Skip to main content
Solved

Credentials Store


Shaokat
Forum|alt.badge.img+3

hi team 

can any you explain me where the veeam Credentials is store? 

if it's store in the sql database is the Credentials is encrypted? 

is it possible to recover Credentials from sql database? 

Best answer by Mildur

The store is in the database.

If you are on the backup server, and you are logged in as an admin, you can decrypt every password.

Therefore, the backup server needs to be protected from any thread.

 

Example:

https://forums.veeam.com/post329685.html#p329685

 

View original
Did this topic help you find an answer to your question?

9 comments

marcofabbri
Forum|alt.badge.img+13
  • On the path to Greatness
  • 990 comments
  • October 18, 2021

Hi @Shaokat credentials are stored in the Veeam B&R configuration database and are encrypted with the machine-specific key.


Mildur
Forum|alt.badge.img+12
  • Influencer
  • 1035 comments
  • Answer
  • October 18, 2021

The store is in the database.

If you are on the backup server, and you are logged in as an admin, you can decrypt every password.

Therefore, the backup server needs to be protected from any thread.

 

Example:

https://forums.veeam.com/post329685.html#p329685

 


StefanZi
Forum|alt.badge.img+3
  • Comes here often
  • 49 comments
  • October 18, 2021

And when you talk about recovery. The credentials stored in the SQL db are included in the VBR config Backup when it's encrypted and thus will be restored together with the rest of the config on a config restore.


Shaokat
Forum|alt.badge.img+3
  • Author
  • Influencer
  • 127 comments
  • October 18, 2021

one of my customer want to know about this. if any of an access my Credentials from database where my Credentials security? 


Mildur
Forum|alt.badge.img+12
  • Influencer
  • 1035 comments
  • October 18, 2021
Shaokat wrote:

one of my customer want to know about this. if any of an access my Credentials from database where my Credentials security? 

There are accessible from everyone with admin permission on the backup server. Hackers and Insiders.

They can get all the passwords if they want in plain text after they decrypt them with the machine key.


marcofabbri
Forum|alt.badge.img+13
  • On the path to Greatness
  • 990 comments
  • October 18, 2021

As @Mildur said, yes if you can access to server you can.

Check this, maybe can help you:

https://forums.veeam.com/powershell-f26/pull-credentials-from-sql-database-t18467.html


marcofabbri
Forum|alt.badge.img+13
  • On the path to Greatness
  • 990 comments
  • October 18, 2021
Mildur wrote:
Shaokat wrote:

one of my customer want to know about this. if any of an access my Credentials from database where my Credentials security? 

There are accessible from everyone with admin permission on the backup server. Hackers and Insiders.

They can get all the passwords if they want in plain text after they decrypt them with the machine key.

whoami

root

The two lines that define the end of games and IT security :joy:


marcofabbri
Forum|alt.badge.img+13
  • On the path to Greatness
  • 990 comments
  • October 22, 2021

@Shaokat have you solved?


vNote42
Forum|alt.badge.img+13
  • On the path to Greatness
  • 1246 comments
  • October 22, 2021

my 2 cents here:

As already been said: it is essential to keep VBR server one of the the safest place in you network! When a bad guy enters the server, he has access to any credential stored in DB like:

  • vCenter user
  • Storage admin-accounts - most vendors just support admin-users when it comes to storage integration
  • Windows backup user(s)
  • probably privileged Linux user(s)

Good news: if you use single-use credentials for Hardened Repo server, at least this credential is not stored in DB! 


Comment