Veeam Plug-in for Oracle RMAN question

[adam900331]

Hy!

I install the Veeam Plug-in for Oracle RMAN and I checked this site which is related to the backup repository permission:
https://helpcenter.veeam.com/docs/backu ... ml?ver=110

I have a question: If I specify an account to has access permission the repository, where can I give this account? When I open the RMAN configuration wizard I can give only the account which has local admin permission on Veeam server.

I am confused.

Thanks.

[PetrM]

Hello,

In the plug-in configuration wizard you provide the account to access Veeam B&R server, this account must have access permissions to a repository that you're going to use as a target for backup jobs.

Thanks!

[adam900331]

Hy.

Do you mean on this step?
https://helpcenter.veeam.com/docs/backu ... rd_vbr.png

[PetrM]

Yes, the account on this step must have access permissions on repository.

Thanks!

[adam900331]

Okay, and this account has to be in local admin on Veeam B&R server.

During the Veeam deploying I created a technical account for services. This account is in local admin group. What is the best prastise and your suggestion? Can I use this service account for RMAN or create a new dedicated account for RMAN and add the Veeam B&R server local admin group and also add this account to repository access permission?

Thanks.

[adam900331]

Anyone?

[Andreas Neufert]

Create a new user within Windows Computer Management and give it local user rights so that this account is NOT an admin within Veeam nor on the local system. Same would work with Active Directory accounts if the Backup Server is a member of the domain (which is not best practices for ransomware/security reasons).
Go to the Repository, right click and add it to the "Access Permissions..." so that Agents/Plug-ins can access.

Install the RMAN Plug-in on the Oracle System and start the wizard. Use the above created account to authenticate against the Veeam Backup Server and select the Repository that you enabled the user for at the second step.

[adam900331]

Okay, but the repository permission has everyone and what happens when restrict only for this user? Every backup job will still send backuo data to this repository like before?

[Andreas Neufert]

The "Access Permissions..." do only matter for external backups from Agents and Plug-ins. It does not affect the VMware VM processing.
If it is set to "Everyone" then every user that can authenticate against the Veeam Server can access the Repository with Agents/Plug-ins.
Backups are owned by specific users, so the users will see only their backups (unless the user has Backup/Restore Operator rights in Veeam).

So you can create the user and the user can authenticate if it set to "Everyone" or you can change this and give only specific users access.

[adam900331]

Thanks for you post. But what happens when I have some Agent backup job, where the agent computer managed by Veeam server?

[Andreas Neufert]

I will ask a Agent team member to comment about this.

[Dima P.]

adam900331,

By setting up a dedicated user in the access permission tab you allow the account set in the B&R server step of the agent job wizard to connect with B&R repository. Changing 'everyone' to specific user should not break anything as long as that specific user account is set in the agent set of the wizard.

Agent backup job, where the agent computer managed by Veeam server?

Jobs managed by B&R does not use access permissions. Access is granted via 'child' certificates created from the root certificate set in the B&R ensuring that every agent can connect to the repo and, at the same time, can see only it's own backup files.

Hope it helps!