Backups to Synology NAS

[B.F.]

Do all the methods mentioned perform about the same? We are a Windows shop. If we don't use the Synology as a Linux Repository, we would need to use an onsite proxy to an SMB on the Synology correct?

Looking at the product list, it looks like the first NAS they have that covers the Linux Repository requirements is the DS3615XS?

Thanks

[foggy]

Do all the methods mentioned perform about the same? We are a Windows shop. If we don't use the Synology as a Linux Repository, we would need to use an onsite proxy to an SMB on the Synology correct?

Correct. Both approaches do the same, just different components involved.

[Calebpaine]

Hi,
I'm trying to add a synology DS1815+ as storage. I've sucesfully added it as a linux server, but whenever I specify it as a storage location for a copy job, it fails stating there isn't enough space left. Check the Veeam software seems to show about 1.5gb of free space, whereas the Synology interface (and CIFS mount points on my workstation) report ~3tb+ free.

I looked back through this thread and only saw a couple of other mentions of of a similar issue, but it was a for a *much* older version of the synology OS. Does anyone know how to had a Synology NAS as a storage location using DMS 6?

[veremin]

What do you refer to by "storage location"? Backup repository? Just for the purpose of sheer testing - can you mount it to some linux-based server and add that server to a backup console as a backup repository? Will the existing issue re-occur? Thanks.

[Calebpaine]

I'm not 100% certain I'm using the correct terminology, since what I see in the free edition looks different than what most people seem to be talking about (but appears if I "turn off" the free interface).

This gallery should explain better I think: http://imgur.com/a/MMe7b

The folder on the synology is available to the veeam server (my workstation while I test/evaluate it) by both NFS & CIFS, yet the only way I can seem to interface with it is via SFTP/SSH. There is no NFS or SMB/CIFS option that I can see.

[al_wearne]

Veeam B&R to 4 x Synology DS412+ via iSCSI MPIO ?? - Looking for advice here please. We're a small not for profit community health organisation & a small IT team. We are a VMware & Veeam shop predominately Windows with a few Linux boxes. I have built a Windows 2012 R2 server (HP DL 360 G7, 24 GB RAM, 4 x NC382i 1Gbps NICs) for testing purposes as our current solution is too old & slow. I have 4 x Synology DS412+ NAS devices (each has 2 x 1 Gbps NICs & 4 x Seagate Constellation 1.8 TB HDDs, yielding 5.44 TB RAID5 block level storage) available for testing. We have HP A5120 switches on the LAN where the storage resides. So anyway, as a test I have installed Veeam 9 (Build 1715) and configured iSCSI MPIO on the Windows 2012 R2 server (finding that the Least Queue Depth policy achieved an average processing rate of 85 MB/sec for a test 340 GB SQL server - active full backup) to a single DS412+ for the moment. I'm not looking for the fastest solution, but a reliable one that we can recover VMs from easily and so that I can hand over the solution to the junior member of the team and move to the next project ( i.e. put out the next fire). My question is simple - given that I have 1 NIC of the server on the same subnet as the 1st NIC in the Synology and another NIC on a separate network for the 2nd NIC in the Synology for MPIO, could I theoretically use the same MPIO methodology in place to attach the addition 3 Synology DS412+'s ?? I have read that Windows 2012 R2 supports up to 32 MPIO paths, but my question is firstly intended to be practical and fundamental one. Is this even possible or supported? I have looked after Veeam on our old server using NIC teaming and the throughput is awful via NIC teaming and a combination of other factors. We need to move to a newer server and I don't wish to waste the storage bought previously. We have 40 or so VMs to back up 10 are important for business continuity - my boss prefers reverse incremental nightly backups for simplicity and I know the backups and infrastructure well enough to juggle across the four NAS devices to prevent too much overlap. Thoughts? Advice. Apologies for the long post & TIA, Al

[DominikM]

FYI:

