NetBackup and Veritas Appliances Hardening Guide

Last Published:
Product(s): Appliances (10.2, 5.1.1, 3.0), NetBackup (10.2, 5.1.1, 3.0)
Platform: NetBackup Appliance OS,Flex Appliance OS,Linux,UNIX,Windows
  1. Top recommendations to improve your NetBackup and Veritas appliances security posture
    1.  
      Introduction
    2.  
      Keeping all systems and software updated
    3.  
      Enabling multifactor authentication
    4.  
      Increasing the appliance security level
    5.  
      Implementing an immutable data vault
    6.  
      Securing credentials
    7.  
      Reducing network exposure
    8.  
      Enabling encryption
    9.  
      Enabling catalog protection
    10.  
      Enabling malware scanning and anomaly detection
    11.  
      Enabling security observability
    12.  
      Restricting user access
    13.  
      Configuring a sign-in banner
  2. Steps to protect Flex Appliance
    1.  
      About Flex Appliance hardening
    2. Managing single sign-on (SSO)
      1.  
        Managing identity providers (IDPs)
      2.  
        Importing single sign-on (SSO) users
    3.  
      Managing user authentication with smart cards or digital certificates
    4. About lockdown mode
      1.  
        Changing the lockdown mode
    5.  
      Using network access control
    6.  
      Using an external certificate
    7.  
      Forwarding logs
    8.  
      Creating a NetBackup WORM storage server instance
    9. Configuring an isolated recovery environment on a WORM storage server
      1.  
        Configuring data transmission between a production environment and an IRE WORM storage server
    10.  
      Protecting the NetBackup catalog on a WORM storage server
    11.  
      Using a sign-in banner
  3. Steps to protect NetBackup Appliance
    1.  
      About NetBackup Appliance hardening
    2. About single sign-on (SSO) authentication and authorization
      1.  
        Configure single sign-on (SSO) for a NetBackup Appliance
    3. About authentication using smart cards and digital certificates
      1.  
        2FA
      2.  
        Smart card Authentication for NetBackup Web UI
      3.  
        Smart card authentication for NetBackup Appliance Web UI
      4.  
        Smart card authentication for NetBackup Appliance Shell Menu
      5.  
        Configure role-based access control
      6.  
        Configure authentication for a smart card or digital certificate for the NetBackup Web UI
    4.  
      Disable user access to the NetBackup appliance operating system
    5.  
      About Network Access Control
    6. About data encryption
      1.  
        KMS support
    7.  
      FIPS 140-2 conformance for NetBackup Appliance
    8.  
      About implementing external certificates
    9. About forwarding logs to an external server
      1.  
        Uploading certificates for TLS
      2.  
        Enabling log forwarding
    10.  
      Creating the appliance login banner
  4. Steps to protect NetBackup
    1.  
      About NetBackup hardening
    2. Configure NetBackup for single sign-on (SSO)
      1.  
        Configure the SAML KeyStore
      2.  
        Configure the SAML keystore and add and enable the IDP configuration
      3.  
        Enroll the NetBackup primary server with the IDP
    3. Configure user authentication with smart cards or digital certificates
      1.  
        Configure smart card authentication with a domain
      2.  
        Configure smart card authentication without a domain
    4. Access codes
      1.  
        Get CLI access through web UI authentication
      2.  
        Approve your CLI access request
      3.  
        Approve CLI access requests of other users
    5. Workflow to configure immutable and indelible data
      1.  
        About configuring disk pool storage
      2.  
        Use WORM setting
      3.  
        Creating a backup policy
    6. Add a configuration for an external CMS server
      1.  
        Add a credential for CyberArk
    7. Configuring an isolated recovery environment on a NetBackup BYO media server
      1.  
        Configuring AIR for replicating backup images from production environment to IRE BYO environment
    8. About FIPS support in NetBackup
      1.  
        Enable FIPS mode on NetBackup during installation
      2.  
        Enable FIPS mode on a NetBackup host after installation
      3.  
        Enable FIPS mode for the NetBackup Authentication Broker service
