Veeam hardened repository ISO for v13: the Veeam Infrastructure Appliance, requirements and setup

What the hardened repository ISO is in Veeam v13

For Veeam Backup & Replication 13, the hardened repository ISO is the Veeam Infrastructure Appliance ISO: you install it and select the Veeam Hardened Repository role in its Initial Configuration wizard. Veeam’s user guide calls this “the recommended option”. Veeam describes the appliance as “a Linux distribution delivered by Veeam as a bootable JeOS (Just Enough Operating System)”, so the operating system, the Veeam components and the hardening arrive as one image. A hardened repository built this way must use certificate-based authentication, and SSH cannot be used.

Version 13.1 has been available since 29 July 2026, and its latest build is 13.1.1.18 of 13 August 2026, according to Veeam’s KB2680 (modified 5 October 2026). The manual Linux build and the job settings that immutability requires are in our Veeam hardened repository setup guide.

What the Veeam JeOS appliance contains and which roles it takes

Veeam’s KB4757 (29 July 2026) states that Veeam JeOS “is built on Rocky Linux from CIQ (RLC Pro)”, which “provides long-term support and FIPS 140-3 validated packages”. Version 13.1 moved all Veeam appliances to Veeam Enterprise Linux JeOS 9.6, which Veeam says extends hardware compatibility. Veeam JeOS also runs the Veeam Software Appliance, the Linux-based backup server, while the Veeam Infrastructure Appliance carries the other backup infrastructure components.

Since 13.1 one boot menu serves every role, and you choose the role later in the Initial Configuration wizard. Infrastructure Server is the default. Infrastructure Server with iSCSI/FC/NVMe-oF is the role for a VMware backup proxy that reads from storage snapshots. The Veeam Hardened Repository role turns the server into an immutable target, and in 13.1 it can also act as an Application Backup Repository. Veeam’s considerations page lists the roles a server deployed from the appliance can take, among them VMware backup proxy, mount server, gateway server, WAN accelerator, cache repository and scale-out backup repository extent. The hardened repository role takes fewer of them; Veeam’s What’s New in 13.1 speaks of roles “which are not allowed on Hardened Repository”.

The user guide allows the VMware backup proxy role on a hardened repository, but only in network mode. It warns that the VMware VDDK components a proxy needs raise the risk of attacks on the hardened repository, and it recommends another managed server for the role. You configure the appliance in the Host Management console, through the host administrator account (veeamadmin) and the security officer account (veeamso). Multi-factor authentication for both was enforced at deployment in 13.0; since 13.1 the appliance can be installed without enforcing it, so check afterwards that both accounts have it. How the lock works and what it does not stop is in our guide to what immutable backup protects against.

Veeam hardened repository requirements: hardware, disks and storage

The table lists Veeam’s minimum for the appliance first, then its sizing guidance for the repository role.

Veeam Help Center, Backup & Replication 13 user guide (system requirements, installation and reinstallation pages) and What’s New in 13.1 (updated 15 October 2026); Veeam Best Practice Guide (© 2025); Veeam blog hardware guide (updated 25 February 2026).

Veeam’s system requirements page marks the 120 GB figure with a footnote, so read that page before you choose the operating system drives. The Standard (Multi-Disk) Deployment creates “separate system and data volume groups” from every disk it finds. Veeam names a backup proxy with remote storage and the Application Backup Repository as the cases for Single-Disk Deployment, so a hardened repository with local data disks uses the default. Give the operating system a small RAID 1 of SSDs, as Veeam’s hardware guide recommends, and the data a larger RAID 6 or 60 volume; the reinstall rule on the smallest drive then holds.

Veeam’s Best Practice Guide says that “Virtual Hardened Repositories are NOT recommended for production environments” and that the repository should ideally be “an administratively and physically isolated system”. Since 13.1 Veeam appliances can attach Fibre Channel and iSCSI storage devices with multipathing. The hardware guide, however, recommends internal disks for a hardened repository, because they remove the risk of an attacker deleting everything on the storage side. It also advises checking the hardware compatibility list of the Linux distribution. We found no such list for Veeam JeOS, so check before ordering that the RAID controller and network adapters run under Veeam JeOS 9.6.

Appliance or self-built Linux hardened repository

The 13.1 user guide still documents a Linux server you configure yourself. The two builds differ in who maintains the operating system and how the backup server reaches it.

Veeam Help Center 13 user guide (hardened repository requirements, installation, updating, ISO v2 upgrade); What’s New in 13.1; Veeam KB4757; Veeam TAM’s Community Hub deep dive on 13.1 (12 August 2026).

A Veeam technical account manager’s comparison of the 13.1 options (Community Hub, 12 August 2026) says that on a manually deployed hardened repository “OS lifecycle, patching, monitoring, and compliance remain with the operator”. Its decision matrix names the appliance hardened repository in multi-disk deployment where ransomware resilience comes first, and the post lists XFS and Fast Clone among the reasons for it. We found no Veeam user guide text that names the file system the installer creates. A self-built server still fits where the hardware or the monitoring tools need software that the appliance does not include.

