Veeam Backup to NAS (Protocol S3 Compatible)

[Princessgalz]

Currently, I need to increase backup security but have a limited budget. Can I set up a Veeam Server and back up to a NAS that is S3-compatible, so that I can enable immutability for the data files and also copy the backup off-site to another location where I have a similar NAS?
Hypervisor MS Hyper-V 2016
NAS : TS‑h987XU‑RP QTS 5.0
Would you like me to also suggest alternative backup security strategies besides using Veeam with S3-compatible NAS and Object Lock? (Cost Optimize)

[Mildur]

Hello,

Welcome to the forum.

Yes, it works technically. This NAS model is listed on our Veeam Ready list, meaning it was tested with our products for compatibility and minimum expected performance. Please review the notes on the Veeam Ready page.
Use only Flash/SSD disks, and perform copies using a Veeam Backup Copy Job, not native NAS tools.

Given the cost of the TS‑h987XU‑RP with SSDs, you may want to compare it with online services such as Wasabi or Veeam Data Cloud Vault.

Alternatively, consider a hardware server with local disks as a Hardened Repository. It also provides immutability and likely better backup and restore performance. You can easily deploy a prehardened operating system (Rocky Linux) with an ISO provided by Veeam.

In my opinion, the best setup is a Hardened Repository in your primary datacenter for backup jobs and Object Storage in your secondary datacenter (or cloud) for backup copy jobs.

Best regards,
Fabian

[Princessgalz]

If i want to avoid managing any on-premises hardware and prefer a fully cloud-based solution. Is it possible for Veeam Backup & Replication (VBR) to back up directly to Veeam Cloud Vault without using a local repository first? If not, what are the recommended options for achieving immutability and ransomware protection in a 100% cloud setup?

[Mildur]

Yes. It's possible to directly backup to Veeam Cloud Vault.
With Veeam Backup & Replication, Veeam Backup for Azure and Kasten.
Backups on Veeam Cloud Vault are always immutable and encrypted.

Best,
Fabian

[jcalvetm]

As Mildur said, in my opinion best option on a budget is a Linux hardened repo.

If you use a local NAS, be sure to secure it properly: Even though NAS S3-compatible buckets can be secure in this level, if I would be an attacker, first thing I would try is gaining access to local NAS management interface. Then first thing I would do would be physically erasing everything (erase RAIDS and storage pools and disassemble and format all disks). To me, a hardened repo is a better option.

Jordi

[billcouper]

Unless QNAP have fixed their shonky S3 implementation, I would advise against this. If you do go down this route, test it very carefully (extended testing) before committing to it.

When I tested S3 on QNAP (TS-h1290FX, and others) they have a hidden, non-configurable, global immutability applied to every object that is created in the bucket - even if the immutability flag is not applied to the object. Backups will work perfectly fine until 10 days after the retention period, when Block Generation happens - then it will totally explode.

I logged a ticket with QNAP Support and they said the default immutability for all objects was a security feature and they were not going to change it.

[gosterm]

Test realy well I concure.
In my opinion veeam is also to be blamed somewhat. It creates enormous amounts of small files. I cant remember excactly only that 30 TB was about 250 milion files. So a troumendous burden on lifecycle script.

We tried it on hero and didnt use it in the end for veeam.

[Mildur]

Hi Gosterm

You can configure the size of the objects by specifying storage optimization in your backup jobs. The default is 1MB, but you can increase it up to 4MB. A size of 8MB is also possible via a registry key. Keep in mind that with larger objects, incremental backup size may increase by 2–3 times when going to 4MB.

One of the main reason for using small files is to achieve faster restores.
For example, when restoring a single Word document, we only need to retrieve the backup objects that contain the data blocks for that specific file. If we were storing VBK/VIB files in Object Storage, we’d have to download the entire backup chain first in order to mount the backup and restore just that single Word document.

So a tremendous burden on lifecycle script.

What would such a script do? It’s not supported to modify or interact directly with objects stored in Object Storage.

Best,
Fabian