How to Set Up a Veeam Hardened Repository for Immutable Backups

To set up a Veeam hardened repository, prepare a dedicated physical Linux server with XFS-formatted block storage. Add it to Veeam Backup & Replication with single-use credentials or certificate-based authentication. Then set an immutability period of 7 to 9,999 days and close remote access so no one can remove the locks. 

Our Veeam beginner’s guide explains what immutability is. This post covers the immutable backup setup itself, following the official Veeam hardened repository documentation for Veeam Backup & Replication 13. ZNetLive is a Veeam partner in India and offers Veeam Data Platform licences with INR quotes, sizing and deployment support. 

How to Buy: Veeam pricing in India is quote-based, depends on workload count, edition and term, and attracts 18% GST. Foundation, Advanced and Premium need at least 10 Veeam Universal Licences (VUL); Essentials is sold in packs of 5, up to 50 workloads. 

What Is a Veeam Hardened Repository? 

A Veeam hardened repository is a Linux backup repository where Veeam makes backup files immutable for a set number of days. Until that period ends, the files cannot be changed or deleted. That makes it central to Veeam ransomware protection: ransomware or a stolen admin account cannot wipe your restore points. 

It relies on three protections: 

• Immutable files:

Veeam sets Linux immutable and extended attributes on each backup file. 

• No stored root credentials:

Amanually built repository uses single-use credentials; a Veeam Infrastructure Appliance repository uses certificates instead of SSH. 

• Time-shift protection:

Veeam detects attempts to move the server clock forward to expire locks early. 

Two services handle the locks. The Veeam Data Mover Service runs as a non-root user on port 6162 and passes the immutability period from the backup server. The Veeam Immutability Service then sets the immutability attributes on each file. You can build a hardened repository in two ways: 

What Linux Server Do I Need for a Veeam Hardened Repository? 

You need a dedicated 64-bit Linux server, ideally physical, with local disks or SAN block storage formatted as XFS. 

Supported OS versions change between builds, so confirm yours in the backup repository system requirements. Size storage generously: locked files cannot be deleted to free space. 

How Do I Set Up a Veeam Hardened Repository? 

Install the server, add it to Veeam Backup & Replication, then create the repository with immutability switched on. 

Option A: Veeam Infrastructure Appliance 

Choose this route if you want Veeam to supply and patch the operating system. 

1. Install the appliance. Boot the Veeam Infrastructure Appliance ISO from Veeam’s download portal and select the Hardened Repository role. The default multi-disk install uses all local disks. 
2. Configure the basics. Set the hostname, network and a reliable NTP server. 
3. Create the accounts. Set up the Host Administrator and, if you use one, the Security Officer. Initialise the Security Officer account before adding the server to Veeam. Without a Security Officer, multi-factor authentication cannot be turned off. 
4. Attach storage (local, iSCSI or Fibre Channel) in the Veeam Host Management console. 
5. Add it to Veeam Backup & Replication as a Veeam Infrastructure Appliance. The connection uses certificates, not SSH. 
6. Keep the Host Management web UI disabled. In current builds it is off by default and opens for 24 hours only when Security Officer approval is needed. 

Option B: Manually Configured Linux Server 

Choose this route if your team already maintains its own hardened Linux builds. 

1. Install a supported 64-bit Linux OS (minimal install) and apply updates. 
2. Format the backup volume as XFS with reflink, for example mkfs.xfs -b size=4096 -m reflink=1,crc=1 /dev/sdb, and mount it permanently, for example at /backups. 
3. Create a non-root user, such as veeamrepo, with temporary sudo rights. 
4. Prepare the folder: owner and group set to that user, permissions 0700, no sticky bit. 
5. Add the server under Backup Infrastructure > Managed Servers > Add Server > Linux, choosing Single-use credentials for hardened repository. 
6. Create the repository under Backup Repositories > Add Repository > Direct attached storage > Linux (Hardened Repository). Select /backups, enable fast cloning on XFS, and set Make recent backups immutable for 7 to 9,999 days. 
7. Remove the temporary sudo rights once Veeam components are installed. 

Assign Your Backup Jobs to the Repository 

Update your backup jobs to write restore points to the hardened repository using the steps below. 

1. Select the hardened repository as the job target. 
2. Use forward incremental backup with active or synthetic full backups. Reverse incremental and forever forward incremental are not supported. 
3. Add GFS retention if you need long-term restore points. 
4. Run the job and test a restore. 

How Do I Harden the Linux Server Further? 

Immutability holds only while attackers cannot get root on the repository, so block every remote path in and protect the clock. 

• Disable SSH  

You need to disable SSH on a manual build after setup and use the local console for maintenance. 

• Keep it off the domain  

Deploy it on an isolated network segment that permits only Veeam traffic. 

• Secure iLO, iDRAC or IPMI

Restrict access as out-of-band access can wipe the server. 

• Use a trusted NTP source 

If time-shift protection triggers on the appliance, reset it from the Host Management console. 

• Install nothing else  

Only Veeam Data Mover processes may run as root. 

• Follow the 3-2-1-1-0 rule 

Maintain three copies, two media types, one offsite, one immutable or offline, zero verification errors. 

Which Veeam Licence Do I Need, and How Do I Buy It from ZNetLive? 

The hardened repository is a core Veeam Backup & Replication feature, available in every Veeam Data Platform edition, including Essentials. 

Pricing of Veeam

Veeam does not publish INR list prices. Share your VM, server and file data counts with ZNetLive, choose an edition and term, and request a quote. Prices are in INR plus 18% GST, and multi-year terms usually lower the yearly cost. 

Frequently Asked Questions 

Here are short answers to the questions we hear most about Veeam hardened repositories. 

1. Is a Veeam Immutable Repository the Same as a Hardened Repository? 

In Veeam Backup & Replication, usually yes: a hardened Linux repository with immutability on. The other option is object storage with S3 Object Lock, such as Wasabi. 

2. Can a Windows Server Be a Hardened Repository? 

No. Windows repositories with ReFS support Fast Clone but have no immutability, so a hardened repository must run Linux. 

3. Can I Use a NAS or NFS Share? 

No. A hardened repository needs block storage: local disks, or iSCSI or Fibre Channel LUNs. NFS and SMB mounts are not supported. 

4. How Long Should the Immutability Period Be? 

Veeam allows 7 to 9,999 days. Choose a period longer than an attacker could stay hidden in your network, and size storage for the extra locked data. 

5. Can I Delete an Immutable Backup to Free Space? 

Not until its lock expires, even as an administrator, so plan capacity before setting a long period. 

Ready to Build Your Veeam Hardened Repository? 

A hardened repository works best as part of a wider backup plan. Pair it with an offsite copy and test your restores regularly. Review the immutability period as your data and risks change. If you need help with licensing or setup, ZNetLive can assist. 

Get your Veeam quote from ZNetLive today!