Whether a repository should move to the appliance is settled in the security and backup assessment of our cyber resilience service, which ends with a risk map and a prioritised action plan. Describe how your repositories are built and which Veeam version they run.

Installing the appliance ISO and adding the hardened repository

The steps follow Veeam’s installation order, with hardware preparation and hardening added.

1. Download the Veeam Infrastructure Appliance ISO from the product downloads in your Veeam account.
2. Write it to a USB drive in DD image mode or mount it through the BMC’s remote media; Veeam’s KB4789 traces an installer error to USB drives not written as a direct image.
3. Leave only the operating system SSDs and the data volume attached, boot the ISO and select Standard (Multi-Disk) Deployment.
4. Begin the installation and accept the licence agreements.
5. In the Initial Configuration wizard, select the Veeam Hardened Repository role, set the hostname and review the network settings.
6. At the Time step, add NTP or NTS servers you control.
7. Configure veeamadmin and veeamso for two different people, each with MFA, and finish the configuration.
8. In the backup console, run the New Linux Server wizard for Veeam Infrastructure Appliances, enter the appliance’s DNS name or IP address and complete the wizard.
9. Add the hardened repository on that server, with its path at or under /var/lib/veeamdata/backup and the immutability period at the Repository step.
10. Disable the Host Management console Web UI, as Veeam strongly recommends, and run the Security & Compliance Analyzer.

On an appliance hardened repository the Web UI switches itself off 24 hours after it is enabled. Leave the BMC unplugged afterwards or behind a firewall that admits no incoming connections, as our setup guide describes.

Updates and lifecycle of the Veeam Infrastructure Appliance

The Veeam Updater updates the appliance. Every 12 hours it asks repository.veeam.com for the latest updates, and it updates and restarts itself when a new version of the Updater exists. Updates can be installed manually or automatically, under a global update configuration that applies to all appliances added as managed servers, or under a custom one. Veeam’s note before any update is to create a configuration backup first, and since 13.1 that backup can be stored immutably on a hardened repository.

A hardened repository in an isolated network needs a planned update path. Since 13.1, Enterprise Manager can cache updates from the official Veeam repository and distribute them to the appliances. Veeam’s KB4879 (14 July 2026) describes a vulnerability in the Updater component, with a CVSS 4.0 score of 8.4 (High), resolved from Updater version 12.3.0.65. Most users needed no action, as the Updater installs the fix during its automatic update check. Appliances that could reach neither repository.veeam.com nor a local mirror needed Veeam Support or temporary internet access. Veeam lists the resolved vulnerabilities of the JeOS operating system in KB4757.

A hardened repository built from the Veeam Hardened Repository ISO v2 is upgraded with the appliance ISO and afterwards has “the same features and functionality as a Veeam Infrastructure Appliance”. Veeam preserves the files under /mnt/veeam-repository01/ during the upgrade. Upgrade the backup server to version 13 first: the Czech IT blog Samuraj notes (July 2026) that a version 13 appliance can only be added to Backup & Replication 13.

Sizing hardened repository appliances for 500 to 2,000 VMs

The capacity inputs are the source data, the data reduction, the daily change rate, the retention, the immutability period and the 80 per cent fill limit. Our example takes the profile from our Veeam sizing guide for large VMware estates, where Veeam’s ratios are worked through: 800 VMs and 120 TB of source data. It assumes 2:1 reduction, 3 per cent daily change, 14 daily restore points and weekly synthetic fulls with Fast Clone. Check that the first synthetic full reports Fast Clone in its job session.

On disk, the full takes about 60 TB and each increment about 1.8 TB. Without a lock the chain holds about 96 TB. With a 30-day immutability period, the oldest full and its increments stay for about 36 days, so the chain grows to about 125 TB. Space for one active full brings this to about 185 TB, and at 80 per cent fill the appliance needs about 231 TB of data volume. The example’s 16 proxy cores call for 6 repository cores and 24 GB of RAM.

Our arithmetic with Veeam’s Best Practice Guide ratios and the assumptions above, 30-day lock, before GFS points; proxy cores scale from 16 at 800 VMs.

At 2,000 VMs the volume passes Veeam’s advice of 500 TB per volume, so split the data across two appliances of about 290 TB each, as extents of a scale-out backup repository or with jobs divided between them. GFS points come on top, and two appliances in one room remain one site, so the second copy belongs elsewhere, as the 3-2-1-1-0 backup rule describes.

Veeam-based backup with regular test restores is part of our cyber resilience service, delivered by our engineering partner Vixen.UNO. Send us your VM count, source data, retention and immutability period through the form below.

What we do

Hardened repositories built from the appliance are part of the Veeam-based backup that the team of our engineering partner Vixen.UNO delivers under our cyber resilience service, on one contract with Eurokommerz and with regular test restores to verify backup integrity. The paid technical assessment of security and backup also covers environments we did not build, ends with a risk map and a prioritised action plan, and its price is fixed before work begins. Changes are rolled out step by step, in agreed maintenance windows with a rollback plan. For a recovery site, our disaster recovery service replicates virtual machines via Veeam Cloud Connect to Baltneta’s Tier-3 data centres in Lithuania, with RPO and RTO fixed in the SLA.

FAQ