In short
A Veeam backup setup uses Veeam Backup & Replication to back up virtual and physical servers, copy those backups to a separate repository and an offsite location, and run regular restore tests. It is for companies running VMware, Hyper-V or physical servers. CybUp configures the backup server, an immutable hardened Linux repository, backup copy jobs and SureBackup testing.
What does a Veeam Backup & Replication setup cover?
Veeam Backup & Replication is made up of a backup server, proxies that move the data, and repositories where backups are written. During setup we decide where each of these three parts lives, which network they talk over and which accounts manage them. The mistake we see most often is a backup server joined to the domain and managed with the same admin account as everything else: an attacker who takes over the production network walks into the backups with the same key.
We split backup jobs by workload. Domain controllers, file servers, databases and application servers need different retention periods and different consistency settings. For applications such as SQL Server and Exchange, application-aware processing is enabled so that transaction logs are handled correctly.
What is the 3-2-1-1-0 backup rule?
3-2-1-1-0 means keeping at least three copies of your data, on two different types of media, with one copy offsite, one copy immutable or offline, and zero errors on restore. Veeam’s article on the 3-2-1 rule extends the classic 3-2-1 in exactly this way, adding the immutable copy and verified recovery.
Simple on paper, but in practice every number has to map to something real. The second medium is a separate disk enclosure or tape, the offsite copy is a branch or the cloud, the immutable copy is a hardened repository, and zero errors means regular SureBackup testing. Veeam’s backup copy jobs automate copying the primary backup, in the same format, to another location.
- 3: production data plus at least two backups
- 2: two different storage media
- 1: at least one copy at another site
- 1: at least one copy immutable or offline
- 0: tested restores with no errors
How do you set up a Veeam hardened repository for immutable backups?
Veeam’s hardened repository feature ensures that backup files written to a Linux-based repository cannot be moved, modified or deleted for a period you set. When the Linux server is added to the backup infrastructure, single-use credentials are used and are not stored on the Veeam server, so even if the Veeam server is compromised, an attacker cannot use them to connect to the repository.
We put the repository on its own physical server, disable SSH or lock it down tightly, and assign no roles beyond what Veeam requires. For security reasons, Veeam itself does not allow any role on this repository other than the VMware proxy role in network mode. The server’s out-of-band management card (iDRAC, iLO) gets a strong password and a separate network, because an attacker who cannot reach the repository may try to wipe the disks through the hardware management card instead. For the Linux side of the build, see our Ubuntu Server setup page.
The immutability period has to match your retention policy. Set it too short and it is useless against an attacker who waits quietly; set it too long and the disks fill up faster than expected. We work out the balance from your data change rate.
“Immutability: when you add a hardened repository, you specify the time period while backup files must be immutable. During this period, backup files stored in this repository cannot be moved, modified or deleted, but can be copied.”
How do you test restores with SureBackup?
SureBackup is the Veeam job that automatically verifies that backups really do start. In full recoverability mode it boots VMs directly from backup in a virtual lab isolated from the production network and runs tests against the applications on them. Dependencies such as a domain controller start first, as an application group.
In small environments where a lab is not practical, you can use the SureBackup mode that runs only a backup integrity check and content scan, looking for traces of malware in the backup. Whichever mode is used, we arrange for the results to reach you by email every week and for a failed test to raise an alert in your monitoring system.
Take a 40-person architecture practice: one Hyper-V host, five VMs and a file server full of large CAD files. Each night the backup is written to a local hardened repository, a backup copy job sends it to a second site in the early hours, and every Sunday SureBackup boots the domain controller and file server in the lab and tests access to the share. The report that arrives on Monday morning is your proof that the backups work.
“In the Backup verification and content scan only mode, the SureBackup job performs only backup integrity check and its content analysis to detect traces of malware or any other unwanted or sensitive data.”
How should offsite and cloud backup copies be set up?
There are three typical options for the offsite copy: a second repository in another of your buildings, object storage that Veeam supports (S3-compatible or Azure Blob), or a service provider’s Veeam Cloud Connect infrastructure. The deciding factors are link capacity, which country the data is held in and how quickly you could pull the data back down when you need it. We open the cloud storage in your own account on your behalf; we do not run a hosting service of our own.
For a cloud copy, immutability through object lock and encryption should both be switched on, and the encryption password must be kept somewhere safe away from the Veeam server. Lose the password and you have effectively lost the backup.
Should Microsoft 365 data be backed up too?
Exchange Online, OneDrive, SharePoint and Teams data is held on Microsoft’s infrastructure with high availability, but that is not a backup against your own mistakes, such as deletions, bad syncs or a compromised account. For this, Veeam offers a separate product, Veeam Backup for Microsoft 365.
Where Microsoft 365 backups are written (an on-premises repository or object storage), how long they are kept and who is allowed to restore should be planned with the same discipline as server backups. We handle this together with your disaster recovery plan.
What you receive
- Veeam Backup & Replication server, proxy and repository setup
- Backup jobs split by workload, with a retention policy
- Hardened Linux repository with immutability configured
- Backup copy job to a second site or the cloud, with encryption
- SureBackup tests and a weekly results report
- Restore procedure document and administrator training
How we work
- 1
Free review
We look at your current backup arrangements, data size, change rate and recovery expectations.
- 2
Design
We set the repository size, retention periods, immutability period and offsite copy target.
- 3
Build
The Veeam server, hardened repository, backup jobs and backup copy jobs are configured.
- 4
Testing
File-, VM- and application-level restores are tried out, and SureBackup jobs are put into service.
- 5
Handover and follow-up
You receive the procedure document; report monitoring and periodic testing support can continue if you want.
Frequently asked questions
Do you supply the Veeam licence?
No. You buy the licence through Veeam’s authorised sales channels, and we determine which edition and licence type you need based on the number of workloads to protect. If you already hold a licence, we can install with it.
What hardware does a hardened repository need?
A separate physical server with enough disk capacity. Disk size is calculated from the amount of data backed up, the change rate and the immutability period. We avoid running it as a VM, because that weakens protection against an attacker who takes over the hypervisor.
We back up to a NAS. Is that enough?
A NAS works as a second medium, but a share that can be reached from the domain is defenceless against ransomware. A Veeam immutable repository, or a target with object lock, closes that gap.
How long does a restore from backup take?
A single file comes back in minutes. A VM can be brought up quickly by running it directly from the backup with Veeam, then moved to production storage in the background. We measure recovery time for the whole environment by testing it against your RTO target.
Can you back up physical servers as well?
Yes. With the Veeam agents for Windows and Linux, physical servers are backed up from the same console and written to the same repositories.
Do we have to drop our current backup software?
Not necessarily. If your current product can provide an immutable repository, an offsite copy and restore testing, we would recommend strengthening it instead. At the end of the review we tell you in writing what is missing.
Can you do the setup remotely?
All of the software side can be done remotely. When a new repository server has to be mounted and cabled, we work on site in Istanbul.
How much does a Veeam setup cost?
We give you a written quote once we have reviewed the scope, and the review is free. The quote depends on the number of servers to protect, the number of repositories and the offsite copy target.