General Security Guidelines for Veeam Self-Service Backup Portal

Part 2: Adjust Website Settings to Enhance Security

These settings can further reduce the attack surface of the IIS-based websites for Veeam Backup Enterprise Manager.

1. Browse to the web app installation folder.
   Default: C:\Program Files\Veeam\Backup and Replication\Enterprise Manager\WebApp\
2. Make a backup copy of the original Web.config file to allow for easy reversion if needed.
3. Open the Web.config file in a text editor and make the following changes:
   • Disable IIS Version Header — By default, IIS will include a header like Server: Microsoft-IIS/10.0, which reveals the version of IIS being used. Setting enableVersionHeader = "false" adjusts the server configuration so that this version information is not included in the HTTP response headers. This adjustment is primarily a security measure aimed at reducing the amount of information disclosed to potential attackers.
     1. Find the node <httpRuntime and add the following option:

        enableVersionHeader = "false"
        

     2. The <httpRuntime settings should look like this afterward:

        <httpRuntime targetFramework="4.5" requestValidationMode="2.0" executionTimeout="300" enableVersionHeader="false" maxUrlLength="16384" maxQueryStringLength="2048000" maxRequestLength="2048000" enableVersionHeader="false" />
        

   • Enable X-Content-Type-Options Header — This setting prevents browsers from performing MIME type sniffing by setting X-Content-Type-Options to nosniff. By doing so, it ensures that browsers adhere to the specified Content-Type declared in the HTTP headers, rather than attempting to determine it themselves. This measure helps prevent security vulnerabilities like cross-site scripting (XSS) attacks and downloads of malicious content by enforcing strict handling of MIME types as they are served by the server.
     1. Find the <customHeaders> section and add the following option:

        <add name="X-Content-Type-Options" value="nosniff"/>
        

     2. The <customHeaders> section should look like this afterward:

        <customHeaders>
          <remove name="X-Powered-By" />
          <remove name="X-AspNet-Version" />
          <remove name="Server" />
          <add name="Strict-Transport-Security" value="max-age=31536000" />
          <add name="X-Content-Type-Options" value="nosniff" />
        </customHeaders>