Requirements of VIA-based Backup Proxy

[d.artzen]

Hello together,

I currently use VMware Backup Proxies based on Ubuntu 24.04 for Hot-Add mode. This works well enough, but with the release of the VIA I am thinking of switching to that, mainly because of the automatic patch management of the underlying OS. Currently I have to manually check for updates on those machines, since we do not have a patch management for Linux servers.
I have read the userguide and it looks simple enough, but I am stumbling a bit about some of the requirements, especially the users and passwords. I understand that, if used as a repository, the VIA has to be as secure as possible, so thinks like MFA are logical. But for a proxy I find it a bit bothersome to create passwords for two users + MFA. And I read somewhere that you enforce regular password changes. So are these things mandatory also for use as a proxy or can they be deactivated?
Other question: I would like to reuse the existing VMs and just reinstall with the VIA ISO, for a proxy with 4 concurrent tasks would this configuration work for the VIA: 6 vCPUs, 12 GB RAM, 16GB HDD.

Thanks for the advice

Best regards
Daniel

[Gostev]

If by two users you mean host admin and security officer, then be aware that the latter is always optional regardless of the component type (even for VSA). So one user is enough but MFA is mandatory and can't be deactivated in this case.

[d.artzen]

Thanks for the response Gostev. So I could skip the security officer, but would have to create MFA for the host admin, understood. In normal operations of a proxy this log-in is not used regularly, correct?
What do you think about the hardware configuration, is that OK?

[Gostev]

Correct.

V13 system requirements are generally lower than V12 so you can't possibly have any issues reusing existing hardware.

[SteveK821]

The disk space requirements are different for a VIA deployment. You need 2x 120GB disks. Even for a proxy. But you could set them as thin-provisioned disks.
https://helpcenter.veeam.com/docs/vbr/u ... -appliance

[d.artzen]

OK, so no reusing the existing VMs. There the disks are 16GB thick-provisioned, which is enough for the Ubuntu Server LTS with the proxy role. I find 120GB a bit oversized for just OS and the Veeam components. And the second disk should be optional, as long as the repository role is not selected.

[Gostev]

It's not for a repository but rather to dump the content of the first disk during future major OS upgrades.

[d.artzen]

Ah, OK that makes sense in a way. I was confused because the user guide explicitly states that the first one is for the JeOS, VBR software and the IR cache. The second disk is stated to be for backups.
Still a bit much for a proxy in my opinion. Any chance of lowering the requirements for specific roles?

[Gostev]

Yeah it may happen down the road, but we need to see how the current allocation behaves in real world environments and at scale. 120GB feels like a lot however DISA STIG hardening requires a very specific partitioning scheme with a ton of separate partitions, and making a particular partition too small may result in reliability issues down the road. I was already quite happy QA agreed to at least drop it to 120GB initially, as for VSA that VIA is based on the minimum is 240GB. And you can further reduce actual consumed space with thin provisioning already.

[d.artzen]

Thanks for the explanation. Under the given circumstances I will most likely stay with the self-managed proxies, since the only advantage in my case is the update management. This is not a big enough plus for me for the additional needed resources in comparison to the existing proxy machines.