Veeam Agent Management Linux user account requirements

KB ID:	2676
Product:	Veeam Backup & Replication
Published:	2018-07-02
Last Modified:	2022-01-12

Challenge

Granular ‘sudo’ configuration for a Linux user account to be used for Agent Management.

Cause

As per the Agent Management User Guide, a user account for Agent Management should have administrative permissions on the computer that you want to add to a protection group or a job. If you would like to avoid using the ‘root’ account in favor of a sudoer account, you may also want to set permissions granularly for one. This document helps you to achieve this goal.

Solution

Linux user account used by Veeam Backup and Replication server for any Veeam Agent for Linux deployment and management operations must have /bin/bash shell set by default.
/etc/sudoers file should contain a line with ‘requiretty’ parameter negated explicitly for desired Linux user account
The account must have either ‘root’ permissions or permissions to execute a specific list of commands as a sudoer on the target Linux machine. (See examples below.)

sudoers examples

The examples below are for SUSE Linux Enterprise Server (SLES).

Process locations may need to be adjusted if using a different distro.

Veeam Agent for Linux v5.x / Veeam Backup & Replication v11a

Example /etc/sudoers entries for SLES 11 SP4:

 
                       ## Basic
Defaults:username !targetpw
username ALL=(root) /bin/chmod
username ALL=(root) /bin/chown
username ALL=(root) /bin/cp
username ALL=(root) /bin/mkdir
username ALL=(root) /bin/mv
username ALL=(root) /bin/rm
username ALL=(root) /opt/veeam/veeaminstaller
username ALL=(root) /usr/bin/id
username ALL=(root) /usr/bin/scp -p -t /opt/veeam/ValPackageIndex.xml
username ALL=(root) /usr/bin/scp -p -t /opt/veeam/veeaminstaller
username ALL=(root) /usr/bin/scp -p -t /tmp/*
username ALL=(root) /usr/bin/veeamconfig
username ALL=(root) /usr/bin/whoami
## FLR via console
username ALL=(root) /bin/mount
username ALL=(root) /bin/ping
username ALL=(root) /bin/ps
username ALL=(root) /bin/tar
username ALL=(root) /bin/uname
username ALL=(root) /tmp/*-*-*-*-*_vblkid
username ALL=(root) /tmp/VeeamAgent*-*-*-*-*
username ALL=(root) /usr/bin/test -e /tmp/
username ALL=(root) /usr/bin/gzip 
                      

Example /etc/sudoers entries for SLES 12 SP4

 
                       ## Basic
Defaults:username !targetpw
username ALL=(root) /opt/veeam/veeaminstaller
username ALL=(root) /usr/bin/chmod
username ALL=(root) /usr/bin/chown
username ALL=(root) /usr/bin/cp
username ALL=(root) /usr/bin/id
username ALL=(root) /usr/bin/mkdir
username ALL=(root) /usr/bin/mv
username ALL=(root) /usr/bin/rm
username ALL=(root) /usr/bin/touch
username ALL=(root) /usr/bin/uname
username ALL=(root) /usr/bin/veeamconfig
username ALL=(root) /usr/bin/whoami
## FLR via console
username ALL=(root) /bin/tar
username ALL=(root) /tmp/*-*-*-*-*_vblkid
username ALL=(root) /tmp/VeeamAgent*-*-*-*-*
username ALL=(root) /usr/bin/test -e /tmp/
username ALL=(root) /usr/bin/gzip
username ALL=(root) /usr/bin/mount
username ALL=(root) /usr/bin/ping
username ALL=(root) /usr/bin/ps 
                      

Veeam Agent for Linux v5.x / Veeam Backup & Replication v11

Example /etc/sudoers entries for SLES 11 SP4:

 
                       ## Basic
Defaults:username !targetpw
username ALL=(root) /bin/chmod
username ALL=(root) /bin/chown
username ALL=(root) /bin/cp
username ALL=(root) /bin/mkdir
username ALL=(root) /bin/mv
username ALL=(root) /bin/rm
username ALL=(root) /opt/veeam/veeaminstaller
username ALL=(root) /usr/bin/id
username ALL=(root) /usr/bin/scp -p -t /opt/veeam/ValPackageIndex.xml
username ALL=(root) /usr/bin/scp -p -t /opt/veeam/veeaminstaller
username ALL=(root) /usr/bin/scp -p -t /tmp/*
username ALL=(root) /usr/bin/veeamconfig
username ALL=(root) /usr/bin/whoami
## FLR via console
username ALL=(root) /bin/mount
username ALL=(root) /bin/ping
username ALL=(root) /bin/ps
username ALL=(root) /bin/tar
username ALL=(root) /bin/uname
username ALL=(root) /tmp/*-*-*-*-*_vblkid
username ALL=(root) /tmp/VeeamAgent*-*-*-*-*
username ALL=(root) /usr/bin/[ -d /tmp/ ]
username ALL=(root) /usr/bin/gzip 
                      

