Revisiting QNAP Object Locks and Veeam

[NorthGuard]

I just rolled out my first pilot install with v12 and using a QNAP with Quobjects as the repository, utilizing immutability. My configuration is this:

QNAP BUCKET CONFIG:
Object Lock: enabled
Object Lock Default retention: disabled (if I enable this Veeam throws a Compliance error)
Versioning: Enabled
Versioning Days to retain: 30
Versioning number of versions to retain: not configured/not enabled

VEEAM REPO SETUP FOR QNAP:
Make recent backups immutable for 7 days

In testing, I logged into the QNAP after a backup and used File Station to browse the "protected" bucket. I then tried to delete a file and sadly was able to do so.

Clearly I am missing something in my setup and am hoping for some help in resolving.

[jorgedlcruz]

Hello,
What a coincidence, I just released a video about this very same topic, but anyways to your question regarding configuration, please refer to our official Veeam Ready, there are a few articles already:

• https://www.veeam.com/alliance-partner- ... get&page=1
• https://www.veeam.com/sys469

In my testing, I didn't delete the bucket, but I deleted objects inside the bucket, and as it has versioning, even if you do not see them on the QuObjects, they are still there, the versions as they are immutable, etc.

Moreover, if the deletion of the bucket has negative consequences, again, have not tried it, as perhaps it is "soft deleted", I would recommend you open support with QNAP so they can fix that potential issue by removing the bucket.

I think, anyways, that is in anything where you have direct access or direct root access. You can always delete, take the disks out, log in as root in SSH, and delete all, even reset factory it. And this is true across any brick, storage vendor, etc. If you want a bit more security, make sure you hardened your QNAP, with only one admin user, secure password, enable MFA to the box, etc.

[NorthGuard]

Great info and was exactly what I was looking for - if I delete files in the explorer or through QuObjects, they "disappear" but still display if you enable version ID.

One question I still had that I missed in the video: when you "delete" files, even though they aren't truly deleted, does the Veeam backup do an incremental or does it trigger a full?

[jorgedlcruz]

Veeam triggers and incremental, as the data is there, the API knows it is there, etc. After you trigger the incremental, you will see everything again, metadata, etc. And the restore process will work from those "deleted" blocks, as they are still there, ofc. It happens similarly in Wasabi, or others S3-Compatible.

Happy to be of help, and as said, what a coincidence Let us know!