File Screen Managment Veeam Extensions

[dhallam]

Hi with the increse in ransomware i have been tasked to introduce File screening managment on our veeam server.
The server is a virtual windows 2012r2 server and has 2 datastores mounted as D: and E: that i would like to lock down as they only contain the veeam backup files.
Ideally i would like to creat a rule that only allows the veeam file extensions and deniy anything else.
Is their a list of veeam file extensions so i could create a rule to only allow those, thus hopefuly giving extra protection from corruption or encription of our backup files.


Cheers for any infomation

[Vitaliy S.]

If you need to know file extensions for Veeam backup files stored in the repository, then this list should be sufficient: *.vbk, *.vrb, *.vib, *.vbm, *.bco, *.vlb and all tmp files (created during synthetic backup)

You can re-confirm it, by browsing to your repository and checking the list of files you have there. Thanks!

[dhallam]

Cheers thanks for that, looks about spot on just didnt know if there we any more ones i might be missing

[Vitaliy S.]

You're welcome. I have edited my response above by adding an extension for Veeam configuration backup file, please add this one too.

[dhallam]

Cheers for that, i added all of the above including *.vbm* as the temp files are always vbm_2_tmp or somthing along those lines.

all working fine now

[Matts N]

Hello,
Quick question, shouldn't .vsb be in there too?

// Matts

[Mike Resseler]

Matts,

Correct, if you want to create a virtual full backup, we use a temporary file with VSB (Veeam Synthetic Backup) extension. The file does not contain backup data but pointers to data blocks inside files of the backup chain on disk. We need those pointers to create a full backup as for the needed day. the tape job detects these blocks (based on the pointers) and writes them to tape. While this is a temporary file, it might indeed be a good idea to exclude those, but as Vitaliy already mentioned the temporary files (and this being a temporary one...)

Cheers
Mike

[Matts N]

Thanks Mike! I think what triggered my question was that I understood Vitally to mean the *.vbm_????_tmp files as temporary files and only those files. .vsb is temporary, but it wasn't clear to me if those were included in Vitally's statement.

// Matts