      4.  
        Enable FIPS mode for the NetBackup Administration Console
      5.  
        NB_FIPS_MODE option for NetBackup servers and clients
    9.  
      Installing KMS
    10. Workflow for external KMS configuration
      1.  
        Validating KMS credentials
      2.  
        Configuring KMS credentials
      3.  
        Configuring KMS
      4.  
        Creating keys in an external KMS
      5. Workflow to configure data-in-transit encryption
        1.  
          Configure the global data-in-transit encryption setting
        2. Configure the DTE mode on a client
          1.  
            DTE_CLIENT_MODE for clients
        3. How DTE configuration settings work in various NetBackup operations
          1.  
            Backup
          2.  
            Restore
          3.  
            MSDP backup, restore, and optimized duplication
          4.  
            Universal-Share policy backup
          5.  
            Catalog backup and recovery
          6.  
            Duplication
          7.  
            Synthetic backup
          8.  
            Verify
          9.  
            Import
          10.  
            Replication
        4.  
          Configure the DTE mode on the media server
        5. Modify the DTE mode on a backup image
          1.  
            DTE_IGNORE_IMAGE_MODE for NetBackup servers
    11. Workflow to use external certificates for NetBackup host communication
      1. About certificate revocation lists for external CA
        1.  
          How CRLs from ECA_CRL_PATH are used
        2.  
          How CRLs from CDP URLs are used
      2.  
        Configuring an external certificate for the NetBackup web server
      3.  
        Configuring the primary server to use an external CA-signed certificate
      4. Configuring an external certificate for a clustered primary server
        1. Configuration options for external CA-signed certificates for a virtual name
          1.  
            CLUSTER_ECA_CERT_PATH for clustered primary server
          2.  
            CLUSTER_ECA_TRUST_STORE_PATH for clustered primary server
          3.  
            CLUSTER_ECA_PRIVATE_KEY_PATH for clustered primary server
          4.  
            CLUSTER_ECA_KEY_PASSPHRASEFILE for clustered primary server
      5. Configuring a NetBackup host (media server, client, or cluster node) to use an external CA-signed certificate after installation
        1.  
          Enrolling an external certificate for a remote host
      6. Configuration options for external CA-signed certificates
        1. ECA_CERT_PATH for NetBackup servers and clients
          1.  
            Specifying Windows certificate store for ECA_CERT_PATH
        2.  
          ECA_TRUST_STORE_PATH for NetBackup servers and clients
        3.  
          ECA_PRIVATE_KEY_PATH for NetBackup servers and clients
        4.  
          ECA_KEY_PASSPHRASEFILE for NetBackup servers and clients
        5.  
          ECA_CRL_CHECK for NetBackup servers and clients
        6.  
          ECA_CRL_PATH for NetBackup servers and clients
        7.  
          ECA_CRL_PATH_SYNC_HOURS for NetBackup servers and clients
        8.  
          ECA_CRL_REFRESH_HOURS for NetBackup servers and clients
        9.  
          ECA_DISABLE_AUTO_ENROLLMENT for NetBackup servers and clients
        10.  
          ECA_DR_BKUP_WIN_CERT_STORE for NetBackup servers and clients
        11.  
          MANAGE_WIN_CERT_STORE_PRIVATE_KEY option for NetBackup primary servers
    12.  
      Guidelines for managing the primary server NetBackup catalog
    13. About protecting the MSDP catalog
      1. About the MSDP shadow catalog
        1.  
          Changing the MSDP shadow catalog path
        2.  
          Changing the MSDP shadow catalog schedule
        3.  
          Changing the number of MSDP catalog shadow copies
      2.  
        About the MSDP catalog backup policy
    14. How to set up malware scanning
      1.  
        Prerequisites for a scan host
      2.  
        Configuring a new scan host pool
    15. About backup anomaly detection
      1.  
        Detecting backup anomalies on the primary server
      2.  
        Detecting backup anomalies on the media server
      3.  
        Configure anomaly detection settings
      4.  
        View anomalies
    16.  
      Send audit events to system logs
    17.  
      Send audit events to log forwarding endpoints
    18.  
      Display a banner to users when they sign in

