Ai-B: Log dataset selection: clarify that the dataset stays in the pool and only its mount point is moved to /var/lib/veeam (veeam-ds-logs.service uses mount -o move). Previous wording implied the dataset itself was relocated.

2026-07-21T08:48:14Z

Log dataset selection: clarify that the dataset stays in the pool and only its mount point is moved to /var/lib/veeam (veeam-ds-logs.service uses mount -o move). Previous wording implied the dataset itself was relocated.

← Older revision		Revision as of 08:48, 21 July 2026
Line 53:		Line 53:
	=== Log dataset selection ===		=== Log dataset selection ===

	The script prompts you to select a ZFS pool where the '''_veeam_logs''' dataset will be created. This dataset ~~is mounted at~~ <code>/var/lib/veeam</code> ~~inside the container and stores Veeam service logs. The container automatically relocates this dataset out of the pool filesystem~~ and unmounts <code>/Pools</code> ~~during setup —~~ no user action is required ~~for this~~.		The script prompts you to select a ZFS pool where the '''_veeam_logs''' dataset will be created. This dataset stores Veeam service logs. The dataset itself remains in the selected pool — during setup the container moves its '''mount point''' to <code>/var/lib/veeam</code> and unmounts <code>/Pools</code>. This is automatic; no user action is required.

	'''Note:''' If a '''_veeam_logs''' dataset already exists in the selected pool, back up its contents before proceeding.		'''Note:''' If a '''_veeam_logs''' dataset already exists in the selected pool, back up its contents before proceeding.

Ai-B: Create rev 04 extension article: setup script self-elevates to root, package-install fallback removed; adds no-internet-required note and console login instructions. Based on the rev 03 draft (never published).

2026-07-21T08:25:39Z

Create rev 04 extension article: setup script self-elevates to root, package-install fallback removed; adds no-internet-required note and console login instructions. Based on the rev 03 draft (never published).

New page

__NOTOC__
Veeam Hardened Repository provides a secure, immutable backup repository for Veeam Backup & Replication. It runs as an isolated LXC container on the storage server, using ZFS-backed ZVOLs formatted with XFS as the backup storage target.

'''Note:''' Veeam Hardened Repository is delivered as an optional Small Update (the '''xc-veeam-hdrep''' module). This article describes revision '''04'''. If your system was updated to a newer revision, refer to the matching ''Extension:Veeam_Hardened_Repository_rev_NN'' article.

== How the hardening works ==

The "hardened" property is the result of two complementary mechanisms working together:

*'''Immutable backups''' — Veeam writes backups to the XFS repository with the '''Make recent backups immutable for N days''' setting enabled. While immutability is in effect, backup files cannot be modified or deleted from outside Veeam, protecting them from ransomware and accidental removal. The XFS filesystem is formatted with reflink support, which also enables Veeam's fast-clone (synthetic backup) optimisation.
*'''Minimal attack surface''' — the dedicated '''locveeam''' account is granted elevated privileges only during the initial Veeam onboarding handshake, then sudo is removed immediately afterwards. SSH access on port '''22522''' is disabled after onboarding completes, closing the inbound path entirely.

The role of the '''xc-veeam-hdrep''' module is to provision the XFS-on-ZVOL repository and orchestrate this temporary-privilege/SSH handshake. Veeam enforces immutability; the module enforces privilege minimisation.

== Prerequisites ==

Before running the setup, ensure the following are in place:

*A ZFS storage pool with sufficient free space.
*One or more ZVOLs with '''veeam''' in the name (the setup script discovers ZVOLs by this keyword).
*Network access to the storage server from the Veeam Backup & Replication console.

'''Note:''' Setup does not require internet access. All software the repository needs is already included in the container image, and the Veeam Data Mover / transport components used during onboarding are delivered by the Veeam Backup & Replication server itself over the SSH connection on port '''22522'''. An isolated or air-gapped storage server deployment is fully supported.

== Accessing the container console ==

The repository container exposes a web-based console at:

https://<server-ip>:4200/veeam-hdrep

'''Login:''' enter '''admin''' as the username and your storage server administrator password.

Accept the self-signed certificate warning if prompted. The console gives direct shell access to the container for running the initial setup and any subsequent maintenance commands.

