Blog

You are currently viewing Veeam Proxmox Virtual Environment Plugin v12.1.3.197: Enhancements to Non-Root Permissions, SOSAPI Integration, and More

Veeam Proxmox Virtual Environment Plugin v12.1.3.197: Enhancements to Non-Root Permissions, SOSAPI Integration, and More

Veeam has released an important update to its Proxmox Virtual Environment Plugin with newly released version 12.1.3.197, bringing significant improvements in non-root user support, SOSAPI integration, and Proxmox networking compatibility. This update refines the initial release, addressing security, usability, and compatibility with the latest Proxmox versions.

Key Enhancements in the Latest Update

Strengthened Non-Root User Permissions

Previously, Veeam’s Proxmox VE Plugin required root privileges, raising security concerns for many administrators. The latest update improves the implementation of non-root access, ensuring a more secure and controlled backup process.

Updated Non-Root Configuration Steps

If you haven’t already switched to non-root access, here’s how you can do so with the latest update. For this example, we are following in Veeam’s KB sample and utilizing a user called veeamdep.

1. Create the Dedicated Veeam User

On each Proxmox node, execute the following commands. This will install the sudo package, create a new user, and prompt you for the password for said user.

apt-get install sudo
useradd -s /bin/bash veeamdep
passwd veeamdep

2. Set Sudoers Permissions

Next, we set granular permissions for the new user. We could just give the user sudo rights, but this is more secure. Using visudo, add or update the following entries in /etc/sudoers:

veeamdep ALL=(root) PASSWD: /usr/sbin/dmidecode -s system-uuid
veeamdep ALL=(root) PASSWD: /usr/bin/kvm -S *
veeamdep ALL=(root) PASSWD: /usr/bin/qemu-img info *
veeamdep ALL=(root) PASSWD: /usr/bin/qemu-img create *
veeamdep ALL=(root) PASSWD: /usr/sbin/qm create *
veeamdep ALL=(root) PASSWD: /usr/sbin/qm ^showcmd [0-9]+ --pretty$
veeamdep ALL=(root) PASSWD: /usr/sbin/qm ^unlock [0-9]+$
veeamdep ALL=(root) PASSWD: /usr/bin/socat ^TCP-LISTEN:[0-9]+,bind=127\.0\.0\.1 UNIX-CONNECT:/[a-zA-Z0-9_./-]+$
veeamdep ALL=(root) PASSWD: /usr/bin/mkdir -p /var/lib/vz/snippets/
veeamdep ALL=(root) PASSWD: /usr/bin/pvenode cert info --output-format json
veeamdep ALL=(root) PASSWD: /usr/bin/pvesh ^get storage/([a-zA-Z0-9_-]+) --output json$
veeamdep ALL=(root) PASSWD: /usr/bin/pvesh ^set /nodes/([a-zA-Z0-9_-]+)/qemu/([0-9]+)/config --lock ([a-zA-Z]+)$
veeamdep ALL=(root) PASSWD: /usr/bin/pkill -9 -e -f -x socat *
veeamdep ALL=(root) PASSWD: /usr/sbin/lvchange -ay *
veeamdep ALL=(root) PASSWD: /usr/sbin/lvchange -an *
veeamdep ALL=(root) PASSWD: /usr/bin/rbd device map *
veeamdep ALL=(root) PASSWD: /usr/bin/mv ^-n /tmp/([a-zA-Z0-9_-]+\.config) /var/lib/vz/snippets/([a-zA-Z0-9_-]+\.config)$
veeamdep ALL=(root) PASSWD: /usr/bin/rm ^/[a-zA-Z0-9_/-]+/VeeamTmp[a-zA-Z0-9_.-]+$
veeamdep ALL=(root) PASSWD: /usr/bin/rm ^-f /[a-zA-Z0-9_/-]+/VeeamTmp[a-zA-Z0-9_.-]+$
veeamdep ALL=(root) PASSWD: /usr/bin/rm ^-f /var/lib/vz/snippets/[a-zA-Z0-9_-]+\.config$
veeamdep ALL=(root) PASSWD: /usr/bin/rm ^-f /var/lib/vz/template/iso/[a-zA-Z0-9_.-]+\.img$

3. Configure Proxmox Access for the Service Account

Next, we have to configure Proxmox permissions to ensure the newly created user can access Proxmox itself and not just the host OS:

  1. Create the Proxmox Veeam User
    • Navigate to Datacenter > Permissions > Users > Add in the Proxmox Web UI.
    • Create a new user, setting the user name as the newly created user. Ensure the realm is set to Linux PAM. Click the Add button.
  1. Assign Necessary Permissions
    • Go to Datacenter > Permissions > Add > User Permission.
    • Set the path as root (/).
    • Select the newly created user.
    • Assign the Administrator role. Click the Add button.

