Securing Veeam Recovery Orchestrator

This section describes best practices that help you harden specific Orchestrator components. For more information on hardening the whole managed infrastructure, see General Security Considerations.

Environment

For large-scale environments, it is recommended that you add the Veeam Recovery Orchestrator server and other components to a management domain in a dedicated Active Directory forest. For medium-sized and small environments, Orchestrator components can be added to a dedicated workgroup.

In both cases, all components must be connected to a dedicated network where applicable.

Veeam Recovery Orchestrator Server

To secure the Veeam Recovery Orchestrator server, consider the following:

• Restrict outbound connections

To allow Orchestrator to check for product updates, automatically renew the license and perform license usage reporting, the Veeam Recovery Orchestrator server must be connected to the internet. However, you must allow outbound HTTPS connections only to the Veeam License Update Server (vao.butler.veeam.com) and update sources provided by Microsoft (either WSUS servers or Update sites).

• Restrict inbound connections

Do not allow inbound connections to the Veeam Recovery Orchestrator server from the internet.

• Reduce the number of opened user sessions

Set the idle timeout to automatically sign out users if their session is opened for a long time. For more information, see Configure Report Retention Settings.

• Use the recommended ACL for the custom installation folder

If you specify a custom installation folder for Veeam Recovery Orchestrator, use the recommended Access Control List configuration to prevent privilege escalation and arbitrary code execution (ACE) attacks. Remove all inherited permissions from this folder — and then add the following permission entries:

For more information on security principals, see this Microsoft article.

Orchestrator Configuration Database

The Orchestrator configuration database stores credentials of user accounts required to connect to various components in the managed infrastructure. All passwords stored in the database are encrypted. However, users that have administrator privileges on the Veeam Recovery Orchestrator server can decrypt passwords, which is a potential threat.

To secure the configuration database, consider the following:

• Check that only authorized users can access the Veeam Recovery Orchestrator server and the server that hosts the configuration database (if the database runs on a dedicated server).
• To protect data, back up the configuration database on a regular basis. Also, make sure that the repository for the configuration database backups is not located in the same network as the Veeam Recovery Orchestrator server.

Orchestrator Web UI

To secure Orchestrator Web UI components, consider the following:

• Orchestrator Web UI components use Microsoft IIS Web Server. To reduce the attack surface, follow CIS Benchmark security guidelines for your Microsoft IIS version.
• Enable multi-factor authentication (MFA) in the Orchestrator UI to protect user accounts with additional user verification. For more information, see Enabling and Disabling Multi-Factor Authentication.