.vbm and .lock files not immutable

[Danh3]

Hello,

I created a Linux Hardened Repository and performed a wins file-level backup. After the backup, I observed that the initial full backup generated three files in the immut repo: .vbk with the "immutable" attribute, while the other two files, .vbm (metadata file) and .lock(file contains immutability time period ), did not have this attribute.


# ll
-rw-r--r--. 1 vadmin vadmin 4075520 Sep 18 19:59 'local hard2023-09-18T165829.vbk'
-rw-r--r--. 1 vadmin vadmin 22938 Sep 18 19:59 'local hard.vbm'
-rw-r--r--. 1 root root 124 Sep 18 19:59 .veeam.1.lock

# lsattr local_harden_folder_-_192.168.2.199/
----i--------------- local_harden_folder_-_192.168.2.199/local hard2023-09-18T165829.vbk
-------------------- local_harden_folder_-_192.168.2.199/local hard.vbm


#1 If the Linux Hardened Repository server is compromised, and the .vbm and .lock files are deleted by malware, does this affect the restorability of backup files (.vbk or .vib)?

#2 if a scheduled backup attempt occurs and cannot find the .vbm and .lock files, what would be the outcome ? how to maintenance the immut period if both files are missing/deleted/corrupted and how to make backup continue to run ?

#3 Does Veeam Linux Hardened Repository supports the use of mount points via iSCSI or FC for connecting to SAN or NAS ?

thanks

[Mildur]

Hello Dan

#1 If the Linux Hardened Repository server is compromised, and the .vbm and .lock files are deleted by malware, does this affect the restorability of backup files (.vbk or .vib)?

No, You can do a restore from VBK/VIB alone.
Lock files can be ignored. They exist while a job session is running. They are not part of the backup chain.
VBM file contains metadata of the backup chain. We need to be able to update it in every backup session. Therefore it cannot be immutable. A copy of the metadata is in the backup files. Import of VBK/VIB files on a new VBR server for doing a restore is possible.

#2 if a scheduled backup attempt occurs and cannot find the .vbm and .lock files, what would be the outcome ? how to maintenance the immut period if both files are missing/deleted/corrupted and how to make backup continue to run ?

Maintenance (retention) is managed from the backup server, not from the metadata file. VBM file will be recreated in the next job run.

#3 Does Veeam Linux Hardened Repository supports the use of mount points via iSCSI or FC for connecting to SAN or NAS ?

Yes, but we don't recommend it for a harden repository. It's supported, but you need also to this SAN/NAS system. Even if you have immutable backups on the iSCSI/FC LUN, one can delete the entire LUN and your backups are gone. Your SAN/NAS doesn't check the content of the filesystem. it just deletes the LUN with it's entire content.

Best,
Fabian

[Danh3]

thanks for the clarification, Fabian