______ Security Considerations The security advice in this article is provided as a courtesy and is not intended to replace the advice of a professional security consultant. The advice in this article has been tested with the assumption that the machine operating Veeam Backup Enterprise Manager and/or Veeam Backup & Replication runs no other software. Please remember that while Veeam's software is compatible with TLS 1.2 and 1.3, which allows TLS 1.1 and 1.0 to be disabled, other third-party software may not be compatible and could be impacted by the OS-level security changes discussed in this article. ## Purpose This article documents security improvements that can be made to the Veeam Backup Enterprise Manager server and its IIS-based websites. ## Solution #### **Part 1:** Disabling Weak Protocols and Ciphers By default, the Windows Server OS has numerous protocols and ciphers enabled, many of which are unnecessary when operating Veeam Backup Enterprise Manager. ##### **Protocols** Veeam backup infrastructure components support the following TLS versions: * TLS 1.2 * TLS 1.3 is partially supported by backup infrastructure components installed on Microsoft Windows Server 2022. PowerShell components and components using OpenSSL do not support TLS 1.3. **Note:** For security reasons, disable outdated protocols TLS 1.0 and 1.1 if they are not needed. For more information, see this Microsoft article. ##### **Ciphers** By default, the list of ciphers the Windows OS may negotiate for a given security protocol includes DES, RC2, RC4, and 3DES (Triple DES). These ciphers are considered vulnerable, and it's recommended to disable them. Veeam backup infrastructure components support AES (128 and 256) Ciphers. ______ **Tip:** The free third-party tool IIS Crypto, from Nartac Software, can be used to easily manage which protocols and ciphers are enabled. Simply run the program on the Veeam Backup Enterprise Manager server, click the **Best Practices** button, click **Apply** , and reboot the server. **Note:** The**Best Practices** option in IIS Crypto does not disable TLS 1.0 and TLS 1.1; you must toggle those within the Server Protocols and Client Protocols sections yourself. #### **Part 2:** Adjust Website Settings to Enhance Security These settings can further reduce the attack surface of the IIS-based websites for Veeam Backup Enterprise Manager. 1. Browse to the web app installation folder. Default: `C:\Program Files\Veeam\Backup and Replication\Enterprise Manager\WebApp\` 2. Make a backup copy of the original `**Web.config**` file to allow for easy reversion if needed. 3. Open the `**Web.config**` file in a text editor and make the following changes: * **Disable IIS Version Header** -- By default, IIS will include a header like `**Server: Microsoft-IIS/10.0**`, which reveals the version of IIS being used. Setting `**enableVersionHeader = "false"**` adjusts the server configuration so that this version information is not included in the HTTP response headers. This adjustment is primarily a security measure aimed at reducing the amount of information disclosed to potential attackers. 1. Find the node `**< httpRuntime**` and add the following option: enableVersionHeader = "false" 2. The `**< httpRuntime**` settings should look like this afterward: * **Enable X-Content-Type-Options Header** -- This setting prevents browsers from performing MIME type sniffing by setting `**X-Content-Type-Options**` to `**nosniff**`. By doing so, it ensures that browsers adhere to the specified Content-Type declared in the HTTP headers, rather than attempting to determine it themselves. This measure helps prevent security vulnerabilities like cross-site scripting (XSS) attacks and downloads of malicious content by enforcing strict handling of MIME types as they are served by the server. 1. Find the `**< customHeaders>**` section and add the following option: 2. The `**< customHeaders>**` section should look like this afterward: ##### **Part 3:** Sanitize the Error Page While error webpages can be user-friendly, they can inadvertently disclose critical server and application details to potential attackers probing your environment. To enhance security, sanitize the error page contents. 1. Navigate to the web app installation folder: Default: C:\Program Files\Veeam\Backup and Replication\Enterprise Manager\WebApp\ 2. Make a backup copy of the original _Error.aspx_ file to allow for easy reversion if needed. 3. Open the original Error.aspx file. 4. Delete its contents. 5. Save the now-blank file. If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case. To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

General Security Guidelines for Veeam Self-Service Backup Portal