If you're upgrading to DSM 6.1 and you're using the Synology NAS as a Linux backup target, you have to modify the sudoers configuration:

vi /etc/sudoers

change this:

Code: Select all

# Configure privilege of wheel group
Cmnd_Alias SHELL = /bin/ash, /bin/sh, /bin/bash
Cmnd_Alias SU = /usr/bin/su
%wheel ALL=(ALL) NOPASSWD: ALL, !SHELL, !SU

into that:

Code: Select all

# Configure privilege of wheel group
Cmnd_Alias SHELL = /bin/ash, /bin/sh, /bin/bash
Cmnd_Alias SU = /usr/bin/su
# %wheel ALL=(ALL) NOPASSWD: ALL, !SHELL, !SU
admin ALL = NOPASSWD: ALL

That will solve the connection problem.

Regards,
Dominik

[AFalb]

Hello,
since a lot of people use Synology NAS and you can't add that NAS as Linux Server because of missing packages it would be great if Veeam could develop a Package for Synology DSM with everything needed to add it as a Linux Server for NFS.

kind regards

[Andreas Neufert]

Veeam uses standard packages like SSH and Pearl. So those packages needs to be enabled on the Synology side. Please open a feature request there.

A lot of customers were able to use Synology as Veeam Backup Target. Please see: veeam-backup-replication-f2/backups-to- ... 1-120.html (last page)

[AFalb]

Since Synology DSM 6 it's no longer possible to use the NAS as a Linux server and only as CIFS Share.
This makes file merges with TB of data pretty slow and takes a lot of time, since all the data has to be moved between Veeam Backup Server and the NAS.

With a Veeam Package the file merges should be faster, because all processing is done on the NAS itself and the network load should be minimal.
Please take a loot into it. Here a quite a few people who use Synology NAS.

kind regards

[buggy]

Synology with DSM 6 is fully working for me as standard Linux backup repository, but you need to do following:

From the Synology NAS web interface:

• Control Panel/Terminal & SNMP: Enable SSH
• Click on "Advanced Settings" and change the cipher strength to "Low" (Veeam doesn't support even the medium strength ciphers).
• Control Panel/File Services/FTP: Enable sFTP.
• Control Panel/User/Advanced: Enable the user home service.
• Control Panel/Shared Folder. Create a shared folder and grant "admin" access to it.
• Package Centre: Search for Perl. It will be listed under "Third Party". Click install.

Then in Veeam when you add the NAS, specify the IP address, tell it to login with the "admin" account. DO NOT select to use an elevated account, use sudo, or anything else. The "admin" account has access to everything it needs without any extra permissions.

[B-C]

I can confirm this was working up until 6.2 and then having all sorts of issues...
DSM in general is not working especially over vlans - but even direct from veeam server to NAS on same vlan having all sorts of issues.
just reset my ssh down to low per above - did have it set via custom and had it working for almost a year - now all borked again...

https://nas:5001 from server 1 on same vlan - connection refused
https://nas:5001 from server 2 on same vlan - works but will randomly disconnect and have to refresh the page... ARGH
in connections have them set /whitelist basically entire subnets / vlans internally so there is no reason one machine is blocked vs another...

just a mess... and only after the 6.2 release did all these issue start happening...

[Tecbil]

Synology with DSM 6 is fully working for me as standard Linux backup repository, but you need to do following:

From the Synology NAS web interface:

• Control Panel/Terminal & SNMP: Enable SSH
• Click on "Advanced Settings" and change the cipher strength to "Low" (Veeam doesn't support even the medium strength ciphers).
• Control Panel/File Services/FTP: Enable sFTP.
• Control Panel/User/Advanced: Enable the user home service.
• Control Panel/Shared Folder. Create a shared folder and grant "admin" access to it.
• Package Centre: Search for Perl. It will be listed under "Third Party". Click install.

