Veritas NetBackup™ Appliance Security Guide

To install certificate files to the existing Java KeyStore and TrustStore in NetBackup Appliance, perform the following steps:

1. Log on to the maintenance account using SSH and override the Symantec Data Center Security protection.
2. Log on to the appliance using the root account.
3. Copy the appliance host certificate, private key, and CA certificate files to a temporary directory such as /tmp.
4. Ensure that all certificate files are in X.509 PEM format. These files typically have a suffix of .pem or .cer. and contain a header line -----BEGIN CERTIFICATE----- at the beginning of the certificate. For a procedure to convert certificate files to the required format, see the Prerequisites section.
5. Convert the PEM formatted X.509 certificate (server.pem) and private key (serverkey.pem), to the PKCS#12 format using the CA certificate file cacerts.pem. Type the following command:

   openssl pkcs12 -export -in server.pem -inkey serverkey.pem -out server.p12 -name tomcat -CAfile cacerts.pem -caname root

   Note:

   When the OpenSSL command prompts for the import password, type the private key's passphrase. When it prompts for the export password, type appliance.

6. Copy the NetBackup Appliance's webservice KeyStore file to your working directory, as follows:

   cp /opt/apache-tomcat/security/keystore ./keystore

7. Import the PKCS#12 file (server.p12) to the Java KeyStore, type the following command:keytool -importkeystore -deststorepass appliance -destkeypass appliance -destkeystore keystore -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass appliance -alias tomcat

   To prevent any exceptions from occurring, ensure the following:

   • Specify appliance as the password for the -deststorepass and -destkeypass options. Note that only alphanumeric characters are supported for the password.

   • Specify tomcat for the -alias option.

8. Run the following command to ensure that all the DNS values are correctly applied to the entry in Java KeyStore.

   keytool -list -v -alias tomcat -keystore keystore -storepass appliance

9. At the bottom of the cacerts.pem certificate authority (CA) certificate file, ensure that you have included the chain of intermediary CA certificates (if any) up to the root CA certificate.
10. Import the CA certificate file cacerts.pem to the Java TrustStore. The Java TrustStore is used by the NetBackup Web Management Console. Type the following commands:

    keytool -import -noprompt -trustcacerts -file cacerts.pem -alias vxosrootcachain -keystore keystore -storepass appliance

    If the cacerts.pem file consists of multiple intermediary CA certificates, ensure that you split the certificates into separate files as indicated by the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags in the certificate. You can then run the command separately for each CA certificate file.

    keytool -import -noprompt -trustcacerts -file cacertn.pem alias vxosrootcachain[n] -keystore keystore -storepass appliance

    Where cacertn represents each of the individual certificate files (for example, cacert1.pem, cacert2.pem, ... , cacertn.pem.

1. Backup the existing web server KeyStore file using the following command

   cp /opt/apache-tomcat/security/keystore /opt/apache-tomcat/security/keystore.orig

2. Replace the existing KeyStore file with the new KeyStore file:

   cp ./keystore /opt/apache-tomcat/security/keystore

3. Set the permissions for the new KeyStore file using the following command:

   chmod 700 /opt/apache-tomcat/security
   chmod 600 /opt/apache-tomcat/security/keystore 
   chown -R tomcat:tomcat /opt/apache-tomcat/security 
   

1. Copy the certificate files to /etc/vxos-ssl/servers/certs.

   cp serverkey.pem /etc/vxos-ssl/servers/certs
   cp server.pem /etc/vxos-ssl/servers/certs
   cp cacerts.pem /etc/vxos-ssl/servers/certs
   

2. Concatenate the private key (serverkey.pem) and certificate (server.pem).

   cat /etc/vxos-ssl/servers/certs/server.pem >> 
   /etc/vxos-ssl/servers/certs/serverkey.pem

3. Set the required file permissions for the certificate files, as follows:

   chown root:infra /etc/vxos-ssl/servers/certs/serverkey.pem
   chown root:infra /etc/vxos-ssl/servers/certs/server.pem
   chown root:infra /etc/vxos-ssl/servers/certs/cacerts.pem
   
   chmod 440 /etc/vxos-ssl/servers/certs/serverkey.pem
   chmod 440 /etc/vxos-ssl/servers/certs/server.pem
   chmod 440 /etc/vxos-ssl/servers/certs/cacerts.pem
   

4. To ensure that the correct certificate files are used, check whether the names of the certificate files in /etc/vxos-ssl/servers/certs/ are in the short name format, rename the files to a fully qualified domain name (FQDN) format. For example, change <ServerName>.<DomainName>.com--self.cert.pem to <ServerName>--self.cert.pem. Use the following commands:

   rm /etc/vxos-ssl/servers/certs/<FQDN_hostname>-self.cert.pem
   
   cp /etc/vxos-ssl/servers/certs/<short_hostname>.cert.pem 
   /etc/vxos-ssl/servers/certs/<FQDN_hostname>-self.cert.pem
   
   tpconfig -delete -nb_appliance <short_hostname>

   check whether the certificate files in /etc/vxos-ssl/servers/certs/ are the same as /usr/openv/var/global/appliance_certificates/

1. Edit the line containing certificateKeyFile in /etc/mongod.conf, and add /etc/vxos-ssl/servers/certs/serverkey.pem.
2. Edit the line containing certificateKeyFilePassword in /etc/mongod.conf, and add the passphrase of the private key.
3. Edit /etc/vxos-ssl/cert.conf, and add the following:

   server_cert=/etc/vxos-ssl/servers/certs/serverkey.pem
   client_cert=/etc/vxos-ssl/servers/certs/cacerts.pem
   pem_password=<passphrase of the private key>
   

4. Type the following commands to start the mongodb and web service:

   /opt/IMAppliance/scripts/infraservices.sh database start 
   /opt/IMAppliance/scripts/infraservices.sh webserver start 

1. Ensure that /etc/nginx/conf.d/appsol.conf is writable.

   Edit the lines containing ssl_certificate and ssl_certificate_key to point to the certificates and private key (concatenated with the certificate):

   ssl_certificate /etc/vxos-ssl/servers/certs/server.pem;
   ssl_certificate_key /etc/vxos-ssl/servers/certs/serverkey.pem;
   

2. Ensure that /etc/nginx/locations/appsol.conf is writable.

   Edit the lines containing proxy_ssl_certificate and proxy_ssl_certificate_key to point to the certificates and private key (concatenated with the certificate):

   proxy_ssl_certificate /etc/vxos-ssl/servers/certs/server.pem;
   proxy_ssl_certificate_key /etc/vxos-ssl/servers/certs/serverkey.pem;
   

3. Type the following commands to start the NGINX server:

   systemctl start nginx