Veeam’s Hardened Repository lets you store backups on a Linux server with immutability enforced at the file-system level. It is a cost-effective way to add an immutable tier — if it is built and operated correctly.
How it works
Backup files are flagged as immutable for a set period, so they cannot be modified or deleted — even by the backup server — until that period ends.
Hardening steps that matter
- Use single-use credentials during setup, not stored SSH access.
- Disable or tightly restrict remote management such as SSH.
- Use a dedicated, minimal Linux installation with no other roles.
- Protect the server’s time source so retention cannot be manipulated.
- Restrict physical and out-of-band (iLO/iDRAC) access.
Common mistakes
Leaving SSH open, sharing credentials with other systems, or running the repository as a virtual machine on infrastructure the attacker can also control all weaken the design.
Operating the repository day to day
Once the repository is built, the work shifts to keeping it hardened. Apply operating-system updates through a controlled process, monitor for unexpected logins or configuration changes, and review immutability periods whenever backup policies change.
Capacity planning matters more with immutability: data cannot be deleted early to free space, so running out of capacity can cause backup failures. Track growth and plan expansion well ahead of need.
Key takeaways
- Hardened Repository adds file-level immutability on Linux.
- Its strength depends on hardening and access control.
- Treat it as a security system, not just storage.
Want an independent view of your recoverability?
Book a Recovery Readiness Call and we’ll help you turn assumptions into evidence.
