Veeam Hardened Repository rev 04

Veeam Hardened Repository provides a secure, immutable backup repository for Veeam Backup & Replication. It runs as an isolated LXC container on the storage server, using ZFS-backed ZVOLs formatted with XFS as the backup storage target.

Note: Veeam Hardened Repository is delivered as an optional Small Update (the xc-veeam-hdrep module). This article describes revision 04. If your system was updated to a newer revision, refer to the matching Extension:Veeam_Hardened_Repository_rev_NN article.

How the hardening works

The "hardened" property is the result of two complementary mechanisms working together:

• Immutable backups — Veeam writes backups to the XFS repository with the Make recent backups immutable for N days setting enabled. While immutability is in effect, backup files cannot be modified or deleted from outside Veeam, protecting them from ransomware and accidental removal. The XFS filesystem is formatted with reflink support, which also enables Veeam's fast-clone (synthetic backup) optimisation.
• Minimal attack surface — the dedicated locveeam account is granted elevated privileges only during the initial Veeam onboarding handshake, then sudo is removed immediately afterwards. SSH access on port 22522 is disabled after onboarding completes, closing the inbound path entirely.

The role of the xc-veeam-hdrep module is to provision the XFS-on-ZVOL repository and orchestrate this temporary-privilege/SSH handshake. Veeam enforces immutability; the module enforces privilege minimisation.

Prerequisites

Before running the setup, ensure the following are in place:

• A ZFS storage pool with sufficient free space.
• One or more ZVOLs with veeam in the name (the setup script discovers ZVOLs by this keyword).
• Network access to the storage server from the Veeam Backup & Replication console.

Note: Setup does not require internet access. All software the repository needs is already included in the container image, and the Veeam Data Mover / transport components used during onboarding are delivered by the Veeam Backup & Replication server itself over the SSH connection on port 22522. An isolated or air-gapped storage server deployment is fully supported.

Accessing the container console

The repository container exposes a web-based console at:

 https://<server-ip>:4200/veeam-hdrep

Login: enter admin as the username and your storage server administrator password.

Accept the self-signed certificate warning if prompted. The console gives direct shell access to the container for running the initial setup and any subsequent maintenance commands.

Initial setup

Setup is performed once, using the interactive make_veeam_repo script included in the container. All steps below are run inside the container console.

Running the setup script

1. Connect to the container console at https://<server-ip>:4200/veeam-hdrep.
2. Navigate to the tools directory and run the setup script:

 cd /tools
 sudo ./make_veeam_repo

1. Follow the interactive prompts described in the sections below.

Note: The script needs root privileges to modify system files (SSH configuration, fstab, cron) and automatically elevates itself if it is not already running as root. sudo ./make_veeam_repo, as shown above, remains the recommended way to start it.

User account creation

The script creates the dedicated locveeam account (UID 1000) used exclusively for Veeam access. If the account does not yet exist, you will be prompted to set a password for it.

Log dataset selection

The script prompts you to select a ZFS pool where the _veeam_logs dataset will be created. This dataset stores Veeam service logs. The dataset itself remains in the selected pool — during setup the container moves its mount point to /var/lib/veeam and unmounts /Pools. This is automatic; no user action is required.

Note: If a _veeam_logs dataset already exists in the selected pool, back up its contents before proceeding.

ZVOL selection and formatting

The script lists all ZVOLs whose path contains veeam. Enter the numbers of the ZVOLs you want to use as backup repositories, separated by spaces.

For each selected ZVOL:

• If the ZVOL is already XFS-formatted, it is used as-is.
• If the ZVOL is not XFS-formatted, the script will warn that all data on the ZVOL will be erased. Type format to confirm, or anything else to cancel.

