spr\u00e1ve a automatiz\u00e1cii. Z poh\u013eadu spo\u013eahlivosti syst\u00e9mu<\/strong> je ide\u00e1lne, ak je aj syst\u00e9mov\u00fd disk nasaden\u00fd v RAID zrkadlen\u00ed (RAID 1)<\/strong>, \u010d\u00edm sa zabezpe\u010d\u00ed jeho dostupnos\u0165 v pr\u00edpade zlyhania jedn\u00e9ho z diskov. V mojom pr\u00edpade, ke\u010f\u017ee ide o dom\u00e1ce LAB rie\u0161enie, som sa rozhodol t\u00fato redudanciu neimplementova\u0165 \u2013 syst\u00e9m sa d\u00e1 v pr\u00edpade poruchy jednoducho znova nain\u0161talova\u0165. D\u00f4le\u017eit\u00e9 s\u00fa predsa d\u00e1ta.<\/strong> A pr\u00e1ve tie s\u00fa ulo\u017een\u00e9 na samostatn\u00fdch 4 TB diskoch (WD Gold), ktor\u00e9 sl\u00fa\u017eia ako hardened Veeam repository. Pr\u00e1ve tu je kritick\u00e9 ma\u0165 zabezpe\u010denie, integritu a ochranu pred stratou alebo manipul\u00e1ciou \u2013 syst\u00e9m si toti\u017e obnov\u00edm, ale straten\u00e9 z\u00e1lohy nie.<\/p>\n\n\n\n

      Nastavenie RAID<\/h2>\n\n\n\n

      Pre \u00fa\u010dely zabezpe\u010den\u00e9ho a redundantn\u00e9ho ukladania d\u00e1t som sa rozhodol vyu\u017ei\u0165 softv\u00e9rov\u00fd RAID1<\/strong>, ktor\u00fd poskytuje jednoduch\u00fa a spo\u013eahliv\u00fa ochranu d\u00e1t prostredn\u00edctvom zrkadlenia medzi dvoma fyzick\u00fdmi diskami. Ako s\u00faborov\u00fd syst\u00e9m som zvolil XFS<\/strong>, a to z konkr\u00e9tneho d\u00f4vodu \u2013 XFS ako jeden z m\u00e1la podporuje nastavenie s\u00faborov ako immutable (nezmenite\u013en\u00fdch)<\/strong> pomocou chattr +i<\/code>, \u010do je z\u00e1kladn\u00fd predpoklad pre spr\u00e1vne fungovanie Veeam Hardened Repository<\/strong>.<\/p>\n\n\n\n

      Nasleduj\u00faci postup demon\u0161truje, ako vytvori\u0165 RAID1 pole pomocou mdadm<\/code>, naform\u00e1tova\u0165 ho na XFS a pripoji\u0165 do adres\u00e1ra \/backup<\/code> tak, aby bolo pripraven\u00e9 na bezpe\u010dn\u00e9 z\u00e1lohovanie s podporou immutable ochrany s\u00faborov.<\/p>\n\n\n\n

      # In\u0161tal\u00e1cia potrebn\u00fdch bal\u00edkov\nsudo apt update\nsudo apt install mdadm xfsprogs -y\n\n# Vytvorenie RAID1 po\u013ea z dvoch diskov (napr. \/dev\/sdb a \/dev\/sdc)\nsudo mdadm --create --verbose \/dev\/md0 --level=1 --raid-devices=2 \/dev\/sdb \/dev\/sdc\n\n# (Volite\u013en\u00e9) Monitorovanie synchroniz\u00e1cie\ncat \/proc\/mdstat\n\n# Ulo\u017eenie konfigur\u00e1cie RAID po\u013ea\nsudo mdadm --detail --scan | sudo tee -a \/etc\/mdadm\/mdadm.conf\nsudo update-initramfs -u\n\n# Form\u00e1tovanie po\u013ea na XFS\nsudo mkfs.xfs \/dev\/md0\n\n# Vytvorenie mount pointu a pripojenie po\u013ea\nsudo mkdir -p \/backup\nsudo mount \/dev\/md0 \/backup\n\n# Z\u00edskanie UUID po\u013ea\nsudo blkid \/dev\/md0\n\n# Pridanie z\u00e1znamu do \/etc\/fstab pre automatick\u00e9 pripojenie\necho 'UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \/backup xfs defaults 0 0' | sudo tee -a \/etc\/fstab<\/code><\/pre>\n\n\n\n