Then in Veeam when you add the NAS, specify the IP address, tell it to login with the "admin" account. DO NOT select to use an elevated account, use sudo, or anything else. The "admin" account has access to everything it needs without any extra permissions.

Still working great and without issues for me on current DSM 6.2, even with disabled sFTP.

[eduhernandezm]

Hi,

I have the following infrastructure. I have a virtualized environment with several virtual machines, among them, I have a virtual machine where I have installed and configured Veeam Backup.

I need to know the steps to configure a NAS SYNOLOGY to be a repository of my Veeam Backup by NFS instead of by iSCSI. What steps do I have to follow, both on the side of the NAS and on the side of the Veeam Backup console? What is the correct configuration?

Thank you very much in advance

[foggy]

Please review posts above for details. Thanks!

[Kraken]

I switched our Synology NAS (RS2416+ - with Intel Atom C2538 and 2GB RAM) from CIFS to Linux storage server and I'm really impressed by the performance! It increased so high, that VeeamOne reported "Possible ransomware activity" for backup proxies

Anyway... I would like to ask, if this is normal to see on Synology NAS side? Because after dozens of server that have been backed up by the backup job, the performance dropped significantly, NAS RAM was almost full, so it started to swap heavily. The backup repository (that is attached to this NAS as Linux server storage) is limited to 3 maximum concurrent tasks, but I found no settings for linux server.

I checked the Task manager and found this - is this normal or I missed something in configuration?

[SebCharp]

Hi,

If this can be helpful to anyone.

The best way to use a Synology NAS, is to set it up as a Linux Repo server through Perl package.
This is working very well.

To ensure it does work flawless, be sure to setup a fixed IP on your Synology.

Here are the steps.

From the Synology NAS web interface:
- Control Panel/Terminal & SNMP: Enable SSH
- Click on "Advanced Settings" and change the cipher strength to "Low" (VEEAM doesn't support (yet?) even the medium strength ciphers).
- Control Panel/File Services/FTP: Enable sFTP. [MODERATOR NOTE: as per OP's correction, sFTP is not required]
- Control Panel/User/Advanced: Enable the user home service.
- Control Panel/Shared Folder. Create a shared folder and grant "admin" access to it.
- Package Center: Search for Perl. It will be listed under "Third Party". Click install.

Then in Veeam:
- Backup infrastructure (bottom left of the VEEAM console).
- Click on "Managed Servers".
- Click on "Add Server" (top left).
- Select LINUX
- Specify the IP address of the NAS.
- Tell it to login with the "admin" account. DO NOT select to use an elevated account, otherwise you will get a "failed to start PerlSoap protocol" error message. The "admin" account has access to everything it needs without any extra permissions.
- Click on "Backup Repositories".
- Click on "Add Repository" (top left).
- Select "Linux server" as type of repo.
- On the next step, when you click on the "Populate" button, you should see all NAS folders. If not, something is not setup properly (SSH, Perl package, login setup, etc...).
- Select the path.

You are done.


Since the NAS (through Perl command) does lot of handshake work (probably some hash process), the backups are very fast. This is good for offsite backup, cos most of the traffic is from VEEAM B&R to the NAS. There is nearly no more traffic from the NAS to VEEAM B&R (probably all write checks are done on the CPU of the NAS).

I hope this help.

Seb

[SebCharp]

Why my message has been merged?
I opened it in a new topic (in purpose) in order to help people to find this tutorial without digging in many posts.

Seb

[PTide]

Hi,

Good job, thanks for sharing!

<...> and change the cipher strength to "Low" (VEEAM doesn't support (yet?) even the medium strength ciphers).

Depends on what they (Synology) are referring to as "medium" and "low". Do you happen to know that? If not, then maybe you could tell us the model of the box that you're using?

Thanks!

[foggy]

Hi Seb, I appreciate your effort in sharing the procedure with the community. We try to keep all similar posts together for consistency and to avoid duplicate discussions. This doesn't affect search results.