== Initial setup ==

Setup is performed once, using the interactive '''make_veeam_repo''' script included in the container. All steps below are run inside the container console.

=== Running the setup script ===

#Connect to the container console at <code>https://<server-ip>:4200/veeam-hdrep</code>.
#Navigate to the tools directory and run the setup script:
cd /tools
sudo ./make_veeam_repo
#Follow the interactive prompts described in the sections below.

'''Note:''' The script needs root privileges to modify system files (SSH configuration, fstab, cron) and automatically elevates itself if it is not already running as root. <code>sudo ./make_veeam_repo</code>, as shown above, remains the recommended way to start it.

=== User account creation ===

The script creates the dedicated '''locveeam''' account (UID 1000) used exclusively for Veeam access. If the account does not yet exist, you will be prompted to set a password for it.

=== Log dataset selection ===

The script prompts you to select a ZFS pool where the '''_veeam_logs''' dataset will be created. This dataset is mounted at <code>/var/lib/veeam</code> inside the container and stores Veeam service logs. The container automatically relocates this dataset out of the pool filesystem and unmounts <code>/Pools</code> during setup — no user action is required for this.

'''Note:''' If a '''_veeam_logs''' dataset already exists in the selected pool, back up its contents before proceeding.

=== ZVOL selection and formatting ===

The script lists all ZVOLs whose path contains '''veeam'''. Enter the numbers of the ZVOLs you want to use as backup repositories, separated by spaces.

For each selected ZVOL:

*If the ZVOL is already XFS-formatted, it is used as-is.
*If the ZVOL is '''not''' XFS-formatted, the script will warn that '''all data on the ZVOL will be erased'''. Type <code>format</code> to confirm, or anything else to cancel.

Formatting uses optimised XFS parameters for backup workloads:
{| class="wikitable"
! Parameter !! Value !! Purpose
|-
| Block size || 4096 bytes || Standard block size
|-
| Reflink || enabled || Efficient data deduplication at the XFS level
|-
| CRC || enabled || Metadata integrity checksums
|}

=== Mount point configuration ===

For each formatted ZVOL, the script:

*Creates a mount point at <code>/mnt/<zvol_name></code>.
*Adds an entry to <code>/etc/fstab</code> with the following XFS options:
**<code>noatime,nodiratime</code> — disables access-time updates to reduce write overhead
**<code>nodiscard</code> — disables TRIM for ZFS-backed storage compatibility
**<code>logbufs=8,logbsize=32k</code> — XFS journal tuning for write-heavy workloads
**<code>nofail</code> — system boots even if the mount is unavailable
*Sets ownership to <code>locveeam:locveeam</code> and permissions to <code>700</code>.

=== Maintenance scheduling ===

The script configures automated filesystem trimming (<code>fstrim</code>) via cron. You will be prompted to choose a schedule:

*Daily
*Weekly (Mondays)
*Monthly (1st of the month)

A custom start time in 24-hour format can be selected for each option.

=== SSH configuration ===

SSH is enabled on port '''22522''' and configured to allow access for the '''locveeam''' user. The non-standard port is intentional — it avoids conflicts with the host SSH service and is required in the Veeam Backup & Replication repository configuration.

=== Temporary sudo privileges ===

After the repository volumes are prepared, the script temporarily grants '''locveeam''' sudo access. This allows the Veeam agent to perform its initial configuration steps (such as installing transport components) when you connect from the Veeam console.

The script pauses and waits for you to complete the Veeam-side setup (described in the next section). Once you confirm, sudo access is removed and SSH is disabled to harden the repository.

== Configuring the Veeam side ==

With the storage prepared and '''locveeam''' temporarily elevated, complete the Veeam Backup & Replication wizard to register the repository. These steps are performed in the Veeam Backup & Replication console on your Windows backup server.

'''Note:''' Do not press '''Enter''' in the container console until you have completed all steps in this section and Veeam has finished deploying its transport components. The '''make_veeam_repo''' script is waiting at that prompt — pressing Enter removes sudo and disables SSH, which will interrupt a Veeam deployment still in progress.

