Requirements and Limitations

For the hardened repository, consider the following requirements and limitations.

Veeam Infrastructure Appliance Hardened Repository

When deploying a Veeam Hardened Repository with Veeam Infrastructure Appliance, consider the following:

• Hardened repositories created with Veeam Infrastructure Appliance must use certificate-based authentication. SSH cannot be used.

• It is strongly recommended that you disable the Host Management console Web UI on Veeam Infrastructure Appliance Hardened Repositories. This reduces the potential security attack surface.

• Multi-factor authentication cannot be disabled on hardened repositories that do not have security officer accounts enabled.
• If security officer accounts are enabled, you must initialize the default security officer account before you add the hardened repository to your Veeam Backup & Replication infrastructure.
• You attach the block storage for a Veeam Infrastructure Appliance Hardened Repository — local, iSCSI or Fibre Channel — in the Host Management console. For more information, see Managing Storage.
• You can allow a Veeam Infrastructure Appliance Hardened Repository to also function as an Application Backup repository. Combining both roles on the same appliance increases the attack surface on its immutability compared to using a standalone Veeam Hardened Repository. For more information, see Configuring Backup Infrastructure Settings.

Linux Server

• The role of the hardened repository can be assigned to a Linux machine with local or remotely attached block storage. The machine must meet system requirements for backup repositories.

• The Linux machine file system must support immutable files and extended attributes modified by the chattr and setxattr commands. We recommend using XFS for performance and space efficiency reasons (block cloning support).
• As the hardened repository requires the block storage, you cannot use the following storage types:

• NFS share or a Linux machine with the mounted NFS volume.
• ⁠A Linux machine with the mounted SMB (CIFS) volume.

• Depending on the Linux distribution, Veeam services use one of the following Linux firewall managers to operate correctly:

• firewalld
• ufw
• iptables
• [For IPv6] ip6tables

If none of these firewall managers are installed, make sure that you open all required ports manually. For more information, see Ports.

• You must add the Linux machine to the Veeam Backup & Replication console as a managed server. The hardened repository cannot be shared between different Veeam Backup & Replication servers.
• The Linux machine should have redundant network connection.
• Veeam Agent for Linux must not be installed on the Linux server.

Repository

• For the separate directory that you created for the backup data, consider the following:

• Both owner and group must be the user account you use to connect to the Linux server.
• Directory permissions must be 0700.
• Directory must not have a sticky bit.

• To store backup files in a repository, use only a forward incremental backup method with enabled active full backup or synthetic full backup. Once a backup file becomes immutable, it can be merged or deleted only when the immutability time period expires. For this reason, you cannot select a reverse or a forever forward incremental backup method.

• For importing a backup, use VBK backup files. Metadata files of a backup chain (.VBM) cannot be immutable because they are updated on every job pass.
• Veeam Backup & Replication does not support symlinks in the path to the hardened repository.
• Only Veeam Data Mover Service/Veeam Transport Service child processes can run under the root account on a hardened repository.
• Hardened repositories are not visible in the Files view in the Veeam Backup & Replication console.

Immutability Feature

• To use the immutability feature for backup copy jobs, enable the GFS retention policy. For more information, see Long-Term Retention Policy (GFS).