In Veeam Backup & Replication a Hardened Repository refers to the use of single-use credentials or immutability, or a combination of both.

In Veeam Backup & Replication 11, when configuring a Hardened Repository with Immutability, it is strongly advised to use a non-root account. Starting in Veeam Backup & Replication 12, a non-root account will be a requirement. The account must be either:

• A persistent non-root account that has sudo capabilities (Account or Private Key)
  
  or
• Single-use credentials for hardened repository (recommended)

 

After changing the account used with the Linux server,  the Veeam Data Movers will lose access to previously written restore points. Use the script below to reassign ownership of the backup files to the new non-root account to ensure continued access to the existing restore points.
 

Change Account

1. Edit the Linux Server
2. On the SSH Connection page of the Wizard, add or select the non-root credentials.
3. Click Next through the pages of the Wizard, and finally, Click Finish to save the changes.

 

Reassigning Ownership of Restore Points

When changing the account used by Veeam Backup & Replication to connect to the Linux server, all files and folders within the repository path must have their ownership changed using the chown command. However, the files marked as immutable must first have their immutability status removed using chattr -i. Once the ownership has been changed, the immutability flag must be reapplied to those files where it was removed using chattr +i. It is critical that only the files that were immutable before the ownership change have the immutability flag reapplied.

Below is an example bash script that performs these steps and tracks which files were immutable before the ownership change. This script is an example and may not function with some distributions of Linux. It should be run as root (or using sudo) to reassign ownership of the backup files in the immutable repository path.

Script Syntax: ./change_backup_owner.sh <repository_path> <username> <groupname>