[Feature Request] - Export Backup with encryption

[NickSPH]

We may want to export a specific restore point for longer term archiving. For example, the last restore point of the year. I think the Export Backup option is ideal for this use-case, as is also mentioned in the user guide. According to veeam-backup-replication-f2/feature-req ... 60333.html the option to export to another location has been added in V12 which I can confirm. Unfortunately, it doesn't seem possible to encrypt an exported backup. This is necessary for us when we want to export the backup to an external HDD.

I did see the same question being asked at vmware-vsphere-f24/export-backup-t62326.html, but unfortunately without a reply.

The option to encrypt a backup is available for Backup (Copy) Jobs, and VeeamZIP. I think it would be a nice addition if it were also made available for Export Backup.

If an alternative is available, other than creating a Backup Copy Job as this can only copy the latest restore point afaik, please do share!

[Mildur]

Hi Nick

It's not available for export backup. Thanks for the request, we count it as +1.
May I ask what type of repository you will use for "longer-term archiving"?

Have you considered tapes? Tapes are a reliable method for storing backups for many years.
I wouldn't trust a disk to still be usable after 10 years. And for Tapes you can use encryption.

Best,
Fabian

[mcz]

+1 for this feature from my side. I'd like to export to an object storage...

[Mildur]

Just to add one thing to my comment.
If you export an encrypted restore point, the exported VBK file will also be encrypted.

@mcz
Your +1 is noted. May I ask, do you encrypt your source backup/backup copy jobs or do you only want to use encryption for Exports?

Best,
Fabian

[mcz]

Well, in general I use encryption (why not?). The thing is that you sometimes receive backups from external people from an agent backup and now you wannt to move that backup encrypted - no way to do that currently. So it's out of my control and my policy says that I have to encrypt everything...

[Mildur]

Yes, that makes sense. Thanks for the feedback.

Best,
Fabian

[TitaniumCoder477]

Would another use case be source backup on dedup appliance? I think in most cases encryption is NOT recommended for jobs targeting a dedup appliance. The Veeam BP doc also indicates Encryption should be disabled for dedup targets: https://bp.veeam.com/vbr/3_Build_struct ... ation.html

As for the Export to USB for archiving, this is quite a common use case in the MSP. Pretty much any time we decom'd a server (for example, replacing a DC or app or SQL server), we would create an Export of the last backup prior to the task. Then, once the new server was in place and we had a full two weeks of retention, we would nuke the old server's chain. Then, if primary repo space was a premium, we would move the export to a USB attached to the repo. Sometimes the USB was indefinitely attached. Other times, we'd have the client disconnect it and stow it in the fireproof safe etc.

[NickSPH]

Hi Fabian,

Thank you for your reply!

Currently we create backups to an on-site NAS with a retention period of at least 30 days. In the past we used rotating external HDDs for an off-site backup, but have since moved to Azure Blob Storage. For disaster recovery and recovery within the 30 days retention we feel this is adequate. Unfortunately, I do very rarely receive a request to restore files that have been deleted or modified beyond our retention period of 30 days. For these requests I can try to recover the requested file from the external HDD.

As these HDD are stored off-site I'd like to store the backups encrypted. Currently, I can use a Backup Copy job to store the most recent restore point encrypted to the external HDD but it would be nice to just export a specific restore point (that has been stored unencrypted as on-site backup) encrypted to another (removable!) location.

I understand HDD are not that reliable as a long-term archiving solution, but as we already had these HDD from our previous backup strategy I figured we could still use these for the very rare request for older backups.

I do hope the above clarifies our use case!

[mcz]

why not encrypt the local backups? exporting to HDDs would then also write them encrypted...

[TitaniumCoder477]

Currently, I can use a Backup Copy job to store the most recent restore point encrypted to the external HDD but it would be nice to just export a specific restore point (that has been stored unencrypted as on-site backup) encrypted to another (removable!) location.

I agree with mcz. Your local backup job to the NAS should be configured with encryption. Then you can Export from that chain to USB to your heart's content. You could map the USB into Veeam via the NAS and SMB/CIFS. I have done this many times, but obviously depends on the NAS capability (and whether or not it has USB3.0/3.1 ports). Alternatively, you could attach the USB to a workstation w/ USB3.0/3.1 and map that into Veeam as a repo target. Just know that then the Export will traverse the network, i.e. from NAS to workstation. A major benefit of Export is that you can Export retroactively. For example, if your goal is to export the last backup of every month, but the last month happened to coincide with PTO, no worries--just Export it when you get back (as long as that happens before your local backup job's retention culls the point from the chain). Also, Export does not affect production as it's exporting from the chain, not taking a new backup.

Now, there is another option too--VeeamZIP. You can create an ad-hoc backup at any time and configure it with encryption. However, this DOES affect production obviously. And it will be of the state of the production asset(s), not a previous state.

Configuring encryption of the local backup to NAS and then creating Exports off that chain is the way to go here, IMHO. Obviously, if instead of a NAS you had a dedup appliance, that would not be an option. Perhaps you have another legitimate reason why your local backup job is not encrypted?

A final word on Copy job to USB targets that are rotated/swapped... I know Veeam has very limited support for this, and I have both set this up and used it in the past. It's also blown up in my face. I would highly recommend NOT trying to use a Copy job for this use case as it creates more problems that it solves in my experience. Copy jobs should only be used to automatically copy points from one static location to another static location. If you truly need automatic secondary backup to USB, you may want to consider tape. I dislike even saying that because I dislike tape entirely nowadays, but there... I said it. But it sounds like your use case is manual backup to USB, hence my recommendation to encrypt your local backup to NAS and then leverage Export.

[Outlaw]

+1 for Export Backup with encryption(only want to use encryption for Exports)
long term is provided by another division with own backup software

[Zew]

Why not export to a USB drive then encrypt the drive with Bitlocker?

Did this as a work around for a similar requirement.