Veeam Hardened Repository Part 3 - Adding to VBR and Usage

Note: The description in the article is based on Veeam Backup & Replication 12.3.1, licensed using Veeam Universal License (VUL), which is equivalent to Enterprise Plus. And Veeam Hardened Repository ISO 2.0.0.8 for v12.

Adding Hardened Repository

Note: Hardened Repository installed from VHR ISO can be added to VBR 12 and VBR 13 using Single-use credentials. Installation using Veeam Infrastructure Appliance 13 uses Certificate-based authentication and can only be added to VBR 13.

To Veeam Backup & Replication, we add a new Backup Repository of type Linux Hardened Repository.

• first we need to add a managed server to the backup infrastructure
• then create a Repository from a specific folder on the server

Note: Both steps can be performed together as part of Add Backup Repository

Enabling SSH on Hardened Repository

For deployment, we must first enable SSH on the Linux server. This also generates temporary / single-use credentials. After completion, we disable it again (it will automatically disable after a certain time).

• connect to the server console (e.g., iLO Remote Console)
• log in with the vhradmin account and access the Veeam Hardened Repository Configurator
• select Start SSH
• the password for the veeamsvc user will be displayed; we will use this account to add the repository to Veeam Backup & Replication

Adding Managed Server

Adding Linux Servers

• Veeam Backup & Replication Console
• Backup Infrastructure - Managed Servers - Add Server
• select Linux

• Name - enter either the full DNS name (FQDN) or IP address of the server
• SSH Connection - select Single-use credentials for hardened repository, which are not saved in the Veeam configuration; use the previously displayed veeamsvc account

• Veeam will attempt to connect to the server; usually it is necessary to confirm server trust (SSH key fingerprint); installed components are detected
• Review - clicking the Apply button will begin component installation and server configuration

Adding Repository

• Adding Hardened Repositories

Note: When creating the repository, we immediately set the immutability period in days, and this value is the same for all stored backups. Later we can change the value, but it only applies to new backups.

• Veeam Backup & Replication Console
• Backup Infrastructure - Backup Repositories - Add Repository
• select Direct Attached Storage - Linux (Hardened Repository)

• Name - unique name and description of the repository
• Server - select the just-added Repository server, click Populate to load folders from the server, mark our folder (Mount Point) typically /mnt/veeam-repository01

• Repository - the selected folder and backups subfolder are automatically suggested; the Populate button retrieves disk space information; check Use fast cloning on XFS volumes, enter the number of days for immutability period (7 to 9999 days); we can adjust other settings including special parameters under Advanced

• Mount Server - select the mount server and its parameters for file recovery, application items, and VM instant recovery
• Review - click Apply and installation and configuration of all required components will proceed

Disabling SSH on Hardened Repository

It is recommended to disable SSH access to the server when it is no longer needed.

• connect to the server console (e.g., iLO Remote Console)
• log in with the vhradmin account and access the Veeam Hardened Repository Configurator
• select Stop SSH

Backup Repositories List

• Veeam Backup & Replication Console
• Backup Infrastructure - Backup Repositories

Backups

Creating Backup Job

• Creating Backup Jobs

Hardened Repository can be used in all common backup jobs (Backup Job and Backup Copy Job) for secure storage of backups of VMs, physical machines, enterprise applications, transaction logs, etc. Immutability is not set automatically when data is stored (as with object storage), but is applied by the Veeam service after the backup session is completed (so it does not apply to files stored in other ways).

We create a backup job in the standard way, for example, for VMware VMs in

• Veeam Backup & Replication Console
• Home - Backup Job - Virtual Machine - VMware vSphere

In the Storage step, we must select our Hardened Repository as the Backup repository. Backup immutability will be at least the same as the Immutability period specified on the repository.

Using VHR requires Forward Incremental Backup Chain; if we select another option in the Advanced - Backup settings, we cannot proceed to the next step.

Backups and Immutability Information

Created backups can be found in the standard location

• Veeam Backup & Replication Console
• Home - Backups

If we open the properties of our job that stores backups on VHR, we will see the list of individual files and Restore Points. For individual files, there is a date until which they are immutable (Immutable Until).

Copying Backup Files

• Copying Files and Folders Manually

If we need to retrieve some files (typically backups) stored on the Hardened Repository, we have several options. When we enable SSH, we can use SCP (Secure Copy Protocol) and log in with the veeamsvc account.

