Object First Storage in Veeam Backup & Replication

Note: The configuration described in this article was tested on Veeam Backup & Replication 13.0.1, licensed with a Veeam Universal License (VUL), which is equivalent to Enterprise Plus. Object First Ootbi version 1.7.93.14382.

Configuring Ootbi via the Web Management Console

Object First is built on simplicity. Management and configuration are performed through a clear web interface. It is referred to by various names: Web UI, ObjectFirst S3 Web UI, Web Management Console, or Cluster Web Console.

Ideally, create a DNS record for the Cluster IP address and connect using a web browser, for example https://objectfirst.company.local:8443. Log in using the default user objectfirst and the password set during initial configuration.

Object Storage Principles

Ootbi is an S3-compatible object storage, which determines how it works and how it is used. A Bucket is the basic logical container (organizational unit) for storing objects. S3 Versioning is enabled on the bucket, which together with S3 Object Lock enables Immutability functionality.

Access to the bucket is done via an S3 Access Key, which is created within a user account (used for logging into the device's management interface). It consists of an Access Key ID and a Secret Key. Access can be controlled at the user level. An Access Key must be created before a Bucket can be created.

Users

• Adding User Access in the Dashboard
• ObjectFirst S3 Web UI - (Security) Users

Initially, a user objectfirst with Super Admin rights is created. Additional users with limited rights can be created by assigning user roles. To allow access via an S3 Access Key only to specific buckets, a user with the Bucket Manager role (Limited Access to S3) must be created, and an S3 Key created for that user. IAM policies are used for this purpose.

Creating an S3 Access Key

• Generating S3 Access Keys

In the ObjectFirst S3 Web UI, generate a new access key for the currently logged-in user.

• menu (Security) S3 Keys - Create key

Note: Some privileged actions must be confirmed by entering the password for your account. This also applies to creating an S3 Access Key.

• the created key (Access Key ID and Secret Access Key) will be displayed and must be copied, once the dialog is closed, it cannot be displayed again

Creating an S3 Bucket

• Creating Object First S3 Buckets

In the ObjectFirst S3 Web UI, create a new bucket. It is not possible to set its size, only some storage systems support this. Maximum capacity utilization can be managed on the Veeam Backup & Replication side.

• menu (Buckets) S3 Buckets - Create bucket
• enter a unique bucket name; naming rules are displayed
• leave Enable versioning checked
• under Advanced, a Region can optionally be specified
• create the bucket by clicking Create

Security

There are several things that should be configured to improve security.

• enable MFA on accounts - Configuring Multi-Factor Authentication
• IPMI access should be disabled, the network cable disconnected, or strictly network-controlled
• restrict physical access to the appliance
• other standard security measures

Accessing Objects on S3-Compatible Object Storage

Unfortunately, the ObjectFirst S3 Web UI does not allow browsing of data (objects) stored in a bucket. A dedicated S3 storage management tool can be used, such as S3 Browser. This is a paid application with a free version available for non-commercial use only.

Configuring Veeam Backup & Replication

In this article, the traditional thick client Veeam Backup & Replication Console is used for configuration.

Creating an S3 Compatible Backup Repository

Adding S3 Compatible Object Storage

• Veeam Backup & Replication Console
• Backup Infrastructure - Backup Repositories - Add Repository

• select Object Storage - S3 Compatible - S3 Compatible
• Name - unique name and description of the repository
• Account
  • Service Point - enter the FQDN or IP address of the object storage (https is used; a port can also be specified)
  • Region - likely not important for on-premises storage; us-east-1 can be used
  • Credentials - select or add access credentials for the object storage (Access key ID and Secret key)
  • Connection mode - choose the data transfer method to the object storage: either direct or through a gateway
• clicking Next will initiate a connection to the storage; a warning about an untrusted certificate will appear, which can be reviewed and confirmed by clicking Continue

Note: The question of certificates on storage systems is often quite complex. Object First apparently tries to simplify this. The administration interface does not provide any option to import a custom certificate. A self-signed certificate can be regenerated, which must then be accepted in VBR. Alternatively, a CA root certificate can be generated and exported. Generate SSL certificates

• Bucket
  • Bucket - select the pre-created bucket for storing backups
  • Folder - create a new folder using New Folder
  • Automatic bucket creation disabled - by default, automatic creation of sub-buckets is enabled; however, this feature is not supported for storage using SOSAPI with Smart Entity, so it can be disabled (if left enabled, a warning will appear during apply, indicating the feature could not be activated)
  • Limit object storage consumption to - a soft limit on storage utilization can be set; if the limit is exceeded, a running job will complete but no new job will start
  • Make backups immutable (recommended) - the immutability settings for object storage changed in VBR 13; the Minimum immutability duration value specifies the minimum period (in practice it may be longer, as the Block Generation period is still factored in) during which stored data cannot be modified or deleted; values from 1 to 999 days can be entered; additionally, the method for calculating the immutability period can be chosen: either For the entire duration of their retention policy or For the minimum immutability period only

• Mount Server - select the (Windows and/or Linux) mount server and its parameters for file and application item restores
• Review - click Apply and the installation and configuration of all required components will proceed

Creating a Backup Job

• Creating Backup Jobs

Object storage can be used in all standard backup jobs (Backup Job and Backup Copy Job) for secure storage of backups of VMs, physical machines, enterprise applications, transaction logs, etc. Immutability is applied automatically when data is written.

A backup job is created in the standard way, for example, for a Hyper-V VM in:

• Veeam Backup & Replication Console
• Home - Backup Job - Virtual Machine - Microsoft Hyper-V

In the Storage step, the added Object First Ootbi repository (S3 Compatible Repository) must be selected as the Backup repository. Backup immutability is governed by the settings on the repository (Backup Repository).

Backups and Immutability Information

Created backups can be found in the standard location:

• Veeam Backup & Replication Console
• Home - Backups - Object Storage

Opening the properties of a job displays a list of individual files and restore points. Each file shows the date until which it is immutable (Immutable Until).