Long Term Immutability on Linux Hardened Repository

[bg.ranken]

I'm hoping I could get some general guidance and confirmation on setting up jobs and retention levels to achieve long term immutability for a new Linux hardened Repository.

Currently we are adding a new Linux hardened repository and planning to send backup copy files to it and keep our regular jobs pointed to our current repository. The business requirement is to keep 24 monthly full backup points and we want to make them all immutable.

It seems we could configure the "Make recent backups immutable for x" setting on the repository to be 7 days, and then in the backup copy job set the GFS settings to retain 4 weekly and 24 monthly full backups. It seems to me that the "Make recent backups immutable for" should take care of the incremental files and the GFS settings on the backup copy job would set a different date based on retention settings there.

Does this all sound correct? Is there any configuration steps or other things I might be missing on how this works?

Also regarding the long term immutability, is there any limits on this method if it works? Would we be able to set the GFS option to keep monthly's for 5 or 10 years and that's the only setting we need to change to start setting the immutability flag for that long?

[Gostev]

Yes, that is all correct and nothing seems to be missing.

[bg.ranken]

Thanks for the info, glad to know it works how I expected it. I'm really liking this Hardened repository concept.

On a side note, is this a similar process for immutability using AWS? For instance, if our source backup jobs are set to keep 2 years of monthly retention and we add capacity and archive extents in our SoBR pointing to an AWS S3 bucket with immutability turned on, will the immutable flags be configured on the monthly restore points as well to keep them immutable for 2 years?

[Mildur]

No, for the capacity tier, the immutable settings is valid for the gfs restore points too.
If you configure 90 days immutable, you get 90 days immutability. A monthly backup will not be any longer immutable. It‘s 90 for every RP in the capacity tier.

If you use Archive Tier, the gfs restore points would be immutable until the retention is over.

https://helpcenter.veeam.com/docs/backu ... ml?ver=110

[Gostev]

Capacity Tier is backed by hot S3 storage so it's quite expensive and you don't want to accidentally lock your data there for years with absolutely no ability to remove. Archive Tier is far less risky in that sense being by an order of magnitude cheaper thanks to Glacier Deep Archive.