4. Configure Veeam Backup & Replication

  1. In Veeam Backup & Replication, navigate to Backup Infrastructure > Backup Infrastructure, select your Proxmox server, and select Edit Server or Properties… to edit the configuration.
  2. Under Credentials, add the account or edit the existing root account entry. Set the username and password.
  3. Select “Elevate account privileges automatically”.
  1. Click Finish to save the changes.

SOSAPI Integration

The latest update introduces support for the SOSAPI (Smart Object Storage API), allowing Proxmox VE backups to leverage enhanced object storage interactions. The SOSAPI enables deeper integration between Veeam Backup & Replication and supported object storage solutions, resulting in improved backup performance and management.

Key benefits of SOSAPI support include:

  • Efficient Storage Utilization – Veeam can now retrieve and process metadata directly from the storage layer, reducing overhead and improving data transfer efficiency.
  • Optimized Backup Operations – Instead of relying on traditional S3 API calls, Veeam now uses extended SOSAPI capabilities for streamlined snapshot handling and data integrity verification.
  • Improved Monitoring and Reporting – With the SOSAPI, Veeam gains enhanced visibility into storage health metrics, allowing better decision-making for backup retention and restoration processes.

This integration ensures faster, more reliable backups, reducing strain on Proxmox environments while improving overall backup efficiency.

Open vSwitch Support

The latest update brings official Veeam support for Open vSwitch (OVS) in Proxmox, ensuring smooth backup and restore operations for environments utilizing OVS. Designed for virtualized infrastructure, Open vSwitch offers advanced networking capabilities that allow for greater flexibility in managing virtual machine traffic.

What This Means for Proxmox Users

  • Ensured Backup Compatibility – Veeam now officially supports OVS-based networking configurations, ensuring that network settings remain consistent during backup and restore operations.
  • Support for PVE Workers – Previously, when deploying Proxmox workers for Veeam to utilize, you could not select OVS networks during the configuration process, they had to be configured manually after deployment. This should now be rectified.

Looking Toward Software Defined Networking (SDN)

While Open vSwitch continues to be widely used, Proxmox is increasingly recommending Software Defined Networking (SDN) as the preferred approach for managing virtualized network infrastructure. SDN provides:

  • Simplified Network Management – Centralized control over VLANs, VXLANs, and firewall rules.
  • Greater Automation – Enabling dynamic provisioning and scaling of network resources.
  • Optimized Performance – Designed to support complex network architectures with better efficiency.

For organizations currently relying on Open vSwitch, considering a shift toward SDN could provide long-term benefits in terms of scalability and automation while maintaining full compatibility with Veeam backup operations.

Resolved Issues

Restored VM OS Type Correction

In previous versions, virtual machines restored from backups created on different hypervisors would sometimes be misidentified as having an ‘other’ OS type. This update ensures that VMs restored to Proxmox VE now accurately reflect the operating system of the original backup, improving compatibility and reducing post-restore configuration work.

PCIe Passthrough Device Handling

Previously, backups of powered-off virtual machines with PCIe passthrough devices failed due to processing issues. With this update, the backup job now correctly skips passthrough devices rather than causing the entire backup to fail. Since these devices are not automatically restored, administrators should manually reattach them post-recovery as needed.

Linked Clone Backup Fix

Backups of linked clones previously only captured the base disk, leading to incomplete snapshots without delta changes. To prevent users from relying on incomplete backups, the updated backup engine now blocks backup jobs for linked clones, ensuring administrators are aware of the limitation and can take appropriate steps to safeguard their data.

Final Thoughts

The latest Veeam Proxmox Virtual Environment Plugin update brings meaningful improvements to security, performance, and backup efficiency. With non-root user support, administrators can now implement a more secure configuration without compromising functionality. The introduction of SOSAPI support ensures more efficient and performant storage utilization, while official Open vSwitch support enhances networking compatibility for Proxmox users.

In addition, the update introduces Nested Pools support, allowing for better management of nested virtualized environments, and backup engine enhancements, leveraging multi-threading to improve performance and reduce backup times. These features streamline backup and recovery operations, making them faster and more reliable.

Furthermore, several critical issues have been addressed, including proper OS-type restoration when migrating from other hypervisors, improved handling of PCIe passthrough devices, and better management of linked clones to ensure data integrity.

If you haven’t updated yet, now is the time to take advantage of these enhancements. For full details, refer to the official Veeam KB articles:

Jonah May

Hey there! I’m Jonah May, a Product Architect and Product Engineering Manager at CyberFortress, a Platinum VCSP dedicated to keeping data safe and recoverable. When I’m not working on backup strategies and automation, you’ll find me deeply involved in the Veeam community—as a Veeam Vanguard, Veeam Certified Architect, VCSP Technical Ambassador, and co-founder of the Veeam Community Hackathon. I also help lead the Texas and Automation Desk Veeam User Groups, where we nerd out over all things backup, automation, and infrastructure.Beyond tech, I’m a Scout leader, having earned my Eagle Scout back in the day. I love sharing knowledge, solving problems, and making technology work smarter, not harder. If you’re into Veeam, automation, or home labs, let’s connect!

Leave a Reply