      Nastavenie siete<\/h2>\n\n\n\n
      Hardened Repository server nie je len o s\u00faborovom syst\u00e9me a diskoch \u2013 bezpe\u010dnos\u0165 na \u00farovni siete<\/strong> je rovnako d\u00f4le\u017eit\u00e1 ako samotn\u00e1 d\u00e1tov\u00e1 ochrana. V mojej architekt\u00fare je tento server fyzicky aj logicky oddelen\u00fd<\/strong> od zvy\u0161ku infra\u0161trukt\u00fary pomocou Check Point firewallu<\/strong>, ktor\u00fd sl\u00fa\u017ei ako centr\u00e1lny bod pre kontrolu a monitoring sie\u0165ovej komunik\u00e1cie.<\/p>\n\n\n
      \n
      \"Nastavenie<\/figure>\n<\/div>\n\n\n
      Firewall je nakonfigurovan\u00fd tak, aby zabezpe\u010doval:<\/p>\n\n\n\n
        \n
      • Presn\u00e9 logovanie v\u0161etk\u00fdch pr\u00edstupov<\/strong> na \u00farovni paketov,<\/li>\n\n\n\n
      • Segment\u00e1ciu siete<\/strong> \u2013 Hardened Repository je umiestnen\u00fd v samostatnej z\u00f3ne\/subnete,<\/li>\n\n\n\n
      • Minim\u00e1lnu expoz\u00edciu<\/strong> \u2013 pr\u00edstup je povolen\u00fd iba pre autorizovan\u00e9 syst\u00e9my<\/strong>.<\/li>\n<\/ul>\n\n\n\n
        Povolen\u00e9 spojenia a pravidl\u00e1:<\/h4>\n\n\n\n
          \n
        • Veeam Backup Server<\/strong> \u2013 m\u00e1 povolen\u00fd pr\u00edstup iba cez port 22 (SSH)<\/strong>, \u010do je potrebn\u00e9 pre pripojenie a z\u00e1pis z\u00e1loh cez funkciu Linux Hardened Repository. Veeam pou\u017e\u00edva pr\u00edstup s nemenn\u00fdm (immutable) pr\u00edstupov\u00fdm pr\u00e1vom bez root opr\u00e1vnen\u00ed.<\/li>\n\n\n\n
        • Veeam Installer Service<\/strong> \u2013 m\u00e1 povolen\u00fd pr\u00edstup cez port 6160<\/strong>, ktor\u00fd sl\u00fa\u017ei na nasadzovanie a spr\u00e1vu agentov alebo komponentov Veeam<\/strong> na vzdialen\u00fdch syst\u00e9moch. Tento port je vyu\u017e\u00edvan\u00fd pri in\u0161tal\u00e1cii Data Mover slu\u017eieb alebo aktualiz\u00e1ci\u00e1ch cez rozhranie Veeam Backup & Replication.<\/li>\n\n\n\n
        • TCP 6162<\/strong> \u2013 port vyu\u017e\u00edvan\u00fd Veeam Data Mover Service<\/strong>, ktor\u00e1 zabezpe\u010duje samotn\u00fd prenos d\u00e1t medzi komponentmi infra\u0161trukt\u00fary.<\/li>\n\n\n\n
        • TCP 2500 \u2013 3300<\/strong> \u2013 predvolen\u00fd rozsah portov vyu\u017e\u00edvan\u00fdch ako d\u00e1tov\u00e9 kan\u00e1ly<\/strong> pre ka\u017ed\u00e9 spojenie vytvoren\u00e9 z\u00e1lohovacou \u00falohou. Pre ka\u017ed\u00fa TCP rel\u00e1ciu sa rezervuje jeden port z tohto rozsahu.<\/li>\n\n\n\n
        • Monitoring server (Checkmk)<\/strong> \u2013 m\u00e1 povolen\u00fd pr\u00edstup iba cez port 6556<\/strong>, \u010do je port pou\u017e\u00edvan\u00fd pre pas\u00edvne z\u00edskavanie inform\u00e1ci\u00ed o stave servera a diskov pomocou check_mk_agent<\/code>.<\/li>\n<\/ul>\n\n\n\n
