NetBackup and Veritas Appliances Hardening Guide

Ensure that you meet the following prerequisites:

• The malware tool must be installed and configured.

• The scan host must have a share type configured, that is, an NFS or SMB client.

• The scan host must be reachable from the media server over SSH.

  Note:

  SSH connection to scan host from the media server must be successful.

• OpenSSH must be configured on windows scan host.

  Note the following:

  • For Windows 2016, get OpenSSH from GIT hub repository and for Windows 2019, enable OpenSSH server feature. For more details, refer to Microsoft documentation.

  • Microsoft Visual C/C++ Redistributable is an additional dependency if media server is updated to 10.1.1.

    Visual C/C++ run-time library DLL is required to execute nbmalwareutil utility on windows scan host. The runtime DLL can be obtained from Microsoft Visual C++ Redistributable latest supported downloads.

• The minimum required configuration for the scan host is 8 CPU and 32-GB RAM.

• NetBackup footprint is not required on the scan host. The existing systems with the NetBackup client or media server can be used as scan host, too.

• For the supported operating systems of the scan host, refer Software Compatibility List.

• For NetBackup malware detection utility to execute on scan host, install libnsl.so.1 library on scan host. If the latest version of libnsl library file is present (for example, /usr/lib64/libnsl.so.2), then create a softlink file /usr/lib64/libnsl.so.1 which points to /usr/lib64/libnsl.so.2 file.

  Example for creating softlink file:

  # cd /usr/lib64 # ln -sf libnsl.so.2 libnsl.so.1

  Note:

  For assistance on installing libnsl* library file, contact operating system administrator.

• Allow ssh connection using non-root user.

  For example: Add the Allow Users root scanuser entry in the /etc/ssh/sshd_config file.

  Note:

  Scanuser is a non-root user created in the system.

• Provide user permission to mount and umount. Add user permission entry in sodoers file.

  For example: In the /etc/sudoers file add one of the following:

  • scanuser ALL=(ALL) NOPASSWD:ALL

  • scanuser ALL=(ALL) NOPASSWD:/bin/umount, /bin/mount

• Configure malware tool using non-root user on the scan host.

  Note:

  If scanning is done using root user, then change the permission of the /tmp/malware folder to provide write permissions to the non-root user.

  Note:

  For example: chmod a+rwx /tmp/malware