Securing Veeam Recovery Orchestrator

This section includes recommendations for hardening specific Orchestrator components in addition to general security considerations.

Infrastructure Planning

For large-scale environments, it is recommended to add the Veeam Recovery Orchestrator server and other components to a management domain in a separate Active Directory forest. For medium-sized and small environments, Orchestrator components can be placed in a separate workgroup.

In both cases, Orchestrator components should be placed in a separate network where applicable.

Veeam Recovery Orchestrator Server

To secure the Veeam Recovery Orchestrator server, consider the following:

• Restrict outbound connections

To enable product update check, automatic license update, and license usage reporting, the Veeam Recovery Orchestrator server must be connected to the internet and be able to send requests to servers on the internet. Allow only HTTPS connections to the Veeam License Update Server (vao.butler.veeam.com) and Microsoft WSUS servers or Microsoft Update sites.

• Restrict inbound connections

Inbound connectivity to the Veeam Recovery Orchestrator server from the internet must not be allowed.

• Reduce the number of opened user sessions

Set the idle timeout to automatically sign out users if their session is opened for a long time. For more information, see Configure Report Retention Settings.

• Use the recommended ACL for the custom installation folder

If you specify a custom installation folder for Veeam Recovery Orchestrator, use the recommended Access Control List configuration to prevent privilege escalation and arbitrary code execution (ACE) attacks. Remove all inherited permissions from this folder — and then add the following permission entries:

For more information on security principals, see this Microsoft article.

Orchestrator Configuration Database

The Orchestrator configuration database stores credentials of user accounts required to connect to various components in the managed infrastructure. All passwords stored in the database are encrypted. However, users that have administrator privileges on the Veeam Recovery Orchestrator server can decrypt passwords, which is a potential threat.

To secure the configuration database, consider the following:

• Check that only authorized users can access the Veeam Recovery Orchestrator server and the server that hosts the configuration database (if the database runs on a dedicated server).
• To protect data, back up the configuration database on a regular basis. Also, make sure that the repository for the configuration database backups is not located in the same network as the Veeam Recovery Orchestrator server.

Orchestrator Web UI

To secure Orchestrator Web UI components, consider the following:

• Orchestrator Web UI components use Microsoft IIS Web Server. To reduce the attack surface, follow CIS Benchmark security guidelines for your Microsoft IIS version.
• Enable multi-factor authentication (MFA) in the Orchestrator UI to protect user accounts with additional user verification. For more information, see Enabling and Disabling Multi-Factor Authentication.