          V\u0161etky ostatn\u00e9 spojenia s\u00fa defaultne zamietnut\u00e9<\/strong> a d\u00f4kladne logovan\u00e9. Firewall pravidl\u00e1 s\u00fa definovan\u00e9 tak, aby nedoch\u00e1dzalo ku \u017eiadnej zbyto\u010dnej komunik\u00e1cii<\/strong>, \u010d\u00edm sa minimalizuje vektor \u00fatoku a z\u00e1rove\u0148 udr\u017eiava vysok\u00fd \u0161tandard transparentnosti a auditu.<\/p>\n\n\n\n
          Hardening opera\u010dn\u00e9ho syst\u00e9mu<\/h2>\n\n\n\n
          V r\u00e1mci budovania bezpe\u010dn\u00e9ho z\u00e1lohovacieho prostredia som pou\u017eil bash skript<\/strong>, ktor\u00fd implementuje vybran\u00e9 odpor\u00fa\u010dania zo \u0161tandardu DISA STIG<\/strong> pre Linuxov\u00e9 syst\u00e9my. Cie\u013eom je zabezpe\u010di\u0165, aby Veeam Hardened Repository<\/strong> be\u017ealo na syst\u00e9me, ktor\u00fd je nielen izolovan\u00fd sie\u0165ovo a syst\u00e9movo, ale aj pevne nakonfigurovan\u00fd proti zn\u00e1mym zranite\u013enostiam a slab\u00fdm miestam.<\/p>\n\n\n\n
          K\u013e\u00fa\u010dov\u00e9 vlastnosti skriptu:<\/h4>\n\n\n\n
            \n
          • Automatick\u00e1 in\u0161tal\u00e1cia a aktiv\u00e1cia bezpe\u010dnostn\u00fdch komponentov (auditd<\/code>, AppArmor<\/code>, rsyslog<\/code>, ufw<\/code>, chrony<\/code> at\u010f.),<\/li>\n\n\n\n
          • Vyn\u00fatenie polit\u00edk pre hesl\u00e1, prihlasovanie a autoriz\u00e1ciu (napr. z\u00e1mok \u00fa\u010dtu, komplexita hesiel, pam_pwquality),<\/li>\n\n\n\n
          • Nastavenie auditovania syst\u00e9mov\u00fdch udalost\u00ed vr\u00e1tane bin\u00e1rnych oper\u00e1ci\u00ed, pou\u017e\u00edvania privilegovan\u00fdch pr\u00edkazov a pr\u00e1ce s konfigur\u00e1ciou,<\/li>\n\n\n\n
          • Ochrana syst\u00e9mov\u00fdch kni\u017en\u00edc, logov a audit n\u00e1strojov pred neopr\u00e1vnenou manipul\u00e1ciou,<\/li>\n\n\n\n
          • Aktiv\u00e1cia firewallu s bezpe\u010dn\u00fdm defaultn\u00fdm nastaven\u00edm a logovan\u00edm,<\/li>\n\n\n\n
          • Odstr\u00e1nenie zastaran\u00fdch alebo nebezpe\u010dn\u00fdch bal\u00edkov (telnet, rsh),<\/li>\n\n\n\n
          • Aktiv\u00e1cia syst\u00e9mov\u00fdch bezpe\u010dnostn\u00fdch mechanizmov ako Address Space Layout Randomization (ASLR)<\/strong>, sticky bit<\/strong>, disable USB mass storage<\/strong>, at\u010f.<\/li>\n<\/ul>\n\n\n\n
            Spustenie skriptu:<\/h4>\n\n\n\n
            Skript je mo\u017en\u00e9 spusti\u0165 na \u010derstvo nain\u0161talovanom Ubuntu serveri (napr. 24.04 LTS) s minim\u00e1lnou in\u0161tal\u00e1ciou. Pred samotn\u00fdm spusten\u00edm odpor\u00fa\u010dam skontrolova\u0165 a upravi\u0165:<\/p>\n\n\n\n
              \n
            • zoznam zapnut\u00fdch audit pravidiel,<\/li>\n\n\n\n
            • hodnoty \u010dasov\u00fdch timeoutov, politiky hesiel,<\/li>\n\n\n\n
