In Veeam Backup & Replication, a Hardened Repository refers to the use of single-use credentials or immutability, or a combination of both.
In Veeam Backup & Replication 11, when configuring a Hardened Repository with Immutability, it is recommended to use single-use credentials but not strictly required. Starting in Veeam Backup & Replication 12, single-use credentials will become a requirement for Hardened Repository Immutability.
To allow the upgrade to Veeam Backup & Replication 12 to complete, ensure that the account assigned to the underlying Linux server associated with the Hardened Repository with Immutability is either:
- Edit the Linux Server
- On the SSH Connection page of the Wizard, Click Add and select "Single-use credentials for hardened repository"
- Click Next through the pages of the Wizard, and finally, Click Finish to save the changes.
After changing the account used with the Linux server, the Veeam Data Movers will lose access to previously written restore points. Use the script below to reassign ownership of the backup files to the new non-root account to ensure continued access to the existing restore points.
Reassigning Ownership of Restore Points
When changing the account used by Veeam Backup & Replication to connect to the Linux server, all files and folders within the repository path must have their ownership changed using the chown command. However, the files marked as immutable must first have their immutability status removed using chattr -i. Once the ownership has been changed, the immutability flag must be reapplied to those files where it was removed using chattr +i. It is critical that only the files that were immutable before the ownership change have the immutability flag reapplied.
Below is an example bash script that performs these steps and tracks which files were immutable before the ownership change. This script is an example and may not function with some distributions of Linux. It should be run as root (or using sudo) to reassign ownership of the backup files in the immutable repository path.
./change_backup_owner.sh <repository_path> <username> <groupname>