How do I set up a Veeam hardened repository on a rented Linux server?

What does a hardened repository protect against?

A hardened repository makes backup files immutable for a period you set. During it, Veeam says the files cannot be moved, modified or deleted, but can be copied.

Two services do the work. Veeam Data Mover talks to the backup server on port 6162 and runs as a non-root user. The Veeam Immutability Service, its child process with root rights, sets and lifts the immutable attribute and checks files every 20 minutes. The credentials used to install them are not stored, so a compromised backup server cannot log back in.

Immutability protects the files from a stolen backup server; it does not protect the repository from losing the machine itself.

How do I prepare the drives and the file system?

Veeam recommends RAID 1 on SSDs for the system and RAID 6 or 60 with write-back cache for backup data. On a Basalthold hold, the system already sits on SSD. The operating system sits on its own SSD (two mirrored SSDs on the larger holds); the data drives arrive blank and unpartitioned, so you can build ZFS, an mdadm array or a set of independent disks. If you want the team to prepare a RAID 6 or RAID 10 array before delivery, say so to support before the server is handed over.

Basalthold promises no hardware RAID controller, so build RAID 6 in software with mdadm. It gives the same two-drive tolerance, without a write-back cache. Only 4 of 23 storage-server sellers Basalthold checked on 2 November 2026 state a hardware RAID controller on a storage plan. The parity trade-offs are on RAID 6 or RAID 10 for a rented storage server.

Then format with Veeam's own string. Fast clone needs XFS with reflink and checksums on, and a block size of 1 to 4 KB.

mdadm --create /dev/md0 --level=6 --raid-devices=10 /dev/sd[b-k]
mkfs.xfs -b size=4096 -m reflink=1,crc=1 /dev/md0
mkdir /backups
blkid /dev/md0          # copy the UUID
# /etc/fstab
UUID=<UUID>  /backups  xfs  defaults  0  0

How do I add the server with single-use credentials?

Veeam asks for a non-root account with a home directory, used once over SSH to deploy Veeam Data Mover. The backup directory must belong to that account and its group, with mode 0700 and no sticky bit.

useradd -m -s /bin/bash veeamrepo
passwd veeamrepo
mkdir -p /backups/veeam
chown veeamrepo:veeamrepo /backups/veeam
chmod 0700 /backups/veeam
usermod -aG sudo veeamrepo      # temporary, for the deployment only

What changes when the server is rented, not in your rack?

Three things: the console, the clock and the contract.

• Console. Veeam suggests disabling SSH for the whole server if you can work from the console. There is no IPMI or KVM-over-IP access for customers; reboots and reinstalls you request in the dashboard are carried out by the team. So keep root on SSH with a key only, limited by firewall to your admin address. Open 6162 and 2500 to 3300 only to your Veeam servers.
• Clock. The Immutability Service blocks retention if the clock jumps by more than 24 hours, or the repository stays off that long. Keep NTP running.
• Contract. Each server is paid in advance from your crypto balance, for 30 days, 3 months, 6 months or 12 months as chosen at checkout. Auto-renew charges the same length again at the price you started with, unless you set another length for the next renewal in the dashboard; when the balance falls short, the server stops at the end of its term, its drives are held for 7 days and then wiped. Locked or not, the drives go.

An immutable flag lasts as long as the rental: pay the term past the end of the lock. Hold 100 costs $3,167.22 for 12 months, against $377.05/30 days. What happens to the drives after a lapse is on data after cancelling a rented storage server.

How long do backups stay immutable, and how much space does it take?

Each image-level backup stays immutable for the period you set, counted from the last restore point of the active chain. Veeam extends the whole active chain at each new restore point. GFS full backups stay locked for their own retention when it is longer.

Immutability overrides job retention: a file is deleted only once its lock expires. Plan capacity for the longest lock, not the shortest retention. Fast clone keeps synthetic fulls cheap on XFS, so the extra space is mostly changed blocks.

If you also encrypt the jobs, Veeam encrypts at the source, and the data keys stay off the repository. For drive-level encryption, see unlocking a LUKS-encrypted rented server remotely. Prices for every term are on the hold price list. Other locking methods are on immutable backups on your own server.