[SebCharp]

Hi foggy,

I do understand, however I still am not convinced this tutorial will be easily found.

Depends on what they (Synology) are referring to as "medium" and "low". Do you happen to know that? If not, then maybe you could tell us the model of the box that you're using?

Good point, I don't really know.
However, I can tell you we are using DS1817+.

Seb

[foggy]

In any case it will sink in hundreds of other threads (since it is not sticky), but will show up to anyone searching for "Synology repository", regardless of whether it is a standalone thread or post merged into existing discussion.

[SebCharp]

You are right.
Have a nice day.

[Gostev]

Seb, a couple of comments:

1. Why do you need to enable sFTP?

2. Veeam does support advanced ciphers, this was the only reason why we migrated from Granados SSH to Renci SSH a few versions ago... so it's more likely they are using some rare or untypical one with those other combo box options.

Thanks!

[Kraken]

I followed the instructions, but now I'm unable to import any backup from this kind of repository: I right click Home - Backups - Import Backup... then select the Linux repository that represents the Synology NAS and browse for the file. I'm able to see the directory tree on NAS and the volume1 where the repository is, but when I click the folder with backups, I got the message "Exception of type 'Veeam.Backup.AgentProvider.AgentClosedException' was thrown" and the folder does not list.

Also it surprised me, that I saw this error in Backup Copy job, which uses this storage as a source - but only one drive within few VMs failed which does not make sense: the backup is already in repository and now the job is unable to access only part of it?

Any ideas what might be wrong?

[SebCharp]

@Kraken,

If you whish to import existing backup, I think you need to do those steps:
- Go in Backup infrastructure, then choose Backup repositories
- From there, you should see your Syno (Type: Linux).
- Right click on your Linux Syno Repo and choose Rescan

Seb, a couple of comments:

1. Why do you need to enable sFTP?

2. Veeam does support advanced ciphers, this was the only reason why we migrated from Granados SSH to Renci SSH a few versions ago... so it's more likely they are using some rare or untypical one with those other combo box options.

Thanks!

Hi Gostev ,

1. Correct! sFTP does need to be activate. Unfortunately I cannot edit my post. I wrote this when I was trying to setup our Syno. I forgot to remove it from my documentation.

2. Concerning the SSH, if I choose something different than "Low", I got this error message:


Here are the settings which does work for me:


Seb

[Gostev]

Thanks for these details. Diffie-Hellman-Group1-SHA1 cipher has been deprecated as insecure, so it looks like we don't support it any longer.

[SebCharp]

That is the all point!
If you select a medium or high security level on the Synology, the Diffie-Hellman-Group1-SHA1 cipher is disabled. Thus VEEAM cannot communicate anymore because it does use this cipher.

Seb

[PTide]

Let's try to figure out which ciphers and algorithms the ssh server allows. Could you login into your synology box console and provide output of the following command?

Code: Select all

sshd -T | grep "kex\|cipher"

Thanks!

[SebCharp]

Even better, the Synology security levels can be customized (which I did not).
So, I can access the full list from the GUI.

Here are the results for our Synology DS1817+:
In Blue the Low security level (every available protocols are ticked).
In Red the Medium security level.
In Green the High security level.


Diffie-Hellman-Group1-SHA is excluded from the Medium/High levels.

As requested, I run your command:

Code: Select all

sshd -T | grep "kex\|cipher"

Here is the result:

Code: Select all

ciphers:
3des-cbc,aes128-cbc,aes128-ctr,aes128-gcm@openssh.com,aes192-cbc,aes192-ctr,aes256-cbc,aes256-ctr,aes256-gcm@openssh.com,arcfour,arcfour128,arcfour256,blowfish-cbc,cast128-cbc,chacha20-poly1305@openssh.com,rijndael-cbc@lysator.liu.se

kexalgorithms:
curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521

No surprise here, I got the same result than from the GUI (Low level mode).

Seb