Example /etc/sudoers entries for SLES 12 SP4

 
                       ## Basic
Defaults:username !targetpw
username ALL=(root) /opt/veeam/veeaminstaller
username ALL=(root) /usr/bin/chmod
username ALL=(root) /usr/bin/chown
username ALL=(root) /usr/bin/cp
username ALL=(root) /usr/bin/id
username ALL=(root) /usr/bin/mkdir
username ALL=(root) /usr/bin/mv
username ALL=(root) /usr/bin/rm
username ALL=(root) /usr/bin/touch
username ALL=(root) /usr/bin/uname
username ALL=(root) /usr/bin/veeamconfig
username ALL=(root) /usr/bin/whoami
## FLR via console
username ALL=(root) /bin/tar
username ALL=(root) /tmp/*-*-*-*-*_vblkid
username ALL=(root) /tmp/VeeamAgent*-*-*-*-*
username ALL=(root) /usr/bin/[ -d /tmp/ ]
username ALL=(root) /usr/bin/gzip
username ALL=(root) /usr/bin/mount
username ALL=(root) /usr/bin/ping
username ALL=(root) /usr/bin/ps 
                      

Veeam Agent for Linux v4.x / Veeam Backup & Replication v10

Example /etc/sudoers entries for SLES 11 SP4

 
                       ## Basic
Defaults:username !targetpw  
username ALL=(root) /bin/arch
username ALL=(root) /bin/chmod
username ALL=(root) /bin/chown 
username ALL=(root) /bin/cp
username ALL=(root) /bin/mkdir
username ALL=(root) /bin/mv
username ALL=(root) /bin/rm
username ALL=(root) /bin/rmdir
username ALL=(root) /bin/uname
username ALL=(root) /opt/veeam/veeaminstaller
username ALL=(root) /usr/bin/id
username ALL=(root) /usr/bin/scp
username ALL=(root) /usr/bin/veeamconfig
username ALL=(root) /usr/bin/whoami
## FLR via console
username ALL=(root) /bin/ps
username ALL=(root) /bin/sh 
username ALL=(root) /bin/touch 
username ALL=(root) /sbin/modinfo 
username ALL=(root) /tmp/VeeamAgent*-*-*-* 
                      

Example /etc/sudoers entries for SLES 12 SP4

 
                       ## Basic
Defaults:username !targetpw  
username ALL=(root) /opt/veeam/veeaminstaller
username ALL=(root) /usr/bin/arch
username ALL=(root) /usr/bin/chmod
username ALL=(root) /usr/bin/chown
username ALL=(root) /usr/bin/cp
username ALL=(root) /usr/bin/id
username ALL=(root) /usr/bin/mkdir
username ALL=(root) /usr/bin/mv
username ALL=(root) /usr/bin/rm
username ALL=(root) /usr/bin/rmdir
username ALL=(root) /usr/bin/uname
username ALL=(root) /usr/bin/veeamconfig
username ALL=(root) /usr/bin/whoami
## FLR via console
username ALL=(root) /tmp/VeeamAgent*-*-*-*
username ALL=(root) /usr/bin/ps
username ALL=(root) /usr/bin/sh 
username ALL=(root) /usr/bin/touch 
username ALL=(root) /usr/sbin/modinfo  
                      

Veeam Agent for Linux v3.x / Veeam Backup & Replication v9.5u4

Example /etc/sudoers entries for SLES 11

 
                       ## Basic
Defaults:username !targetpw  
username ALL=(root) /bin/arch 
username ALL=(root) /bin/cat 
username ALL=(root) /bin/chown 
username ALL=(root) /bin/hostname 
username ALL=(root) /bin/mkdir 
username ALL=(root) /bin/rmdir 
username ALL=(root) /bin/uname 
username ALL=(root) /tmp/*/veeamagentid 
username ALL=(root) /usr/bin/id 
username ALL=(root) /usr/bin/test 
username ALL=(root) /usr/bin/whoami 
# Agent config/backup 
username ALL=(root) /usr/bin/veeamconfig 
# Agent deployment 
username ALL=(root) /bin/rpm 
username ALL=(root) /sbin/modinfo 
username ALL=(root) /usr/bin/zypper 
# FLR Restore via console 
username ALL=(root) /bin/chmod
username ALL=(root) /bin/mv
username ALL=(root) /bin/ps 
username ALL=(root) /bin/rm 
username ALL=(root) /bin/sh 
username ALL=(root) /bin/touch 
username ALL=(root) /tmp/VeeamAgent*-*-*-* 
                      

Click here to send feedback regarding this KB, or suggest content for a new KB.
To report a typo on this page, highlight the typo with your mouse and press CTRL +Enter.

Veeam Agent Management Linux user account requirements