In the second part of the Veeam 13 series, I demonstrate the installation of a hardened repo server using the new infrastructure ISO file from Veeam. Since the system is intended to serve as the primary backup target, I naturally used a dedicated physical server rather than a VM.

Environment for the setup

For the setup, I´ve used the listed hardware and software stack.

  • Software Stack
    • Veeam Infrastructure Appliance 13.0.1.180_20251101
  • Hardware Stack
    • HPE ProLiant DL20 Gen9
    • Intel(R) Xeon(R) CPU E3-1220 v6 @ 3.00GHz
    • 8 GB Memory
    • HPE Ethernet 1Gb 2-port 332i Adapter
    • Storage for Backup Data
      • SmartArray P408i-a Controller
        • 2x 10T SAS HDD as RAID1
    • Storage for OS
      • 1x 240G SATA SSD

Download the right file

The first step is quite simple: log in to the Veeam homepage and download the appropriate file. When you go to the download page in your profile, just scroll down a little and look for the Veeam Infrastructure Appliance.

Clicking that link should download this file: VeeamInfrastructureAppliance_13.0.1.180_20251101.iso

Installation steps

Next, mount the iso file you just downloaded via the server’s remote interface (in my case, the ILO) and boot the server from the iso file.

Use the arrow keys to select “Veeam Hardened Repository”.
As its a new and fresh installation I´ve selected “Install”.

The bootloader will now transfer all necessary data from the ISO and then start the installer. This may take a few minutes.

When looking at the output on the screen, you can see that the installer automatically picked my small SSD as “system device”, while it picked my 10 TB RAID1 as “data device”.
Click on “Yes” to continue with the installation. Be aware that after that click, all data on the system will be wiped.
The installer is now preparing the storage layout and will automatically continue with installing the appliance. As soon as the installation is done, the system will perform a reboot.
Use the arrow keys the move down and hit enter to accept all agreements.
Give your system its hostname and continue with next.
I selected my active network card eno2 and then selected “static” in the right-hand menu to assign a static IP address.

If you need more advanced or complex network settings, such as tagged VLANs or NIC bonding, you must select the “Advanced” option in the menu. This will take you to the Network Manager text interface (nmtui), where you can configure these settings.

Enter IP, netmask and gateway and confirm everything with apply.

When network configuration is done, the next step will be timezone and NTP configuration.

As I´ve entered an NTP pool, I also selected Pool as the type.
Timezone and NTP servers set, go on with next.

As already known from the installation of the VBR server, you now have to assign passwords for the local admin and the security officer. Login is also secured here using 2FA.

Enter a DISA-compliant password, at least 15 characters, small and capital, numbers, special characters… You know the deal.
Use the shown code or the provided QR code to register your server within your preferred Authenticator app.
Provide a generated number to complete MFA setup.
Enter a DISA-compliant password again, at least 15 characters, lowercase and uppercase letters, numbers, special characters… You know how it works. Oh, and there’s another rule: the password must not be the same as the one for the admin user.
Recap time, you can scroll through the list one last time to verify that everything is correct, then finish the installation by hitting enter while “finish” is selected.
The system will now write down your config and bring up all services.
Once everything is done, you´ll see this screen.

Before the new repo server can be used, the security officer account must be initialized.
Normally, you would now take the link to the host management page and send it to a colleague from the security team along with the temporary password from the installation. Here at home, I simply switch to the role of SO and do this myself.

Security Officer account initialization

Login to the host management site with the veeamso user and the password from the setup.
Then change the password to a new one.
For sure, the SO also needs his account to be MFA secured, so scan the code or type in the key manually. Then enter the current valid response code and click on next.
Once that is completed, you will receive a recovery token. Please keep it in a safe and secure place.

That’s it for today. The repo server is now installed and the SO user is active.

In the next post, I will show you how to register the repo in the VBR server and use it as a backup destination.