            • vlastn\u00e9 NTP servery a bezpe\u010dnostn\u00e9 bannery.<\/li>\n<\/ul>\n\n\n\n
              git clone https:\/\/github.com\/VeeamHub\/veeam-hardened-repository.git\ncd veeam-hardened-repository\/\nchmod +x veeam.harden.sh\nsudo .\/veeam.harden.sh<\/code><\/pre>\n\n\n\n
              Aj ke\u010f je sie\u0165ov\u00e1 konektivita Veeam Hardened Repository striktne obmedzen\u00e1 (napr. cez Check Point firewall), v\u017edy existuje mo\u017enos\u0165, \u017ee sa syst\u00e9m stane cie\u013eom automatizovan\u00fdch brute-force \u00fatokov<\/strong>. Na ochranu proti t\u00fdmto pokusom je vhodn\u00e9 nasadi\u0165 Fail2Ban<\/strong>, ktor\u00fd monitoruje autentifika\u010dn\u00e9 logy a v pr\u00edpade nadmern\u00e9ho mno\u017estva chybn\u00fdch pokusov automaticky zablokuje IP adresu \u00fato\u010dn\u00edka<\/strong> pomocou iptables<\/code> alebo ufw<\/code>.<\/p>\n\n\n\n
              apt-get install -y fail2ban\n\n# Konfigur\u00e1cia z\u00e1kladn\u00e9ho jailu pre SSH\ncat << 'EOF' > \/etc\/fail2ban\/jail.d\/sshd.local\n[sshd]\nenabled = true\nport = ssh\nlogpath = %(sshd_log)s\nbackend = systemd\nmaxretry = 3\nbantime = 3600\nfindtime = 600\nEOF\n\n# Povolenie a spustenie slu\u017eby\nsystemctl enable --now fail2ban\nfail2ban-client status sshd<\/code><\/pre>\n\n\n\n
              Toto roz\u0161\u00edrenie je odpor\u00fa\u010dan\u00e9 pre ka\u017ed\u00fd syst\u00e9m s vystaven\u00fdm SSH portom, bez oh\u013eadu na to, \u010di sa nach\u00e1dza v interne alebo v DMZ. V kombin\u00e1cii s auditom, ufw<\/code> a AppArmor<\/code> predstavuje \u010fal\u0161\u00ed prvok obrany v h\u013abke (defense in depth<\/em>).<\/p>\n\n\n\n
              \u010eal\u0161\u00edm k\u013e\u00fa\u010dov\u00fdm krokom pri zabezpe\u010den\u00ed Veeam Hardened Repository je nastavenie bezpe\u010dnostn\u00fdch parametrov priamo na \u00farovni Linuxov\u00e9ho jadra<\/strong>. Tieto parametre ovplyv\u0148uj\u00fa spr\u00e1vanie sa syst\u00e9mu pri sie\u0165ovej komunik\u00e1cii, spracovan\u00ed pam\u00e4te a interakcii s pou\u017e\u00edvate\u013esk\u00fdm priestorom. Ide o tzv. sysctl<\/em> nastavenia, ktor\u00e9 zvy\u0161uj\u00fa odolnos\u0165 vo\u010di exploitom, zni\u017euj\u00fa povrch \u00fatoku a blokuj\u00fa nevhodn\u00e9 spr\u00e1vanie protokolov<\/strong>.<\/p>\n\n\n\n
              cat <<EOF > \/etc\/sysctl.d\/99-kernel-hardening.conf\nkernel.randomize_va_space=2\nkernel.yama.ptrace_scope=2\nfs.suid_dumpable=0\nnet.ipv4.ip_forward=0\nnet.ipv4.conf.all.send_redirects=0\nnet.ipv4.conf.default.send_redirects=0\nnet.ipv4.conf.all.accept_redirects=0\nnet.ipv4.conf.default.accept_redirects=0\nnet.ipv4.conf.all.secure_redirects=0\nnet.ipv4.conf.default.secure_redirects=0\nnet.ipv4.conf.all.log_martians=1\nnet.ipv4.conf.default.log_martians=1\nnet.ipv4.tcp_syncookies=1\nnet.ipv6.conf.all.disable_ipv6=1\nnet.ipv6.conf.default.disable_ipv6=1\nnet.ipv6.conf.all.forwarding=0\nnet.ipv6.conf.default.forwarding=0\nnet.ipv4.icmp_echo_ignore_broadcasts=1\nnet.ipv4.icmp_ignore_bogus_error_responses=1\nnet.ipv4.conf.all.rp_filter=1\nnet.ipv4.conf.default.rp_filter=1\nnet.ipv6.conf.all.accept_ra=0\nnet.ipv6.conf.default.accept_ra=0\nnet.ipv4.conf.all.accept_source_route=0\nnet.ipv4.conf.default.accept_source_route=0\nnet.ipv6.conf.all.accept_source_route=0\nnet.ipv6.conf.default.accept_source_route=0\nfs.protected_hardlinks=1\nfs.protected_symlinks=1\nkernel.kptr_restrict=2\nkernel.dmesg_restrict=1\nnet.ipv4.tcp_timestamps=0\nEOF\n\n# Aplikovanie nastaven\u00ed okam\u017eite\nsysctl --system<\/code><\/pre>\n\n\n\n
              Vysvetlenie niektor\u00fdch k\u013e\u00fa\u010dov\u00fdch parametrov:<\/p>\n\n\n\n
              Parameter<\/td>Popis<\/td><\/tr>
              kernel.randomize_va_space=2<\/code><\/td>Plne aktivuje ASLR \u2013 n\u00e1hodn\u00e9 rozmiestnenie pam\u00e4\u0165ov\u00fdch adries<\/td><\/tr>
              fs.suid_dumpable=0<\/code><\/td>Zakazuje dumpovanie pam\u00e4te pre SUID bin\u00e1rky<\/td><\/tr>
              net.ipv4.tcp_syncookies=1<\/code><\/td>Ochrana proti SYN flood \u00fatokom<\/td><\/tr>
              net.ipv4.conf.*.accept_redirects=0<\/code><\/td>Zakazuje ICMP redirecty \u2013 ochrana proti MITM \u00fatokom<\/td><\/tr>
              net.ipv4.conf.*.rp_filter=1<\/code><\/td>Aktivuje kontrolu sp\u00e4tnej cesty paketu \u2013 prevencia IP spoofingu<\/td><\/tr>
              net.ipv6.conf.*.disable_ipv6=1<\/code><\/td>Vyp\u00edna IPv6, ak nie je potrebn\u00fd (zn\u00ed\u017eenie attack surface)<\/td><\/tr>
              kernel.yama.ptrace_scope=2<\/code><\/td>Zakazuje ptrace (snooping procesov) mimo vlastn\u00e9ho UID<\/td><\/tr>
              fs.protected_symlinks=1<\/code><\/td>Zamedzuje zneu\u017eitiu symlinkov pri \u00fatokoch v \/tmp<\/td><\/tr>
              kernel.kptr_restrict=2<\/code><\/td>Skrytie adries jadrov\u00fdch symbolov v \/proc\/kallsyms<\/code><\/td><\/tr>
              kernel.dmesg_restrict=1<\/code><\/td>Zakazuje neprivilegovan\u00fd pr\u00edstup ku dmesg<\/code> (zamedzenie info leakov)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
              RKHunter<\/strong> (Rootkit Hunter<\/em>) je n\u00e1stroj na detekciu rootkitov, backdoorov a podozriv\u00fdch modifik\u00e1ci\u00ed syst\u00e9mov\u00fdch bin\u00e1rnych s\u00faborov<\/strong>. Kontroluje integritu d\u00f4le\u017eit\u00fdch \u010dast\u00ed syst\u00e9mu, h\u013ead\u00e1 zn\u00e1me znaky prienikov, modifik\u00e1cie opr\u00e1vnen\u00ed, skryt\u00e9 s\u00fabory a r\u00f4zne typy malwaru, ktor\u00e9 by mohli ohrozi\u0165 bezpe\u010dnos\u0165 z\u00e1lohovacieho repozit\u00e1ra. Aj ke\u010f syst\u00e9m nie je vystaven\u00fd verejne, v pr\u00edpade kompromit\u00e1cie (napr. cez supply chain, infikovan\u00fd software alebo slabinu vo Veeam serveri) je kritick\u00e9 v\u010das zisti\u0165 pr\u00edtomnos\u0165 rootkitu<\/strong> \u2013 teda komponentu, ktor\u00fd sa pok\u00fa\u0161a skr\u00fdva\u0165 svoju \u010dinnos\u0165 v syst\u00e9me.<\/p>\n\n\n\n