=== Step 1 — Add Backup Repository ===

#In the Veeam Backup & Replication console, navigate to '''Backup Infrastructure''' → '''Backup Repositories'''.
#Right-click '''Backup Repositories''' and select '''Add Backup Repository'''.
#When prompted for the repository type, select '''Direct attached storage'''.
[[File:Veeam_add_backup_repository.png|frameless|upright=1.4|Veeam: Add Backup Repository — choose Direct attached storage.]]

=== Step 2 — Select Linux (Hardened Repository) ===

On the next screen, select '''Linux (Hardened Repository)'''.
[[File:Veeam_linux_hardened_repository.png|frameless|upright=1.2|Veeam: select Linux (Hardened Repository).]]

=== Step 3 — Name the repository ===

Enter a display name for the repository and click '''Next'''.

=== Step 4 — Add the Linux server and credentials ===

#Click '''Add New''' next to the server field and enter the IP address or hostname of the storage server.
#When prompted for credentials, click '''Add''' and choose '''Single-use credentials for hardened repository'''.
#Enter the following:
*'''Username''': <code>locveeam</code>
*'''Password''': the password set during <code>make_veeam_repo</code>
*'''SSH port''': <code>22522</code>
#Leave '''Elevate account privileges automatically''' enabled. The '''make_veeam_repo''' script has already granted temporary sudo to '''locveeam''' — no root password and no permanent sudoers entry are required.
#When prompted, review and trust the server's SSH fingerprint.

Veeam will connect over SSH and install its Transport and Installer services on the container.

=== Step 5 — Select the backup directory ===

#Click '''Populate''' to load the available storage.
#Select <code>/mnt/<zvol_name></code> — the XFS repository created by the script.
:You may optionally append a subdirectory, for example <code>/mnt/<zvol_name>/backups</code>.

=== Step 6 — Repository properties ===

On the '''Repository''' step of the wizard, verify the following settings:

*'''Use fast cloning on XFS volumes''' — ensure this is checked. It is supported because the repository uses XFS with reflink enabled, and it reduces storage consumption for synthetic full backups.
*'''Make recent backups immutable for''' — set this to the number of days matching your retention requirement. Backups will be protected from modification or deletion for this period.
[[File:Veeam_fast_cloning_immutability.png|frameless|upright=1.4|Veeam: enable fast cloning on XFS and set backup immutability. The path shown is an example — yours will be /mnt/<zvol_name>.]]

Click '''Next'''.

=== Step 7 — Mount server and finish ===

#On the '''Mount Server''' step, the Veeam Backup & Replication server is pre-selected as the default mount server — click '''Next'''.
#Review the summary and click '''Apply''', then '''Finish'''.

=== Step 8 — Finalize and harden ===

Return to the container console where '''make_veeam_repo''' is still waiting. Confirm that Veeam has finished deploying its transport components (the wizard completed without errors), then press '''Enter'''.

The script will:
*Remove sudo from '''locveeam'''.
*Disable SSH on port '''22522'''.

The repository is now hardened. The '''locveeam''' account remains active for Veeam's internal data-path use, but no interactive login path remains open.

== Updating the Veeam Backup Server ==

When you later update the Veeam Backup Server, Veeam may need to update the Veeam Data Mover service on this repository over SSH. Because the repository is hardened — SSH is disabled and '''locveeam''' has no sudo — that connection is blocked. You need to open a temporary maintenance window before running the Veeam Backup Server update.

Open the container console at <code>https://<server-ip>:4200/veeam-hdrep</code>, then run:

cd /tools
sudo ./update_veeam_repo

The <code>update_veeam_repo</code> script re-enables SSH on port '''22522''' and grants '''locveeam''' temporary sudo (the Data Mover update requires the same elevated privileges as the initial onboarding), then waits. With the maintenance window open, run the Veeam Backup Server update from the Veeam console. When the update completes, return to the container console and press '''Enter''' — the script re-hardens the repository by removing sudo and disabling SSH.

'''Note:''' For security reasons, do not leave SSH enabled after the update is complete. Use <code>update_veeam_repo</code> for this purpose — do not re-run <code>make_veeam_repo</code>, as its SSH-enable step is gated behind ZVOL re-selection.

