Hi there
My concern is someone getting on the backup server and changing the encryption password. We have done everything we can to harden the backup server, use immutable backups and also cc, but if mr bad guy gets on the server and changes the encryption password, we will be in trouble.
Is there anyway Veeam can write to the event log when a password is changed? That way we can monitor the event logs and be notified of this event occurring.
I know Veeam One can monitor this, but our customers dont use this.
Cheers!
-
- Novice
- Posts: 8
- Liked: 1 time
- Joined: Feb 02, 2015 6:06 am
- Contact:
-
- Veeam Software
- Posts: 636
- Liked: 335 times
- Joined: Jul 17, 2015 6:54 pm
- Full Name: Jorge de la Cruz
- Contact:
Re: Notification when encryption password changes
Hello,
Pretty interesting case. Please allow me some time on the lab to see what is the current level of monitoring for this action.
Thank you
Pretty interesting case. Please allow me some time on the lab to see what is the current level of monitoring for this action.
Thank you
Jorge de la Cruz
Senior Analyst, Product Management @ Veeam Software
@jorgedlcruz
https://www.jorgedelacruz.es / https://jorgedelacruz.uk
vExpert 2014-2021 / Nutanix Technology Champion 2018-2019 / InfluxAce
Senior Analyst, Product Management @ Veeam Software
@jorgedlcruz
https://www.jorgedelacruz.es / https://jorgedelacruz.uk
vExpert 2014-2021 / Nutanix Technology Champion 2018-2019 / InfluxAce
-
- Veeam Legend
- Posts: 624
- Liked: 298 times
- Joined: Aug 04, 2019 2:57 pm
- Full Name: Harvey Carel
- Contact:
-
- Veeam Software
- Posts: 2355
- Liked: 581 times
- Joined: Jun 14, 2013 9:30 am
- Full Name: Egor Yakovlev
- Location: Prague, Czech Republic
- Contact:
Re: Notification when encryption password changes
Windows Event Log also has it under Applications > Veeam Backup.
If someone changes password used in the job:
If someone changes used password in credentials manager:
/Cheers!
If someone changes password used in the job:
Code: Select all
Event ID 23050 source VeeamMP
Backup {JobName} has been modified.
<property name="Storage > Storage encryption password" internal="BackupStorageOptionsStorageEncryptionPasswordHint" type="String">
<old>my old password</old>
<new>bad guy password</new>
</property>
Code: Select all
Event ID 31700 source VeeamMP
Encryption password {pass.name} has been modified.
Who is online
Users browsing this forum: No registered users and 45 guests