PAM (Privileged Access Management) Integration

[eeberg]

Hi Mogansundram,

We do not have integrations currently. It would be helpful if you could provide a few details:

1. Which solution are you implementing?
2. Specific requirements, objectives, compliance standards?

Thanks

[ftravinsky]

AFAIK, the only solid RBAC model Veeam able to provide is web-based Backup Enterprise Manager, which might or not support SSO and other authorization perks.

[chrisdearden]

Which tools are you looking to deploy?

[ajtucker]

It will depend on the PAM solution and what you want to protect with it. For example I did some work with Osirium PAM, and they support the Veeam administrator console natively without any integrations being done on the Veeam side (They use credential injection and JIT Elevation).

If you wanted Veeam to query the PAM each time it needed to authenticate to something (rather than storing credentials using the Credential Manager), that would probably need to be a feature request as I don't believe Veeam can do this at the moment.

If you are looking to better protect the encryption keys for your backups, if you have a Key Management Server that implements KMIP you can use Veeam with that. This isn't really a PAM, but does achieve something similar in that it it is able to get the private key for encrypted backups off the Veeam server onto your KMIP server and presumably stored somewhere safe like an HSM.

[rwheeler]

We are preparing to undergo a transformation of our entire environment over to Beyond Trust for rotating passwords. How do we integrate this with Veeam? This will include the VMware VMs, as well as the vCenter password and all Linux/Unix/Windows servers. Everything will be under the control of Beyond Trust. How do we deal with this for our backup/recovery environment? Is there a way to integrate it with Veeam and keep it all running?

[Mildur]

Hi Rick,

I merged your topic with an existing one.

Unfortunately, there is no integration today for PAM applications in our products. However, if your product allows sending REST API calls or PowerShell queries against the backup server, you may be able to use custom scripts to update passwords in Veeam products.

Best,
Fabian

[rwheeler]

Do you know if anyone has already done this for Beyond Trust? If so, if we could copy their process it would help us out a lot.

Regards,

Rick

[Mildur]

Hi Rick

I don't know of any customer using Beyond Trust.
But I can share with you the powershell cmdlets to update credentials in Veeam Backup & Replication:
Updating credentials (managed servers, vCenter, ...): https://helpcenter.veeam.com/docs/backu ... ml?ver=120
Updating cloud credentials (object storage, ...): https://helpcenter.veeam.com/docs/backu ... ml?ver=120

Best,
Fabian