== Storage and access reference ==

{| class="wikitable"
! Path (inside container) !! Purpose
|-
| <code>/mnt/<zvol_name></code> || Backup data storage (XFS on ZVOL)
|-
| <code>/var/lib/veeam</code> || Veeam log dataset (ZFS dataset)
|-
| <code>/var/lib/veeam/log/</code> || Veeam service log files
|-
| <code>/etc/fstab</code> || Volume mount configuration
|-
| <code>/etc/ssh/sshd_config</code> || SSH daemon configuration (port 22522)
|-
| <code>/etc/cron.d/fstrim_*</code> || Automated trim schedules
|}

== Maintenance ==

=== Monitoring disk space ===

From the container console:

df -h /mnt/<zvol_name>

=== Manual filesystem trim ===

sudo fstrim /mnt/<zvol_name>

=== Checking mount status ===

mountpoint /mnt/<zvol_name>
mount | grep /mnt/<zvol_name>

=== Viewing logs ===

journalctl -u ssh
journalctl -u veeam-ds-logs
tail -f /var/log/auth.log

=== Updates ===

Do not run system package updates inside the container. The container has limited disk space, and updates are delivered as new container revisions through the standard small-update mechanism.

== Known issues and limitations ==

*'''ZVOLs must include "veeam" in the name.''' The setup script discovers ZVOLs by searching for this keyword in their device path. ZVOLs without it will not appear in the selection list.
*'''Formatting is destructive.''' Selecting a non-XFS ZVOL and confirming with <code>format</code> irreversibly erases all data on that ZVOL. Verify your selection before confirming.
*'''No in-container package updates.''' Due to disk space constraints, running <code>apt upgrade</code> or similar inside the container is not supported. Updates are delivered as new container revisions.
*'''SSH is a transient onboarding channel only.''' Veeam connects once over SSH on port <code>22522</code> using the password set for <code>locveeam</code> (single-use credentials) to deploy its Data Mover. Backup traffic afterwards does not use SSH. The setup script automatically disables SSH at the finalize step (after you press '''Enter''' to confirm onboarding is complete), so SSH key authentication is not required for normal operation. If you later need manual shell access, re-enable SSH and add public keys to <code>/home/locveeam/.ssh/authorized_keys</code> inside the container.

== Changelog ==

=== rev 04 ===

*The setup script (<code>make_veeam_repo</code>) now automatically elevates itself to root if it is not already running as root, so it completes reliably even if you forget to prefix it with <code>sudo</code>. Running it as <code>sudo ./make_veeam_repo</code>, as shown above, remains correct and is still the recommended way to start it.
*Removed a leftover package-installation check that could misfire and, on a storage server without internet access, print a long series of spurious connection errors. The required XFS tools have always shipped inside the container image, so this change only removes noise — it does not add or change any requirement.

=== rev 03 ===

*SSH is now automatically disabled at the finalize step (Step 8) when onboarding completes, hardening the repository immediately without requiring manual intervention.
*New <code>update_veeam_repo</code> maintenance script to safely open and close the SSH and sudo window when updating the Veeam Backup Server — re-enables SSH on port 22522 and grants <code>locveeam</code> temporary sudo, then re-hardens on confirmation.

=== rev 02 ===

*Initial release of Veeam Hardened Repository container.
*Interactive setup script (<code>make_veeam_repo</code>) for user account, ZVOL selection, XFS formatting, and SSH configuration.
*Automated <code>fstrim</code> scheduling via cron.
*Temporary sudo workflow for Veeam transport component installation.
*Log dataset support (<code>_veeam_logs</code> ZFS dataset mounted at <code>/var/lib/veeam</code>).

----

For further customization or troubleshooting, refer to the [https://www.veeam.com/documentation-guides-datasheets.html upstream Veeam documentation] or contact Open-E support.

[[Category:Help topics]]
[[Category:Extensions]]

Extension:Veeam Hardened Repository rev 04 - Revision history

Ai-B: Log dataset selection: clarify that the dataset stays in the pool and only its mount point is moved to /var/lib/veeam (veeam-ds-logs.service uses mount -o move). Previous wording implied the dataset itself was relocated.

Ai-B: Create rev 04 extension article: setup script self-elevates to root, package-install fallback removed; adds no-internet-required note and console login instructions. Based on the rev 03 draft (never published).