It is simpler to use the Veeam Backup & Replication Console. We can copy the entire Backup Chain using Copy backup or create a Full Backup from selected Restore Points using Export backup. The destination for storage can be a Backup Repository or a local or shared folder.

For many situations, I find it best to use the file copy function in the Files view. Here we can browse the file system of servers that are added to the backup infrastructure. If we run the Veeam Backup & Replication Console on our computer, we can see it as well. Between these servers and hosts, we can easily copy files and folders.

• Veeam Backup & Replication Console
• Files
• expand the file tree of the source server or host
• right-click on a file or folder and select Copy
• expand the file tree of the destination server or host
• right-click on the destination folder and select Paste

Note: Files can also be copied within the Hardened Repository. When copying a file with Immutability set, the copy will not have immutability set.

Moving Existing Backups to Hardened Repository

• Backup Move, Moving Backups
• Alternative Method for Migrating Backups to Hardened Linux Repository

When we create a new backup job, we select our VHR as the storage and we will have backups protected by Immutability. If we have existing Backup Jobs and want their backups to be protected as well, we need to change the Repository for the given job.

Veeam Backup & Replication allows moving all backups of a specific Backup Job from the current storage to the Hardened Repository, thereby applying Immutability to them. The Move Backup function copies the backup files, modifies the backup job settings (Repository), and deletes the source files.

• Veeam Backup & Replication Console
• Home - Backups
• right-click on the job and select Move backup
• select our Hardened Repository as the Destination repository and confirm with OK

The job will be disabled, backups of individual objects will be copied, records in the DB will be updated, the destination repository will be set on the job, original files will be deleted, and the job will be enabled.

If possible, Fast Clone is also used.

Immutability will be set on the files (correctly in accordance with Retention policy and creation data).

[veeamsvc@backupstorage VMware-test2]$ lsattr -a
---------------------- ./.
---------------------- ./..
----i----------------- ./sab_alma8.vm-26437D2025-09-28T083904_1B59.vbk
----i----------------- ./sab_alma9.vm-48417D2025-09-27T093911_ABA2.vbk
----i----------------- ./sab_alma9.vm-48417D2025-09-27T123850_6375.vib
----i----------------- ./sab_alma9.vm-48417D2025-09-28T071023_863A.vib
----i----------------- ./sab_alma9.vm-48417D2025-09-28T083904_E64C.vib
---------------------- ./sab_alma8_5D826.vbm
---------------------- ./sab_alma9_C0669.vbm
----i----------------- ./.veeam.9.lock

Forever Forward Incremental (unsupported Backup Chain)

If we want to move backups to VHR that do not use Forward Incremental Backup Chain, we will get an incompatibility error. Due to the principle of how Immutability on VHR works (immutable files cannot be merged or deleted), we can only use Forward Incremental, where a periodic Full Backup is created.

If we want to move the backups, we need to modify the backup job parameters and then it is possible to move the files immediately. In my case, it was backups using Veeam Agent, where it was advantageous to use Forever Forward Incremental. To use VHR, I added the creation of Full Backup.

Backup Copy Job

Backup Copy Job uses Forever Forward Incremental Backup Chain by default. So when we try to use VHR as a destination during job creation or moving its backup, we get a notification and cannot proceed.

There is advice here for solving the problem. We need to set up GFS (Long-Term Retention Policy) on the copy job, which will cause it to start using Forward Incremental Backup Chain. We can use weekly full backups within GFS.

Moving Backups to Another Job

Move Backup can also be used to move a backup of a specific object (VM) to another backup job. This results in moving files and also moves the processing of the given workload to the target job.

• encrypted backups can only be moved to a job with encryption enabled (and vice versa)
• if the move is within a single repository without Immutability, native move within the file system is used
• in other cases, files (of selected workloads) are copied to the repository where the target job stores backups

When moving backups from a repository with active Immutability function, copying always occurs. Original files remain on the repository until the immutability period expires (we see them under Orphaned). This behavior does not change even if the move occurs within a single repository. This is unfortunate. I think VHR could support moving while preserving immutability.

• Veeam Backup & Replication Console
• Home - Backups
• expand the required job and select objects (workloads)
• right-click on the selection and choose Move backup
• select the target job as Destination backup job and confirm with OK