Securing Veeam Recovery Orchestrator

This section describes best practices that help you harden specific Orchestrator components. For more information on hardening the whole managed infrastructure, see General Security Considerations.

Environment

For large-scale environments, it is recommended that you add the Veeam Recovery Orchestrator server and other components to a management domain in a dedicated Active Directory forest. For medium-sized and small environments, Orchestrator components can be added to a dedicated workgroup.

In both cases, all components must be connected to a dedicated network (where applicable).

Veeam Recovery Orchestrator Server

To secure the Veeam Recovery Orchestrator server, consider the following:

• Restrict outbound connections

  To allow Orchestrator to check for product updates, automatically renew the license and perform license usage reporting, the Veeam Recovery Orchestrator server must be connected to the internet. However, you must allow outbound HTTPS connections only to the Veeam License Update Server (vao.butler.veeam.com) and update sources provided by Microsoft (either WSUS servers or Update sites).

• Restrict inbound connections

  Do not allow inbound connections to the Veeam Recovery Orchestrator server from the internet.

• Reduce the number of opened user sessions

  Set the idle timeout to automatically sign out users if their session is opened for a long time.

• Use the recommended ACL for the custom installation folder

  If you specify a custom installation folder for Veeam Recovery Orchestrator, use the recommended Access Control List configuration to prevent privilege escalation and arbitrary code execution (ACE) attacks. Remove all inherited permissions from this folder — and then add the following permission entries:

  Veeam Recovery Orchestrator Server

  Principal	Access	Applies to
  Administrators	Full control	This folder, subfolders and files
  SYSTEM	Full control	This folder, subfolders and files
  CREATOR OWNER	Full control	Subfolders and files only
  Users	Read & execute	This folder, subfolders and files

  For more information on security principals, see this Microsoft article.

Orchestrator Configuration Database

The Orchestrator configuration database stores credentials of user accounts required to connect to various components in the managed infrastructure. All passwords stored in the database are encrypted; however, since users that have administrative permissions on the Veeam Recovery Orchestrator server can decrypt passwords, it may be a potential threat.

To secure the configuration database, consider the following:

• Make sure that only authorized users can access both the Veeam Recovery Orchestrator server and the
• Microsoft SQL Server hosting the configuration database (in case of remote installation).
• Back up the configuration database on a regular basis. Note that the backup repository and the Veeam Recovery Orchestrator server must not be connected to the same network.

Orchestrator Web UI

To secure the Orchestrator Web UI and reduce the attack surface, consider the following:

• Follow the CIS Benchmark security guidelines for the Microsoft IIS version running on the machine where the Orchestrator Web UI is installed.
• Enable multi-factor authentication (MFA) to protect user accounts accessing the Orchestrator Web UI.