NFS Immutability - Support and user guide limitations

[Asahi]

Hello everyone,

The Veeam v12 documentation does not mention any restrictions regarding NFS.
https://helpcenter.veeam.com/docs/backu ... ml?ver=120

In the v11 documentation, it was clearly stated.
https://helpcenter.veeam.com/archive/ba ... tions.html

Does v12 support Immutabllity even for NFS share?

Asahi

[Mildur]

Hi Asahi

No, NFS shares are not Hardened Repositories. They are completely different types of Veeam backup repositories. So it makes sense that NFS is not mentioned anymore in the Hardened Repository user guide.

Are you looking into connecting to a NFS share directly as a backup repository or mounting an NFS share on a Hardened Repository?

Best,
Fabian

[Asahi]

Hi Mildur,

Thank you for response.

The following page states that Immutable is also available for NFS Share.
https://veeamcookbook.com/vbr/core/4Bac ... lity).html

So I thought I could NFS mount NFS Share from v12 to Linux Server and configure that area as an Immutable repository.

Is this page incorrectly described?

Best Regards,
Asahi.

[Mildur]

Hi Asahi

Yes, you are wright. Guides are not consistent.
Let me check that and update you when I have the answer.

For the design of your Hardened Repository, it's not recommended to use an external system as storage for a Linux server. While it may be supported with specific protocols, it introduces new attack opportunities.
For example (if NFS would work):
I can just login to your NFS server and format the entire Disk which contains the backup files. And you are left with no backups. Hardening a single Hardened Repository server is easier than taking care of multiple devices. That's why we recommend physical hardware with locally attached disks for Hardened Repository server.
A VM would also introduce additional risks. A VM can be taken over by any one with admin permission on a Hypervisor within 5 minutes. And then it's just a reset of the root user password and you can control the entire VM and it's Files.

Best,
Fabian

[Asahi]

Hi Fabian,

Thank you for quick response.

Thank you for the information and that there is an error in the guide.
I will wait to hear from you.

Also, as for me, I understand that Hardened Repository should be configured on a local disk as you said.
However, I didn't see it mentioned in the v12 documentation, so I was curious and asked the question.

Kind Regards,
Asahi,
Climb Inc.

[Mildur]

Hi Asahi

Understood.
Thanks for reading the guide

Best,
Fabian

[Asahi]

Hi Fabian,

I continue to await word on the Hardened Repository in v12 to see if Immutable is supported in NFS Share.

Best Regards,
Asahi

[HannesK]

Hello,
the NFS protocol does not support the immutability flag (chattr +i). NFS is not / will not be supported for immutability because of that. The user guide says

The Linux machine file system must support immutable files and extended attributes modified by the chattr and setxattr commands

Additional to the reasons Fabian mentioned above: it's a bad idea to put backups on file shares (NFS or SMB) for performance reasons (one needs active full backups to avoid merges over the network)

The cookbook is not an official Veeam guide. I will reach out to that team to update it (it's also V11-based and we improved the whole wizard in V12)

Best regards,
Hannes