              apt-get install -y rkhunter\n\n# Aktualiz\u00e1cia datab\u00e1z signat\u00far a konfigura\u010dn\u00fdch s\u00faborov\nsed -i \\\n  -e 's|^MIRRORS_MODE *=.*|MIRRORS_MODE=1|' \\\n  -e 's|^UPDATE_MIRRORS *=.*|UPDATE_MIRRORS=1|' \\\n  -e 's|^WEB_CMD *=.*|WEB_CMD=\/usr\/bin\/wget|' \\\n  \/etc\/rkhunter.conf\nrkhunter --update\n\n# Prv\u00fd scan syst\u00e9mu\nrkhunter --checkall --sk\n\n# Automatick\u00e9 sp\u00fa\u0161\u0165anie cez cron (denne o 1:30)\necho \"30 1 * * * root \/usr\/bin\/rkhunter --cronjob --update --quiet\" > \/etc\/cron.d\/rkhunter<\/code><\/pre>\n\n\n\n
              Bezpe\u010dnostn\u00e9 odpor\u00fa\u010dania a nastavenia pod\u013ea DISA STIG<\/h6>\n\n\n\n
              Pri konfigur\u00e1cii syst\u00e9mu som dodr\u017eal odpor\u00fa\u010dania spolo\u010dnosti Veeam v s\u00falade s DISA STIG \u0161tandardmi pre Ubuntu. Pou\u017eit\u00fd bol vyhraden\u00fd pou\u017e\u00edvate\u013e a skupina veeam-user<\/code>, ktor\u00fd sl\u00fa\u017ei v\u00fdhradne na obsluhu Veeam komponentov a nie je s\u00fa\u010das\u0165ou skupiny sudo<\/code>.<\/p>\n\n\n\n
              Na splnenie po\u017eiadavky UBTU-20-010009<\/code> bola nastaven\u00e1 ochrana GRUB-u heslom:<\/p>\n\n\n\n
              grub-mkpasswd-pbkdf2<\/code><\/pre>\n\n\n\n
              Hash hesla sa pridal do \/etc\/grub.d\/40_custom<\/code>:<\/p>\n\n\n\n
              set superusers=\"root\"\npassword_pbkdf2 root grub.pbkdf2.sha512.10000.XXXX...<\/code><\/pre>\n\n\n\n
              V s\u00fabore \/etc\/grub.d\/10_linux<\/code> bol doplnen\u00fd parameter --unrestricted<\/code>:<\/p>\n\n\n\n
              CLASS=\"--class gnu-linux --class gnu --class os --unrestricted\"<\/code><\/pre>\n\n\n\n
              Aktualiz\u00e1cia GRUB:<\/p>\n\n\n\n
              sudo update-grub<\/code><\/pre>\n\n\n\n
              Na splnenie po\u017eiadavky UBTU-20-010455<\/code> boli zak\u00e1zan\u00e9 v\u0161etky bezdr\u00f4tov\u00e9 sie\u0165ov\u00e9 adapt\u00e9ry, ke\u010f\u017ee nie s\u00fa potrebn\u00e9 v serverovom prostred\u00ed<\/strong>.<\/p>\n\n\n\n
              Obmedzenie pr\u00edstupu k adres\u00e1ru so z\u00e1lohami<\/h6>\n\n\n\n
              Adres\u00e1r ur\u010den\u00fd pre Veeam z\u00e1lohy bol obmedzen\u00fd len pre veeam-user<\/code>:<\/p>\n\n\n\n
              chown -R veeam-user:veeam-user \/backup\nchmod 700 \/backup<\/code><\/pre>\n\n\n\n
              Syst\u00e9m obsahuje iba 2 pou\u017e\u00edvate\u013eov pod\u013ea UBTU-20-010012<\/code>:<\/p>\n\n\n\n