Formatting uses optimised XFS parameters for backup workloads:

Parameter	Value	Purpose
Block size	4096 bytes	Standard block size
Reflink	enabled	Efficient data deduplication at the XFS level
CRC	enabled	Metadata integrity checksums

Mount point configuration

For each formatted ZVOL, the script:

• Creates a mount point at /mnt/<zvol_name>.
• Adds an entry to /etc/fstab with the following XFS options:
  • noatime,nodiratime — disables access-time updates to reduce write overhead
  • nodiscard — disables TRIM for ZFS-backed storage compatibility
  • logbufs=8,logbsize=32k — XFS journal tuning for write-heavy workloads
  • nofail — system boots even if the mount is unavailable
• Sets ownership to locveeam:locveeam and permissions to 700.

Maintenance scheduling

The script configures automated filesystem trimming (fstrim) via cron. You will be prompted to choose a schedule:

• Daily
• Weekly (Mondays)
• Monthly (1st of the month)

A custom start time in 24-hour format can be selected for each option.

SSH configuration

SSH is enabled on port 22522 and configured to allow access for the locveeam user. The non-standard port is intentional — it avoids conflicts with the host SSH service and is required in the Veeam Backup & Replication repository configuration.

Temporary sudo privileges

After the repository volumes are prepared, the script temporarily grants locveeam sudo access. This allows the Veeam agent to perform its initial configuration steps (such as installing transport components) when you connect from the Veeam console.

The script pauses and waits for you to complete the Veeam-side setup (described in the next section). Once you confirm, sudo access is removed and SSH is disabled to harden the repository.

Configuring the Veeam side

With the storage prepared and locveeam temporarily elevated, complete the Veeam Backup & Replication wizard to register the repository. These steps are performed in the Veeam Backup & Replication console on your Windows backup server.

Note: Do not press Enter in the container console until you have completed all steps in this section and Veeam has finished deploying its transport components. The make_veeam_repo script is waiting at that prompt — pressing Enter removes sudo and disables SSH, which will interrupt a Veeam deployment still in progress.

Step 1 — Add Backup Repository

1. In the Veeam Backup & Replication console, navigate to Backup Infrastructure → Backup Repositories.
2. Right-click Backup Repositories and select Add Backup Repository.
3. When prompted for the repository type, select Direct attached storage.

Step 2 — Select Linux (Hardened Repository)

On the next screen, select Linux (Hardened Repository).

Step 3 — Name the repository

Enter a display name for the repository and click Next.

Step 4 — Add the Linux server and credentials

1. Click Add New next to the server field and enter the IP address or hostname of the storage server.
2. When prompted for credentials, click Add and choose Single-use credentials for hardened repository.
3. Enter the following:

• Username: locveeam
• Password: the password set during make_veeam_repo
• SSH port: 22522

1. Leave Elevate account privileges automatically enabled. The make_veeam_repo script has already granted temporary sudo to locveeam — no root password and no permanent sudoers entry are required.
2. When prompted, review and trust the server's SSH fingerprint.

Veeam will connect over SSH and install its Transport and Installer services on the container.

Step 5 — Select the backup directory

1. Click Populate to load the available storage.
2. Select /mnt/<zvol_name> — the XFS repository created by the script.

You may optionally append a subdirectory, for example /mnt/<zvol_name>/backups.

Step 6 — Repository properties

On the Repository step of the wizard, verify the following settings:

• Use fast cloning on XFS volumes — ensure this is checked. It is supported because the repository uses XFS with reflink enabled, and it reduces storage consumption for synthetic full backups.
• Make recent backups immutable for — set this to the number of days matching your retention requirement. Backups will be protected from modification or deletion for this period.

Click Next.

Step 7 — Mount server and finish

1. On the Mount Server step, the Veeam Backup & Replication server is pre-selected as the default mount server — click Next.
2. Review the summary and click Apply, then Finish.

Step 8 — Finalize and harden

Return to the container console where make_veeam_repo is still waiting. Confirm that Veeam has finished deploying its transport components (the wizard completed without errors), then press Enter.

The script will:

• Remove sudo from locveeam.
• Disable SSH on port 22522.

The repository is now hardened. The locveeam account remains active for Veeam's internal data-path use, but no interactive login path remains open.

