Here’s the translation of your text into American English:
The infrastructure of Veeam Availability is essential for data protection and recovery in most organizations. When setting up this infrastructure, it is crucial to remember the principle that a data protection system should not rely on the environment it is meant to protect. This is particularly important in the event of a production environment failure, as the backup server would also depend on domain controllers for authentication, name resolution, and other essential processes.
Domain or Workgroup?
In terms of security and management, there are various options for configuring the Veeam infrastructure. From the most secure to the least secure, the available options are as follows:
- Add Veeam components to a management domain in a separate Active Directory Forest and protect administrative accounts with multi-factor authentication (MFA).
- Add Veeam components to a standalone workgroup and place them on a separate network, if necessary.
- Add Veeam components to the production domain but ensure that accounts with administrative privileges are protected with multi-factor authentication.
Best Practice
The best practice for a more secure implementation is to add Veeam components to a management domain located in a separate Active Directory Forest and protect administrative accounts with multi-factor authentication. This way, the Veeam infrastructure does not depend on the environment it is meant to protect.
Workgroup Configuration
When using a workgroup, each system must be configured independently, including local security policies, users, and permissions. In larger environments, this can lead to tedious administration. Additionally, Kerberos authentication cannot be used, as only NTLM is utilized.
A workgroup is more difficult to defend against internal threats, such as a disgruntled employee, since local accounts are used on workgroup servers, and it’s not possible to block a single user at the Active Directory level. It also becomes more complicated to prove compliance and security of the system, which can be a drawback for meeting regulatory compliance requirements.
Advantages of a Workgroup:
- Easy and quick to set up.
- Separates Veeam accounts from privileged accounts in the production domain, helping to prevent keylogger attacks and breaches in the production domain.
- Does not depend on the environment it is meant to protect.
- Does not require additional servers like domain controllers, NTP, and DNS.
Disadvantages:
- High administrative burden in large environments.
- Cannot use Kerberos communication, only NTLM.
- More difficult to comply with security regulations and generate compliance evidence.
- Cannot use the gMSA system for guest authentication in backup interactions.
Management Domain Configuration
This configuration, which involves adding an independent management domain in a separate Active Directory Forest, is ideal for larger environments. Although this option adds some complexity, it facilitates centralized administration of policies and user permissions. Additionally, it allows for the deactivation of AD accounts with a single click, helping to quickly mitigate internal threats.
Advantages of a Management Domain:
- Easy to manage.
- One-click account deactivation.
- Does not depend on the environment that needs protection.
- Secure communication via Kerberos between Veeam components.
- Use of group policies for easier control of the domain and meeting security regulations.
- Ability to integrate multi-factor authentication (MFA) for an additional layer of security.
Disadvantages:
- Requires additional infrastructure components.
- Requires more technical knowledge to configure properly.
Forest Trusts
Forest Trusts are useful when looking for a solution for administrative autonomy in an environment with multiple Active Directory forests. A forest trust allows a production domain to trust a management domain in a unidirectional manner, providing a seamless authentication and authorization experience between forests.
- A unidirectional trust: Members of the trusted forest can utilize the resources of the trust-granting forest, but the trust operates in only one direction.
This is useful when the production domain needs to trust the management domain with a unidirectional trust relationship. In this case, the production domain would establish the trust relationship with the management domain.
Conclusion
The choice between a management domain and a workgroup depends on the size of the infrastructure and the security needs of the organization. For large environments, implementing an independent management domain and protecting it with multi-factor authentication is the most secure option, ensuring that data protection systems like Veeam do not rely on the infrastructure they are meant to protect. However, a workgroup may be useful for smaller environments, where complexity and compliance requirements are lower.
When making decisions about how to organize the Veeam infrastructure, it is essential to consider long-term security and ease of management to protect the organization’s critical data.
Source: Veeam