Hardened Veaam Backup Reporsitory: question about Veeam Transport/Deployment paths' ownerships

[Parnassus]

Hi all,

We have four Linux Servers (all SLES 15 based, currently three are at SP5 and one is still at SP3), all deployed as Hardened Veeam Backup Repositories.

Those four servers were made in different times, the oldest (the one still at SLES 15 SP3) is tied to a Veeam B&R 11 (Veeam Backup & Replication 11.0.1.1261 P20230227) that we are going to dismiss, we plan to move this old repository to a new Veeam B&R 12 (revamping the repository by migrating it to SLES 15 SP5). All the others three servers are instead tied to two different Veeam B&R 12 (Veeam Backup & Replication 12.1.1.56, both not natively born 12.1.1 but 12.0.0 and 12.1.0).

Long story short to say we performed the deployments of Hardened Backup Repositories in a pretty standardized way during last three years (as per Veeam Best Practices) but we have some doubts regarding the expected ownerships of path used by the installed Veeam Transport Service.

Is it correct that the /opt/veeam/transport folder (as long as the /opt/veeam/deployment folder where present [*]) is owned by user and group root:root with a UMASK 0022 (say rwxr-xr-x)?

[*] we noticed that, on the older Hardened Veeam Backup Repository running on SLES 15 SP3 which is tied to Veeam B&R 11, the /opt/veeam/deployment folder is missing (while it is available on the others Hardened Backup Repositories tied to newer Veeam B&R 12), in any case the /opt/veeam/transport folders are present on all server and were created with the above cited UMASK and ownership.

[Mildur]

Hello Davide

The deployment folder was introduced in V12. It is used by the deployment service which allows the backup administrator to update the hardened repository components without an SSH connection.

I have the following folder permission for root:root in my lab:
- transport (rwxr-xr-x / UMASK 0022)
- deployment (rwxr-xr-x / UMASK 0022)

Best,
Fabian

[Parnassus]

Hello Fabian, thanks you very much for your prompt and detailed answer, it dissipates our doubts and makes us condfident to have done things right. About the /opt/veeam/deployment folder absence on V11 (and popped up on V12), we realized that quite immediately after posting! Thanks you again! Davide.

P.S. For the sake of truth, we have a case open with Veeam Support, possibly with a loose relationship to what was asked here. For reference: Case #07122498 "Linux Server (defined as Hardened Repository) - Failed to create subdirectories for Veeam Agent: Permission denied".

[Mildur]

Hello Davide

Thanks. I can see the case was escalated.
Let's wait for further investigation.

Best,
Fabian