Veritas NetBackup™ Appliance Security Guide
- About the NetBackup appliance Security Guide
- User authentication
- About user authentication on the NetBackup appliance
- About configuring user authentication
- About authenticating LDAP users
- About authenticating Active Directory users
- About authentication using smart cards and digital certificates
- About authenticating Kerberos-NIS users
- About the appliance login banner
- About user name and password specifications
- User authorization
- Intrusion prevention and intrusion detection systems
- About Symantec Data Center Security on the NetBackup appliance
- About the NetBackup appliance intrusion prevention system
- About the NetBackup appliance intrusion detection system
- Reviewing SDCS events on the NetBackup appliance
- Running SDCS in unmanaged mode on the NetBackup appliance
- Running SDCS in managed mode on the NetBackup appliance
- Log files
- Operating system security
- Data security
- Web security
- Network security
- Call Home security
- Remote Management Module (RMM) security
- STIG and FIPS conformance
- Appendix A. Security release content
- Index
Log Forwarding feature overview
The Log Forwarding feature lets you send appliance logs to an external log management server. Starting with software version 3.0, NetBackup appliances support forwarding syslogs. A syslog is an OS system log that contains user and system level activities in the form of events. Use this feature to help increase security and to help achieve general compliance initiatives such as HIPPA, SOX, and PCI. The currently supported log management servers are HP ArcSight and Splunk.
NetBackup appliances use the Rsyslog client to forward logs. In addition to HP ArcSight and Splunk, other log management servers that support the Rsyslog client can also be used to receive syslogs from the appliance. Refer to the log management server documentation to verify Rsyslog client support.
To secure the log transmission from the appliance to the log management server, you can use the TLS (Transport Layer Security) option. NetBackup appliance currently supports only TLS Anonymous Authentication for log forwarding.
To enable TLS, the appliance and the log management servers each require unique preparation as follows:
Appliance requirements
Before you configure and enable the log forwarding feature, the appliance requires the following certificate and private key files in the X.509 file format:
ca-server.pemA root CA certificate from which the log management server certificate is derived.
nba-rsyslog.pemA certificate for the appliance to communicate with a log management server, that also includes any intermediary CA certificates.
nba-rsyslog.keyA private key that corresponds to the certificate used to communicate with the
syslogmanagement server.
You can upload these files to the appliance through an NFS or a CIFS share.
Configuration requirements for HP ArcSight servers
You must set up an Rsyslog server with TLS settings on the HP ArcSight server to receive encrypted logs from the appliance. Then, configure the Rsyslog server to forward the decrypted logs to the HP ArcSiight server. See the www.rsyslog.com website for guides on setup and configuration.
Configuration requirements for Splunk servers
You must first configure TLS on these servers, and then configure the log forwarding feature on the appliance. Refer to your Splunk documentation for the appropriate TLS configuration details.
The feature must be configured from the shell menu with the following Main > Settings > LogFowarding command options:
LogForwarding Enable
Configures the feature functionality.
LogForwarding Disable
Deletes the configuration and disables the feature.
LogForwarding Interval
Sets how often logs are forwarded. Select from 0 (continuous), 15, 30, 45, or 60 minutes.
If STIG is enabled on the appliance, you cannot manually configure the Log Forwarding interval.
LogForwarding Share
Opens or closes an NFS or a CIFS share on the appliance for obtaining the required certificate and private key files. The share paths are the following:
NFS:
<appliance.name>:/inst/logforwardingCIFS:
\\<appliance.name>\logforwardingLogForwarding Show
Shows the current configuration and status.
After you enter the LogForwarding > Enable command, prompts appear to guide you through the configuration as described in the following table:
Table: LogForwarding > Enable command prompts
Prompt | Description |
|---|---|
Server name or IP | Enter the name or the IP address of the external log management server. |
Server port | Enter the appropriate port number on the external log management server. |
Protocol | Select either UDP or TCP. |
Interval | Set how often logs are forwarded. |
Enable TLS | Select to enable TLS for secure log transmissions to the log management server. Currently, only the X.509 file format is supported. The following certificate and private key files must be uploaded to the appliance to use TLS:
|
For complete configuration and command information, refer to the following documents:
NetBackup Appliance Administrator's Guide
NetBackup Appliance Commands Reference Guide