Authentication between Veeam components

[tedsteenvoorden]

I have a questions concerning implementing Veeam in a high secure environment. The backup repositories are based on Windows Server. How do Veeam proxies and Veeam repositories authenticate to each other during backup operation? Is this via the stored Windows credentials for the windows server backup repository?

[HannesK]

Hello,
yes, we use Windows built in security features (DPAPI) for storing passwords & authentication https://helpcenter.veeam.com/docs/backu ... ml?ver=110

Deployment of Windows components is via SMB (port 445 requirement). Microsoft has information on SMB security. https://helpcenter.veeam.com/docs/backu ... ml?ver=110

TLS is used between (Windows) components https://helpcenter.veeam.com/docs/backu ... ml?ver=110

Best regards,
Hannes

[tedsteenvoorden]

Hello Hannes, thanks for your response. Just to validate, am i right if i say that for each new session between a backup proxy and a backup repository, the stored credentials for the backup repository server in the password manager are being used. The password manager is protected using the Data Protection API (DPAPI) from Windows.

[HannesK]

Hello,
I'm not sure I understand the question. Passwords are only stored in the database. The passwords are protected with DPAPI. The backup server uses them https://helpcenter.veeam.com/docs/backu ... ml?ver=110 (only the backup server connects to the database)

Best regards,
Hannes