Veeam Plug-in for Proxmox VE 13.2.0.457 — Updated Granular Permissions, Proxmox VE 9.0 Support, Malware Detection, and Application Aware Processing

  • Post author:
  • Post category:Veeam
  • Reading time:6 mins read

Veeam has released a major update to its Proxmox Virtual Environment Plug-in with version 13.2.0.457, included in Veeam Backup & Replication v13/v13.0.1. Building on the earlier V12.1.3.197 release, this new version expands support for Proxmox VE 9.0, adds inline malware detection, introduces application-aware backups, and updates the granular permissions model introduced previously.

If you implemented non-root access in V12.1, this release includes important changes you will want to apply. And if you’re still running backups using root access, now is the time to take advantage of a more secure, least-privileged configuration.

Key Enhancements in 13.2.0.457

Full Proxmox VE 9.0 Support

The plug-in now fully supports Proxmox VE 9.0, including updated QEMU components, kernel improvements, modern storage drivers, and enhanced configuration APIs. This ensures seamless integration for new clusters or nodes upgraded to 9.x.

Application-Aware Processing

Backing up Microsoft workloads inside Proxmox VMs is now more reliable thanks to support for Microsoft VSS, allowing for:

  • VSS-based freeze/thaw operations
  • Crash-consistent backups of workloads such as Active Directory, Microsoft SQL, Exchange, and PostgreSQL
  • Timeout handling during snapshots
  • Integration with Veeam Explorers for granular restore

This aligns Proxmox support more closely with VMWare and Hyper-V for app-consistent backups.

Malware Detection & Security Enhancements

One of the most significant additions in V13 is the addition of malware detection for Proxmox VM backups:

  • Inline malware scanning during backup
  • Suspicious behavior monitoring
  • YARA post-backup scanning
  • Threat Hunter integration
  • Incident API visibility

When combined with immutable storage, this gives Proxmox deployments the same ransomware-resilient backup strategy available to other hypervisors.

Updated Non-Root & Granular Permissions (Changes from 12.1.3)

Granular sudo permissions were originally introduced in V12.1.3.197, reducing the need for root access on the Proxmox host. With the 13.2.0.457 plug-in, the sudo command list has been expanded and updated to support new snapshot logic, metadata retrieval, and malware-detection workflows.

If you implemented the previous version, you must update your sudoers file to avoid backup failures.

At the same time, it’s important to note that Proxmox UI permissions have NOT changed. Proxmox API operations still require assigning the built-in Administrator role in the Proxmox UI.

This is a hybrid security model:

  • Linux host privileges are restricted through sudo
  • Proxmox API privileges still require the Administrator role

Below are the updated V13 steps.

Step-by-Step: Updating sudo for V13.2.0.457

These steps are run on each Proxmox node while logged in as root.

1. Verify sudo version

Veeam now requires:

  • sudo 1.9.10 or newer

Check version:

sudo --version

Install/upgrade if needed:

apt update && apt install sudo -y

2. Create (or verify) the Veeam service user

If you already created veeamdep in V12.1, you can reuse it.

useradd -s /bin/bash veeamdep
passwd veeamdep

3. Update the granular sudoers file

Open the sudoers file:

visudo -f /etc/sudoers.d/veeamdep

Paste the updated V13.2 command list:

# the account used by Veeam must have PASSWD set; do _not_ use NOPASSWD.
veeamdep ALL=(root) PASSWD: /usr/sbin/dmidecode -s system-uuid
veeamdep ALL=(root) PASSWD: /usr/bin/kvm -S *,!/usr/bin/kvm -S *-netdev*,!/usr/bin/kvm -S *-fsdev*,!/usr/bin/kvm -S *netdev=*,!/usr/bin/kvm -S *fsdev=*,!/usr/bin/kvm -S *-net*,!/usr/bin/kvm -S *net=*
veeamdep ALL=(root) PASSWD: /usr/bin/qemu-img info *
veeamdep ALL=(root) PASSWD: /usr/bin/qemu-img create *
veeamdep ALL=(root) PASSWD: /usr/sbin/qm create *,!/usr/sbin/qm create * --hookscript*
veeamdep ALL=(root) PASSWD: /usr/sbin/qm ^showcmd [0-9]+ --pretty$
veeamdep ALL=(root) PASSWD: /usr/sbin/qm ^unlock [0-9]+$
veeamdep ALL=(root) PASSWD: /usr/bin/socat ^TCP-LISTEN:[0-9]+,bind=127\.0\.0\.1 UNIX-CONNECT:/[a-zA-Z0-9_./-]+$
veeamdep ALL=(root) PASSWD: /usr/bin/mkdir -p /var/lib/vz/snippets/
veeamdep ALL=(root) PASSWD: /usr/bin/pvenode cert info --output-format json
veeamdep ALL=(root) PASSWD: /usr/bin/pvesh ^get storage/([a-zA-Z0-9_-]+) --output json$
veeamdep ALL=(root) PASSWD: /usr/bin/pvesh ^set /nodes/([a-zA-Z0-9_-]+)/qemu/([0-9]+)/config --lock ([a-zA-Z]+)$
veeamdep ALL=(root) PASSWD: /usr/bin/pkill -9 -e -f -x socat *
veeamdep ALL=(root) PASSWD: /usr/sbin/lvchange -ay *
veeamdep ALL=(root) PASSWD: /usr/sbin/lvchange -an *
veeamdep ALL=(root) PASSWD: /usr/bin/rbd device map *
veeamdep ALL=(root) PASSWD: /usr/bin/mv ^-n /tmp/([a-zA-Z0-9_-]+\.config) /var/lib/vz/snippets/([a-zA-Z0-9_-]+\.config)$
veeamdep ALL=(root) PASSWD: /usr/bin/rm ^(/[a-zA-Z0-9_/-]+/VeeamTmp[a-zA-Z0-9_.-]+\s*)+$
veeamdep ALL=(root) PASSWD: /usr/bin/rm ^-f /[a-zA-Z0-9_/-]+/VeeamTmp[a-zA-Z0-9_.-]+$
veeamdep ALL=(root) PASSWD: /usr/bin/rm ^-f /var/lib/vz/snippets/[a-zA-Z0-9_-]+\.config$
veeamdep ALL=(root) PASSWD: /usr/bin/rm ^-f /var/lib/vz/template/iso/[a-zA-Z0-9_.-]+\.img$

4. Install required dependencies

apt update && apt install dmidecode -y

Missing dmidecode is one of the most common causes of credential validation errors.

Configuring Proxmox Permissions

While sudo handles Linux host operations, Proxmox API interactions still require full administrative privileges.

This has not changed in the new release.

1. Create the Proxmox User

In the Proxmox UI:

Datacenter → Permissions → Users → Add

  • User: veeamdep
  • Realm: Linux PAM
  • Enabled: Yes

2. Assign the Administrator Role

Even with V13, the correct and required configuration is:

Datacenter → Permissions → Add → User Permission

  • User: veeamdep@pam
  • Path: /
  • Role: Administrator
  • Propagate: Enabled

Why?

Because Veeam needs to perform:

  • VM inventory and enumeration
  • Storage queries
  • Config retrieval via pvesh
  • Locks/unlocks
  • Snapshot metadata operations
  • SDN/OVS lookups

These require full API access.

The granular model applies only to sudo on the host, not to Proxmox API roles.

3. Veeam Credential Settings

When adding credentials in Veeam:

  • Username: veeamdep
  • Password: Linux user password
  • Do NOT enable: “Add account to the sudoers file”
  • Do NOT enable: “Use su if sudo fails”

These would override or invalidate your granular configuration.

Final Thoughts

Version 13.2.0.457 of Veeam’s Proxmox plugin is a meaningful step forward for Veeam + Proxmox users. With support for Proxmox VE 9.0, expanded malware detection, improved application-aware processing,, this release improves data resiliency and brings Proxmox closer to feature parity with Veeam’s VMware and Hyper-V capabilities.

If you already configured non-root access in V12.1, this update requires adjusting your sudoers file to align with the new command set. If you’re still using root access, now is the best time to migrate to the Veeam-recommended secure configuration.

For more details, refer to:

Jonah May

Hey there! I’m Jonah May, a Product Architect and Product Engineering Manager at CyberFortress, a Platinum VCSP dedicated to keeping data safe and recoverable. When I’m not working on backup strategies and automation, you’ll find me deeply involved in the Veeam community—as a Veeam Vanguard, Veeam Certified Architect, VCSP Technical Ambassador, and co-founder of the Veeam Community Hackathon. I also help lead the Texas and Automation Desk Veeam User Groups, where we nerd out over all things backup, automation, and infrastructure.Beyond tech, I’m a Scout leader, having earned my Eagle Scout back in the day. I love sharing knowledge, solving problems, and making technology work smarter, not harder. If you’re into Veeam, automation, or home labs, let’s connect!