KMS support

NetBackup Appliance supports encryption that is managed by NetBackup Key Management Service (KMS) which is integrated with NetBackup Enterprise Server 7.1. KMS is supported on primary and media server appliances. Regenerating the data encryption key is the only supported method of recovering KMS on an appliance primary server.

The following describes the KMS key features:

  • Does not require an additional license.

  • Is a primary server-based symmetric key management service.

  • Can be administered as a primary server with tape devices connected to it or to another NetBackup Appliance.

  • Manages symmetric cryptography keys for tape drives that conform to the T10 standard (such as LTO4 or LTO5).

  • Designed to use volume pool-based tape encryption.

  • Can be used with tape hardware that has built-in hardware encryption capability.

  • Can be managed by a NetBackup CLI administrator using the NetBackup Appliance Shell Menu or the KMS Command Line Interface (CLI).

About the keys used under KMS

The KMS generates keys from passcodes or auto-generates keys. Table: KMS files lists the associated KMS files that hold the information about the keys.

Table: KMS files

KMS files

Description

Keystore file

The keystore file (KMS_DATA) contains all of the key group and key records, along with some metadata.

KPK file

The KPK file (KMS_KPKF) contains the KPK that is used to encrypt the ciphertext portions of the key records that are stored in the keystore file.

HMK file

The HMK file (KMS_HMKF) contains the HMK that is used to encrypt the entire contents of the keystore file. The keystore file header is an exception. It contains some metadata like the KPK ID and the HMK ID, which is not encrypted.

Configuring KMS

To configure KMS on an appliance primary server, you must log in as a NetBackupCLI user.

Before you proceed, ensure that the NetBackupCLI user is assigned the required RBAC permissions to configure and enable KMS. Use a NetBackup administrator account such as nbasecadmin to log in to the NetBackup Web UI and assign the Default Security Administrator role to the NetBackupCLI user.

For steps on managing role-based access control, see the NetBackup Web UI Administrator's Guide.

Note:

If required, you can create a new NetBackupCLI user for configuring and enabling KMS. For more information about the NetBackupCLI user,

The following describes how to configure and enable KMS on an appliance.

To configure and enable KMS on an appliance

  1. Log in to the appliance primary server as a NetBackupCLI user.
  2. Enter into a restricted shell environment by using the Command command as follows:

    [nb-appliance.NBCLIUSER>]# Command

  3. Authenticate your CLI access using the following steps:

    • Generate an access code by running the following command:

      #bpnbat -login -logintype webui -requestApproval

      Make a note of the access code that is displayed in the command window.

    • Sign in to the NetBackup web UI as a NetBackup Command Line (CLI) Admin user and approve the CLI access request by entering the access code that you generated earlier.

      Once the request is approved, you will see a confirmation message in the restricted shell command window.

    For more information about access key and approval requests, refer to the NetBackup Security and Encryption Guide.

  4. Create an empty database using the nbkms command, as follows:

    [nbucliuser-!>]# nbkms -createemptydb

  5. Start nbkms. For example:

    [nbucliuser-!>]# nbkms

  6. Create a Key group. For example:

    [nbucliuser-!>]# nbkmsutil -createkg -kgname KMSKeyGroupName

  7. Create an active key. For example:

    [nbucliuser-!>]# nbkmsutil -createkey -kgname KMSKeyGroupName -keyname KMS KeyName

Enabling KMS encryption for MSDP

Verify that KMS is configured and running on the primary server. You can then enable KMS encryption for MSDP on all of the media servers that are associated with the primary server.

Before you proceed, ensure that the NetBackupCLI user is assigned the required RBAC permissions to configure and enable KMS. Use a NetBackup administrator account such as nbasecadmin to log in to the NetBackup Web UI and assign the Default Security Administrator role to the NetBackupCLI user.

For steps on how to manage role-based access control, see the NetBackup Web UI Administrator's guide.

Note:

If required, you can create a new NetBackupCLI user for configuring and enabling KMS. For more information about the NetBackupCLI user,

The following describes how to enable KMS encryption for MSDP on an appliance.

To enable KMS encryption for MSDP

  1. Log in to the appliance media server as a NetBackupCLI user.
  2. Change the following options in the order as shown:

    • nbucliuser-!> pdcfg --write=/msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=KMSOptions --option=KMSType --value=0

    • nbucliuser-!> pdcfg --write=/msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=KMSOptions --option=KMSServerName --value=<primary server hostname

    • nbucliuser-!> pdcfg --write=/msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=KMSOptions --option=KMSKeyGroupName --value=msdp

    • nbucliuser-!> pdcfg --write=/msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=KMSOptions --option=KeyName --value=<KMS KeyName>

    • nbucliuser-!> pdcfg --write=/msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=KMSOptions --option=KMSEnable --value=true

    • nbucliuser-!> pdcfg --write= /msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=ContentRouter --option=ServerOptions --value=verify_so_references,fast,encrypt

      Repeat this step on all media servers that are associated with the primary server.

  3. Identify yourself to the system by logging on to the NetBackup web application. Run the following command:

    sudo /usr/openv/netbackup/bin/bpnbat -login -loginType WEB

    Authentication Broker: ApplianceHostname

    Authentication Port: 0

    Authentication Type: unixpwd

    LoginName: Username

    Password: Password

  4. Ensure that the KMS is registered with NetBackup Web Service.

    sudo /usr/openv/netbackup/bin/nbkmscmd -discoverNbkms

  5. Stop and restart the NetBackup services with the following commands:

    • bp.kill_all

    • bp.start_all

  6. To verify that KMS encryption for MSDP is enabled on the media server, run a backup job on the server, then run the following command:

    crcontrol --getmode