Veritas NetBackup™ Virtual Appliance Documentation
- Getting to know the NetBackup Virtual Appliance
- NetBackup Virtual Appliance product description
- Preparing to deploy the appliance
- Deploying and configuring the appliance
- How to deploy and configure a NetBackup Virtual Appliance combined master and media server
- How to deploy and configure a NetBackup Virtual Appliance media server
- How to deploy and configure a NetBackup Virtual Appliance combined master and media server
- Post initial configuration procedures
- Appliance common tasks
- Storage management
- About NetBackup Virtual Appliance storage configuration
- About viewing storage space information using the Show command
- About NetBackup Virtual Appliance storage configuration
- Network connection management
- Managing users
- About authenticating LDAP users
- About authenticating Active Directory users
- About authenticating Kerberos-NIS users
- About user authorization on the NetBackup Virtual Appliance
- Creating NetBackup administrator user accounts
- Using the appliance
- About configuring Host parameters for your appliance on the NetBackup Virtual Appliance
- About Copilot functionality and Share management
- About NetBackup Virtual Appliance as a VMware backup host
- About running NetBackup commands from the appliance
- About mounting a remote NFS
- About Auto Image Replication from a NetBackup Virtual Appliance
- Monitoring the appliance
- About SNMP
- About Call Home
- Appliance security
- About Symantec Data Center Security on the NetBackup Virtual Appliance
- Setting the appliance login banner
- Upgrading the appliance
- About upgrades to NetBackup Virtual Appliance software version 3.1.1 and the Red Hat Enterprise Linux operating system
- Guidelines and best practices for upgrading NetBackup appliances
- Methods for downloading appliance software release updates
- Appliance restore
- Decommissioning and Reconfiguring
- Troubleshooting
- About NetBackup support utilities
- Appliance logging
- Commands overview
- Appendix A. Appliance commands
- Appendix B. Manage commands
- Appendix C. Monitor commands
- Appendix D. Network commands
- Appendix E. Reports commands
- Appendix F. Settings commands
- Appendix G. Support commands
Overriding the NetBackup Virtual Appliance intrusion prevention system policy
To discourage accessing the root account, the appliance requires that you first disable the intrusion prevention system (IPS) policy. For example, using the elevate command under Support > Maintenance fails unless the IPS policy is disabled.
Warning:
Disabling the IPS policy is not recommended as it puts the system at risk and vulnerable to attack.
You can use the NetBackupCLI user role to run NetBackup commands without overriding the IPS policy. See About the NetBackupCLI user role.
Note:
Overriding the IPS policy disables only the appliance intrusion prevention system. The appliance intrusion detection system (IDS) logging is still enabled and every activity under the maintenance account is still logged.
To override the appliance IPS policy
- Log on to the NetBackup Virtual Appliance Shell Menu as an administrator.
- Enter the Support > Maintenance command to bring up the Maintenance Mode login prompt. Enter the Maintenance user account password to log into Maintenance Mode.
app123.Support> Maintenance <!-- Maintenance Mode --!> maintenance's password:
- In Maintenance Mode, type the following command to override the IPS policy:
/opt/Symantec/sdcssagent/IPS/sisipsoverride.sh
The following message is displayed:
Symantec Critical Protection Policy Override Agent Version: 6.7 (build 1060) Current Policy: NetBackup Appliance Prevention Policy, r123 Policy Prevention: Enabled Policy Override: Allowed Override State: Not overridden To override the policy and disable protection, enter your login password. Password:
- Enter the Maintenance user account password. The following options are displayed:
Choose the type of override that you wish to perform: 1. Override Prevention except for Self Protection 2. Override Prevention Completely Choice?
- Enter 1 to override prevention except for self-protection.
Note:
Veritas recommends that you use Option 1. Selecting Option 1 allows modification only to the NetBackup Virtual Appliance Shell Menu and not to the SDCS agent.
The following options are displayed:
Choose the amount of time after which to automatically re-enable: 1. 15 minutes 2. 30 minutes 3. 1 hour 4. 2 hours 5. 4 hours 6. 8 hours
- Enter the appropriate number from 1 to 7 based on the amount of time that is required to debug the support case.
The appliance displays the following message:
Enter a comment. Press Enter to continue.
- Enter a relevant comment as to why the override is required. For example:
Enter a comment. Press Enter to continue. Disabling the security policy for debugging support case no - XYZ
The appliance overrides the policy and displays the following message:
Please wait while the policy is being overridden. ........ The policy was successfully overridden. maintenance - !> elevate
You should now have access to the root account for debugging the appliance.