Updating the Veeam Backup Server

When you later update the Veeam Backup Server, Veeam may need to update the Veeam Data Mover service on this repository over SSH. Because the repository is hardened — SSH is disabled and locveeam has no sudo — that connection is blocked. You need to open a temporary maintenance window before running the Veeam Backup Server update.

Open the container console at https://<server-ip>:4200/veeam-hdrep, then run:

 cd /tools
 sudo ./update_veeam_repo

The update_veeam_repo script re-enables SSH on port 22522 and grants locveeam temporary sudo (the Data Mover update requires the same elevated privileges as the initial onboarding), then waits. With the maintenance window open, run the Veeam Backup Server update from the Veeam console. When the update completes, return to the container console and press Enter — the script re-hardens the repository by removing sudo and disabling SSH.

Note: For security reasons, do not leave SSH enabled after the update is complete. Use update_veeam_repo for this purpose — do not re-run make_veeam_repo, as its SSH-enable step is gated behind ZVOL re-selection.

Storage and access reference

Path (inside container)	Purpose
/mnt/<zvol_name>	Backup data storage (XFS on ZVOL)
/var/lib/veeam	Veeam log dataset (ZFS dataset)
/var/lib/veeam/log/	Veeam service log files
/etc/fstab	Volume mount configuration
/etc/ssh/sshd_config	SSH daemon configuration (port 22522)
/etc/cron.d/fstrim_*	Automated trim schedules

Maintenance

Monitoring disk space

From the container console:

 df -h /mnt/<zvol_name>

Manual filesystem trim

 sudo fstrim /mnt/<zvol_name>

Checking mount status

 mountpoint /mnt/<zvol_name>
 mount | grep /mnt/<zvol_name>

Viewing logs

 journalctl -u ssh
 journalctl -u veeam-ds-logs
 tail -f /var/log/auth.log

Updates

Do not run system package updates inside the container. The container has limited disk space, and updates are delivered as new container revisions through the standard small-update mechanism.

Known issues and limitations

• ZVOLs must include "veeam" in the name. The setup script discovers ZVOLs by searching for this keyword in their device path. ZVOLs without it will not appear in the selection list.
• Formatting is destructive. Selecting a non-XFS ZVOL and confirming with format irreversibly erases all data on that ZVOL. Verify your selection before confirming.
• No in-container package updates. Due to disk space constraints, running apt upgrade or similar inside the container is not supported. Updates are delivered as new container revisions.
• SSH is a transient onboarding channel only. Veeam connects once over SSH on port 22522 using the password set for locveeam (single-use credentials) to deploy its Data Mover. Backup traffic afterwards does not use SSH. The setup script automatically disables SSH at the finalize step (after you press Enter to confirm onboarding is complete), so SSH key authentication is not required for normal operation. If you later need manual shell access, re-enable SSH and add public keys to /home/locveeam/.ssh/authorized_keys inside the container.

Changelog

rev 04

• The setup script (make_veeam_repo) now automatically elevates itself to root if it is not already running as root, so it completes reliably even if you forget to prefix it with sudo. Running it as sudo ./make_veeam_repo, as shown above, remains correct and is still the recommended way to start it.
• Removed a leftover package-installation check that could misfire and, on a storage server without internet access, print a long series of spurious connection errors. The required XFS tools have always shipped inside the container image, so this change only removes noise — it does not add or change any requirement.

rev 03

• SSH is now automatically disabled at the finalize step (Step 8) when onboarding completes, hardening the repository immediately without requiring manual intervention.
• New update_veeam_repo maintenance script to safely open and close the SSH and sudo window when updating the Veeam Backup Server — re-enables SSH on port 22522 and grants locveeam temporary sudo, then re-hardens on confirmation.

rev 02

• Initial release of Veeam Hardened Repository container.
• Interactive setup script (make_veeam_repo) for user account, ZVOL selection, XFS formatting, and SSH configuration.
• Automated fstrim scheduling via cron.
• Temporary sudo workflow for Veeam transport component installation.
• Log dataset support (_veeam_logs ZFS dataset mounted at /var/lib/veeam).

---

For further customization or troubleshooting, refer to the upstream Veeam documentation or contact Open-E support.