Hardening and Secure Veeam Backup and Replication Servers

In this post I will show you how to secure/hardening your Veeam Servers in addition to following the 3-2-1-1-0 security standard.

3: Maintain at least 3 copies of your data

By three copies, I mean that in addition to your primary data, you should also have at least two more backups of the same data.

2: Store the backups on 2 different media

Store one of the copies on internal hard disk drives and the other copy on removable storage media (tapes, external hard disk drives, cloud-storage, etc.)

1: Store at least 1 of the copies at an offsite location

One copy of the backups away from the physical location where the primary data and primary backup is located. If the company has no remote or branch office, an alternative could be saving a copy at a service provider in a private cloud or saving a copy in the public cloud.

1: Store at least 1 of the copies offline or immutable

Keep at least one copy of the backups offline (USB Drives, tapes ejected) or immutable (Linux with Veeam immutability or object storage with immutability).

0: Be sure to have verified backups without errors

Backups are only as good as they are being verified.

Hardening is about securing the infrastructure against attacks, by reducing its attack surface and thus eliminating as many risks as possible. One of the main measures in hardening is removing all non-essential software programs and utilities from the deployed Veeam components. While these components may offer useful features to the administrator, if they provide “back-door” access to the system, they must be removed during the hardening process.
Protecting your infrastructure successfully is all about understanding the current attack vectors; what and whom you are protecting, your Veeam infrastructure, against. If you know what and whom you are protecting against, makes it easier to take the correct countermeasures. One of those countermeasures is hardening.

Looking at the different Veeam Backup & Replication components you must protect the following components:

• Veeam Backup server
  
• User Accounts
• Backup repositories
• Backup data flows
  

Consider the Veeam Backup & Replication server to be the Number 1 target on your infrastructure and it should have very restricted access. As a general rule, the backup server is the single greatest target a hacker can claim on your network/infrastructure. Also the backup repositories which holds the backup files are a primary target.

There are two options to secure all the Veeam Servers. Let's see the details.

NetApp - Convert 7-Mode to Cluster-Mode and Upgrade ONTAP 8.X to 9.8

 

In this first post of 2022 I will show you how to convert from Data ONTAP 7-Mode to Data ONTAP Cluster Mode 8.X (and later versions). In this step-by-step, the source version is v8.2 and the final version will be v9.8. Be aware that this process will wipe all the data. So, you first need to backup all the data or move it to another repository.

First you need to check if yout Netapp has one or two controllers.

• One Controller: You don't need to perform any additional step;
  
• Two Controllers: You need to connect both controllers with a DAC Cable.
  

There are several in-between version upgrades that we need to do first, so we can go to v9.8. Let´s first see the Upgrade compatibility.