Comprehensive data protection for all workloads
Post Reply
Maurice
Service Provider
Posts: 27
Liked: 2 times
Joined: May 26, 2014 7:59 am
Full Name: Maurice Galicic
Location: Münster, Germany
Contact:

Can't disable Encrypt of Configuration Backup

Post by Maurice »

Hi all,

i got a small Problem with a Customers B&R Configuration.
They tested a Encryption on a Test Backup and now decided they dont want to use it. :roll:
Now i got a Problem disabling Configuration Backup Encryption.
When i disable the encryption it says "Configuration backup encryption must be enabled because product configuration contains encryption keys.".
The problem is: The key which is inside the Password Manager is the key that the Configuration Backup itself uses.
So i can't disable the Configuration Backup because of that error message and i can't delete the key because it is used by a Job (the Configuration Backup).

How can i disable the encryption of the Configuration backup now?

Thanks for any solutions. :)
veremin
Product Manager
Posts: 20261
Liked: 2249 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by veremin »

I'm wondering whether the backup console still contains encrypted backups or jobs using encryption. Thanks.
Maurice
Service Provider
Posts: 27
Liked: 2 times
Joined: May 26, 2014 7:59 am
Full Name: Maurice Galicic
Location: Münster, Germany
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by Maurice »

There are no other Jobs using encryption.
When i try to delete the Password in the Password Manager it shows me the dependent jobs and the only one showing is the configuration backup.
I deleted also the corresponding backups (restore points).
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by foggy »

Maurice, just talked to QA, they are aware of this issue, so it should be addressed further down the road. Thanks.
Maurice
Service Provider
Posts: 27
Liked: 2 times
Joined: May 26, 2014 7:59 am
Full Name: Maurice Galicic
Location: Münster, Germany
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by Maurice »

Thank you for the info. I hope it will soon be fixed. Till then the customer will create an easy Password for the Config-Backup.
BarryPhillips
Lurker
Posts: 1
Liked: never
Joined: Dec 13, 2016 12:23 pm
Full Name: Barry Phillips
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by BarryPhillips »

Has there been any update to this issue ? I find myself in the same scenario, We have one password associated to the Configuration Backup job only (we were testing), but now I cannot remove it or turn off encryption on the configuration backup job
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by foggy »

Hi Barry, this hasn't been addressed so far.
sfbi
Influencer
Posts: 15
Liked: 2 times
Joined: Jan 12, 2016 10:15 am
Full Name: SFBI
Contact:

[MERGED] Unable to delete Encryption Password (all 9.x versi

Post by sfbi »

Hello,
I've added one "Ecryption Password" and then configured for "Configuration Backup".
Now I need to delete this password and disable "Encryption configuration backup".
When I try to "Remove" the Encryption Password Veeam reply: "Unable to delete selected password ..in use.."
When I try to remove the flag "Encryption configuration backup" into "Configuration Backup Settings" Veeam reply: "Configuration backup encryption must be enabled becouse product configuration contains encryption keys".

It's a loop! :shock:

Support reply me:
This behavior is by design. Veeam requires that you encrypt the configuration backup if you have created at least one password in the Password Manager on the backup server (https://helpcenter.veeam.com/docs/backu ... tml?ver=95).

Code: Select all

Veeam Backup & Replication requires that you encrypt the configuration backup if you have created at least one password in the Password Manager on the backup server"
It's right, but it is not specified that I can not delete and disable this feature...

I still do not understand why I can't:
- disable "Configuration Backup"
- delete "Ecryption Password" (It is no longer used anywhere!)
- enable "Configuration Backup"
Done.

Any idea? :?:

Regards
Sim
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by foggy » 1 person likes this post

Hi Sim, this should be fixed in v10.
lightsout
Expert
Posts: 227
Liked: 62 times
Joined: Apr 10, 2014 4:13 pm
Contact:

[MERGED] Removing configuration backup encryption

Post by lightsout »

All,

It seems playing about has got me into trouble. :D I enabled encrypted backups which forced me to create an encrypted backup password. The issue is I can't turn it off!

If I try to turn off encrypted backups, it says I have an encryption key so I can't. If I try to remove the encryption key, it says I can't as it is use by the configuration backup job.

