Search <book_title>...

Veritas NetBackup™ Appliance Security Guide

Last Published: 2021-05-26

Product(s): Appliances (4.0)

Platform: NetBackup Appliance OS

User types that can authenticate on the NetBackup appliance

You can directly add local users on the appliance, or register users from an LDAP server, Active Directory (AD) server, or NIS server. Registering remote users offers the benefit of letting you leverage your existing directory service for user management and authentication. Table: NetBackup appliance user types describes the types of users that can be added to a NetBackup appliance.

Note:

Local user commands cannot be used successfully before the appliance role is configured. Any attempted local user commands including, but not limited to granting user permissions, fail if the appliance role is not configured. If you attempt to run local user commands before role configuration, those same commands also fail after you complete the role configuration. Certain commands can also exhibit unexpected or undesired behavior. To prevent these situations, it is a best practice to avoid attempting any local user commands until after the appliance role has been configured.

Table: NetBackup appliance user types

User type	Description	Notes
Local (native user)	A local user is added to the appliance database and is not referenced to an external directory-based server like an LDAP server. Once the user has been added, you can then grant or revoke the appropriate appliance access permissions.	You can use the Settings > Authentication > User Management page from the NetBackup Appliance Web Console to add, delete, and manage local users. You can use the Settings > Security > Authentication > LocalUser command from the NetBackup Appliance Shell Menu to add and delete local users, as well as change their passwords. You cannot add local user groups. A local user can have the Administrator or NetBackupCLI role. Note: You cannot grant the NetBackupCLI role to an existing local user. However, you can create a local NetBackupCLI user by using the Manage > NetBackupCLI > Create command from the NetBackup Appliance Shell Menu.
LDAP	An LDAP (Lightweight Directory Access Protocol) user or user group exists on an external LDAP server. After configuring the appliance to communicate with the LDAP server, you can register those users and user groups with the appliance. Once the user has been registered (added), you can then grant or revoke the appropriate appliance access permissions. See About authenticating LDAP users.	You can use the Settings > Authentication > User Management page from the NetBackup Appliance Web Console to add, delete, and manage LDAP users and user groups. You can use the Settings > Security > Authentication > LDAP command from the NetBackup Appliance Shell Menu to add and delete LDAP users and user groups. You can assign the Administrator or NetBackupCLI role to an LDAP user or user group. Note: The NetBackupCLI role can be assigned to a maximum of nine (9) user groups at any given time.
Active Directory	An Active Directory (AD) user or user group exists on an external AD server. After configuring the appliance to communicate with the AD server, you can register those users and user groups with the appliance. Once the user has been registered (added), you can then grant or revoke the appropriate appliance access permissions. See About authenticating Active Directory users.	You can use the Settings > Authentication > User Management page from the NetBackup Appliance Web Console to add, delete, and manage AD users and user groups. You can use the Settings > Security > Authentication > ActiveDirectory command from the NetBackup Appliance Shell Menu to add and delete AD users and user groups. You can assign the Administrator or NetBackupCLI role to an AD user or user group. Note: The NetBackupCLI role can be assigned to a maximum of nine (9) user groups at any given time.
Kerberos-NIS	A NIS (Network Information Service) user or user group exists on an external NIS server. Unlike the LDAP and AD implementations, configuring the appliance to communicate with the NIS domain requires Kerberos authentication. You must have an existing Kerberos service associated with your NIS server before you can configure the appliance to register the NIS users. After configuring the appliance to communicate with the NIS server and the Kerberos server, you can register the NIS users and user groups with the appliance. Once the user has been registered (added) to the appliance, you can then grant or revoke the appropriate appliance access permissions. See About authenticating Kerberos-NIS users.	You can use the Settings > Authentication > User Management page from the NetBackup Appliance Web Console to add, delete, and manage NIS users and user groups. You can use the Settings > Security > Authentication > Kerberos command from the NetBackup Appliance Shell Menu to add and delete NIS users and user groups. You can assign the Administrator or NetBackupCLI role to a NIS user or user group. Note: The NetBackupCLI role can be assigned to a maximum of nine (9) user groups at any given time.

For detailed instructions on configuring new users, refer to the NetBackup Appliance Administrator's Guide.