NetBackup™ Commands Reference Guide

These options enable an administrator that runs locally on an Authentication server to add or remove domains within the private Veritas Domain Database. These domains are not accessible from within any operating system. They are meaningful only within Veritas Product Authentication and Authorization Service. Use them where a centralized naming authority (such as a PDC/AD or NIS domain) is not available.

Registers a computer in a private Veritas Product Authentication. The identity is placed in the private domain NBU_Machines@at.server.name. Run this option on your authentication broker (root +ab).

Enables an administrator that runs locally on an Authentication server to add or remove users from domains in the private Veritas Domain Database. These accounts are meaningful only within Veritas Product Authentication and Authorization Service. Use them when a centralized naming authority (such as PDC/AD or NIS domain) is not available.

Obtains a broker certificate without authenticating to a broker.

Identifies yourself to the system. When you run this command with no options, you are prompted to enter a name, password, domain, authentication type, and a server to authenticate. The combination of a name, password, domain, and domain type creates a unique identity within an Enterprise-wide network. The first time a broker is contacted, you are asked if you want to trust that broker and authenticate them. You cannot use an untrusted broker.

The -Info option accepts the name, password, and domain information from an answer file. The password is optional in the answer file. You can also place the certificate in a credential file (if specified) or the default location. If you do not provide a password, you are prompted for the password when you run the command.

The -Info option accepts the name, password, and domain information from an answer file. The password is optional in the answer file. You can also place the certificate in a credential file (if specified) or the default location. If you do not provide a password, you are prompted for the password when you run the command. The -Info option is applicable only for AT, WEB, and APIKEY login.

The -Info [-i | -Interactive] option prompts you to enter the one-time password during logon when your user account is configured for multifactor authentication.

If multifactor authentication is enforced and you have not configured multifactor authentication for your user account, use of NetBackup web UI is recommended to configure multifactor authentication.

For the bpnbat -login operation on NetBackup host earlier than 10.3, you must append the one-time password to the password.

If you have not provided any value for the bpnbat -LoginType option and user enters one-time password appended to password, the web logon succeeds. The authentication of the Veritas authentication service (AT), however, fails. For successful AT authentication and web logon, you must enter the password and one-time password separately.

The -requestApproval option is applicable only for WEBUI login. Use this option to request NetBackup command line interface execution permission.

For the APIKEY login type, the answer file should contain the details in the following order:

User name
API key
Master server

Example of a sample answer file:

administrator
A1WMg0EmC4pKBXlZjL61qlqJ0YE4-IRacjViMKLg9pUVaU-XJAnroQNawlnKLaNx
nbmaster1

The answer file is a text file with entries for the required information.

The answer file for WEB must contain the four lines that are shown in the order shown:

domain type
domain
user name
password

A sample answer file is:

NT
Sample_Domain
administrator
s@Mpl3

The answer file for AT must contain the four lines that are shown in the order shown:

domain type
domain
user name
password
authentication broker

A sample answer file is:

unixpwd
Sample_Domain
root
s@Mpl3
Sample_Domain

As previously explained, password is an optional value. The domain type value must be one of the values shown:

If you use an answer file, ensure that the appropriate AUTHENTICATION_DOMAIN is configured on the server. See the NetBackup Security and Encryption Guide.

The NetBackup Web Management Console Service (nbwmc) always runs on the NetBackup master server. The Authentication Broker normally runs on the NetBackup master server as well. But in certain instances, it can run on a host other than the master server.

The answer file for APIKEY must contain the three lines that are shown:

Login name
API key
Master server

If the -LoginType is AT, only a NetBackup AT broker log on for the master server is performed. If the -LoginType is WEB or APIKEY, only a NetBackup web application log on for the Authentication Broker or the master server is performed. If the -LoginType is not specified, both the AT and the WEB logons are performed if the Authentication Broker is on the master server. If the -LoginType is not specified and the Authentication Broker is not on the master server: the WEB logon succeeds and the AT logon fails. The AT logon fails with a security services status code 96. If the -LoginType is APIKEY, only API key logon is performed. The - cf option is not applicable if the -LoginType is WEB or APIKEY.

Identifies a computer that uses an account within the Veritas Security Subsystem private domain NBU_Machines@at.server.name. Run this option on your NetBackup Media, Master, and Clients. This option is similar to when you log on as a user to an authentication broker.

Invalidates the current user credentials that require the user to log on again to continue. Without the -cf option, the credential that is stored at the default location is expired. The -cf option points to the actual credential file, which allows a user to explicitly specify the credential to be expired.

If the -LogoutType is AT, only a NetBackup AT broker logout is performed. If the -LogoutType is WEB, WEBUI, or APIKEY, it is a NetBackup web application logout. If the -LogoutType is not specified, the AT, web and the WEBUI logout are performed. The - cf option is applicable only for the AT logout.

Removes a trust of a specified authentication broker for all users except the root user (administrator). You can use this command to remove a broker when you no longer trust it. For example, an authentication broker is moved to a different corporate division.

Renews the current user credentials from the VxSS store or the credential file that is specified with the -cf option.

Lists all of the brokers that the user currently trusts. NetBackup trusts any broker that is listed to handle the authentication requests that are sent to it.

Lists all computers that have been added to the computers domain of a private Veritas Security Subsystem database by using the -AddMachines option. It also shows if DNS fully resolved the computer name. Run this option on your authentication broker (root +ab).

Use this option to skip authentication domain validation. Applicable only for AT or WEB login.

Retrieves the version of the executable.