Comprehensive data protection for all workloads
Post Reply
mattk0
Novice
Posts: 5
Liked: never
Joined: Nov 14, 2013 5:38 pm
Full Name: Matt Klein
Contact:

VEEAM Backup Replication Roles (feature request)

Post by mattk0 » Mar 20, 2017 4:15 pm

I'd like to request some additional roles be added to the VEEAM Backup and Replication Console. Currently the only roles available are (per https://helpcenter.veeam.com/docs/backu ... tml?ver=95)
- Restore Operator (can perform restores)
- Backup Viewer (Read-only access to view jobs)
- Backup Operator (Can start/stop existing jobs)
- Administrator (full access)

I'd like to propose having another role for a Backup Creator/Editor of someone who can create and edit backup jobs but yet doesn't have rights to do deletions from the 'files' or change configuration backup, or other administrative VEEAM settings.

Does anyone know if this is possible or agree with some more granularity needed for these roles? Thanks,

veremin
Product Manager
Posts: 16778
Liked: 1405 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: VEEAM Backup Replication Roles (feature request)

Post by veremin » Mar 20, 2017 4:22 pm

I'd like to propose having another role for a Backup Creator/Editor of someone who can create and edit backup jobs but yet doesn't have rights to do deletions from the 'files' or change configuration backup, or other administrative VEEAM settings.
Someone having rights to edit job settings would be automatically able to "delete" backups by shortening retention and executing new backup cycle, wouldn't he?

Vitaliy S.
Product Manager
Posts: 22862
Liked: 1538 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: VEEAM Backup Replication Roles (feature request)

Post by Vitaliy S. » Mar 20, 2017 4:24 pm

Hi Matt,

That's not possible today, but can you please elaborate a bit more on your use case? Do you provide backup as a service internally or you're an MSP?

Thanks!

mattk0
Novice
Posts: 5
Liked: never
Joined: Nov 14, 2013 5:38 pm
Full Name: Matt Klein
Contact:

Re: VEEAM Backup Replication Roles (feature request)

Post by mattk0 » Mar 20, 2017 4:29 pm

v.Eremin wrote:Someone having rights to edit job settings would be automatically able to "delete" backups by shortening retention and executing new backup cycle, wouldn't he?
Interesting - I hadn't thought of that.

Our use case is just trying to prevent a rogue/accidental admin from going into the files from a backup copy or standard job and deleting data but still being allowed to do standard administrative details such as creating jobs and adding VM's to existing jobs. I'm guessing it's too detailed to ask that an admin be able to modify just retention of existing jobs or create new ones....

Vitaliy S.
Product Manager
Posts: 22862
Liked: 1538 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: VEEAM Backup Replication Roles (feature request)

Post by Vitaliy S. » Mar 20, 2017 5:25 pm

If you're worried about backup being deleted, then why not to offload it to archival media or any device not connected to Veeam B&R? This would protect you not only from the rogue admin, but also from different malware (cryptolockers etc.)

mattk0
Novice
Posts: 5
Liked: never
Joined: Nov 14, 2013 5:38 pm
Full Name: Matt Klein
Contact:

Re: VEEAM Backup Replication Roles (feature request)

Post by mattk0 » Mar 20, 2017 6:06 pm

We're using Exagrid for our primary and backup/DR site - I was told this wasn't possible to offload it to ExaGrid seperate from VEEAM B&R

Vitaliy S.
Product Manager
Posts: 22862
Liked: 1538 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: VEEAM Backup Replication Roles (feature request)

Post by Vitaliy S. » Mar 20, 2017 7:02 pm

Well, you can definitely access ExaGrid device manually, right? Here is a similar topic that might be useful > New ransomware that targets backups. Are we susceptible?

mattk0
Novice
Posts: 5
Liked: never
Joined: Nov 14, 2013 5:38 pm
Full Name: Matt Klein
Contact:

Re: VEEAM Backup Replication Roles (feature request)

Post by mattk0 » Oct 02, 2017 2:37 pm

Bumping this as we have a similar issue again where we'd like our helpdesk to be able to restore files, but the Backup Restore role in the Thick client is allowed full access to backup the VM as well. We'd like the same granularity of only restoring files that you have in the webconsole in the thick client as well

Post Reply

Who is online

Users browsing this forum: baber, Google [Bot], JedSheehan and 31 guests