Granular sudo Permissions Required for Hardened Repository
Purpose
This article documents the granular sudo permissions required to allow Veeam Backup & Replication to deploy and manage a Hardened Repository.
Solution
Account Requirements
- The Linux user account used by Veeam Backup & Replication to deploy and manage the Hardened Repository must use the bash shell.
- The Linux account used for a Hardened Repository must be a non-root account with root-equivalent permissions (sudo). Some administrators may prefer to restrict the account used by Veeam Backup & Replication to only be able to execute specific commands using sudo on the target Linux machine. (See example below.)
Granular Sudoer Drop-In Example
The example sudoers drop-in file below is compatible with all supported Linux distributions.
The example provided includes entries for the package managers of all supported Linux distributions. To further restrict sudoer permissions comment out or remove the lines for package managers not in use by the Linux distribution in use by the Hardened Repository.
- Debian/Ubuntu — Remove lines 17-23.
- SLES/openSUSE — Remove lines 17-21 and 24-25.
- RHEL/AlmaLinux/Rocky Linux/Oracle Linux — Remove lines 22-25.
Example /etc/sudoers.d/veeamsvc file:
More Information
The following command can be used to validate the sudoers drop-in file:
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.