Separate Veeam Linux onboarding credentials from ongoing access

Review single-use SSH credentials specifically for manually prepared Linux hardened repositories.

Source facts

For a manually prepared Linux hardened repository, Veeam’s version 13 guide describes initial setup using single-use SSH credentials. The account must be non-root and have a home directory. Veeam states that these single-use credentials are not stored in the backup server’s configuration database. If the account belongs to sudoers, the guide directs administrators to remove it from sudoers after the Linux server is added.

Source: Veeam — Adding Hardened Repositories, version 13.

Applicability

This article concerns the manual Linux path in the cited guide. Do not apply its SSH onboarding instructions to a different repository deployment method without checking that method’s documentation.

DSE recommendation

DSE recommends documenting the temporary onboarding authority separately from the repository’s continuing service and maintenance requirements. Before setup, record the account owner and the planned privilege-removal checkpoint. After successful addition, review the actual operating-system account and its remaining rights; the phrase single-use should not substitute for that review. Keep credentials out of tickets, screenshots, and evidence bundles. Agree a supported maintenance and recovery process with the backup owner before removing access that process requires.

Verification

Record successful Linux-server addition, then confirm removal of the temporary sudoers membership where applicable. Check the supported backup and repository-management operations after setup. Retain sanitized outcomes and ownership details rather than the onboarding password.

Official reference

Veeam — Adding Hardened Repositories, version 13. Reviewed October 14, 2026.