How can I escape this trap! :oops:

Thanks!
sasilik
Expert
Posts: 104
Liked: 13 times
Joined: Jun 12, 2014 11:01 am
Full Name: Markko Meriniit
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by sasilik »

Why not fix it in some 9.5 updates? I also fell in this trap and can't get rid of encryption password and encryption of configuration backup job. Kind of frustrating.
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by foggy »

Markko, this is still planned to be fixed in one of the next updates. Thanks.
alphabet5
Lurker
Posts: 1
Liked: never
Joined: Nov 13, 2017 2:30 pm
Full Name: John Burt

Re: Can't disable Encrypt of Configuration Backup

Post by alphabet5 »

Is there a timeline for this issue being fixed? Is there a workaround in the meantime?
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by foggy » 1 person likes this post

Hi John, this is addressed in the upcoming U4. Thanks!
mallikarjunac
Novice
Posts: 7
Liked: never
Joined: Mar 29, 2022 12:12 pm
Full Name: Mallikarjuna Chennareddy
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by mallikarjunac »

Hi All,
Any updates on this issue. I too facing same issue in Veeam 11.
Is there a way to disable Encryption in Configuration Backup or remove Configuration Backup settings by powershell cmd-lets.?
Mildur
Product Manager
Posts: 8481
Liked: 2203 times
Joined: May 13, 2017 4:51 pm
Full Name: Fabian K.
Location: Switzerland
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by Mildur »

Hi Mallikarjuna

Do you use encryption in any backup job or backup repo? Or have encrypted backups registered in the console?

I can disable the encryption of the configuration backup, when the encryption key is only used for the configuration backup, but not a server where encryption keys are used for actual jobs or repositories.

Thanks
Fabian
Product Management Analyst @ Veeam Software
mallikarjunac
Novice
Posts: 7
Liked: never
Joined: Mar 29, 2022 12:12 pm
Full Name: Mallikarjuna Chennareddy
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by mallikarjunac »

Hi Fabien,

We use two encryption keys, one for BackupJobs and another one for Configuration Backup. Can you please provide us the cmd-lets to disable encryption of the configuration backup.

Thanks,
Mallikarjuna
Egor Yakovlev
Veeam Software
Posts: 2532
Liked: 676 times
Joined: Jun 14, 2013 9:30 am
Full Name: Egor Yakovlev
Location: Prague, Czech Republic
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by Egor Yakovlev »

Check out Set-VBRConfigurationBackupJob cmdlet.

Please note that having encryption enabled on Configuration Backup is a recommended best practice.

/Thanks!
mallikarjunac
Novice
Posts: 7
Liked: never
Joined: Mar 29, 2022 12:12 pm
Full Name: Mallikarjuna Chennareddy
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by mallikarjunac »

Hi Egor,

I tried "Set-VBRConfigurationBackupJob -EnableEncryption:$false", but no luck. it thrown below error.

"Set-VBRConfigurationBackupJob : Configuration backup encryption must be enabled because product configuration contains encryption keys."

Do we need to pass any other additional arguments?

Thanks,
Mallikarjuna
Egor Yakovlev
Veeam Software
Posts: 2532
Liked: 676 times
Joined: Jun 14, 2013 9:30 am
Full Name: Egor Yakovlev
Location: Prague, Czech Republic
Contact:

Re: Can't disable Encrypt of Configuration Backup

Post by Egor Yakovlev »

That error is expected when your configuration database contains security data that otherwise cannot be restored(without being included in the encrypted configuration backup). Such security data can be encryption keys, thumbprints, password hashes just to name a few.

When you enable configuration backup without encryption we can ignore some security principals, like added credentials, and just skip passwords from processing. There is a warning for you, and when you are restoring from such configuration backup you will have to re-type passwords for all used credentials as they are not backed up without encryption. However, some things like a password hash cannot be re-entered as easy, thus leading us to enforce encryption when database already contains such data. We cannot allow non-encrypted configuration backup, because it is like storing your passwords on desktop in Passwords.txt format.

/Hope that helps!
Post Reply

Who is online

Users browsing this forum: No registered users and 72 guests