Search <book_title>...

NetBackup and Veritas Appliances Hardening Guide

Last Published: 2024-02-07

Product(s): Appliances (10.3, 5.3, 4.0), NetBackup & Alta Data Protection (10.3, 5.3, 4.0)

Platform: Flex Appliance OS,NetBackup Appliance OS,Linux,Windows,UNIX

Prerequisites for a scan host

A scan host is a host machine that has the required malware tool configured. Once it is integrated with NetBackup, NetBackup initiates scanning on the scan host.

Ensure that you meet the following prerequisites:

The minimum required configuration for the scan host is 8 CPU and 32-GB RAM.
The malware tool must be installed and configured.
For the supported operating systems of the scan host, refer Software Compatibility List.
The scan host must have a share type configured, that is, an NFS or SMB client.
NetBackup footprint is not required on the scan host. The existing systems with the NetBackup client or media server can be used as scan host, too.
The scan host must be reachable from the media server over SSH.
Note:
SSH connection to scan host from the media server must be successful.
Depending on the platform, perform the following:
(For Windows)
- OpenSSH must be configured on windows scan host. Create the firewall rule for OpenSSH so that scan host is accessible from media server.
Note the following:
- For Windows 2016, get OpenSSH from GIT hub repository and for Windows 2019, enable OpenSSH server feature. For more details, refer to Microsoft documentation.
- Microsoft Visual C/C++ Redistributable is an additional dependency if media server is updated to 10.1.1 and above.
  Visual C/C++ run-time library DLL is required to execute nbmalwareutil utility on windows scan host. The runtime DLL can be obtained from Microsoft Visual C++ Redistributable latest supported downloads.
(For Linux)
- For Linux scan host default login shell must be bash.
- For NetBackup malware detection utility to execute on scan host, install libnsl.so.1 library on scan host. If the latest version of libnsl library file is present (for example, /usr/lib64/libnsl.so.2), then create a softlink file /usr/lib64/libnsl.so.1 which points to /usr/lib64/libnsl.so.2 file.
  Example for creating softlink file:
  # cd /usr/lib64 # ln -sf libnsl.so.2 libnsl.so.1
  Note:
  For assistance on installing libnsl* library file, contact operating system administrator.
- For non-administrator user on windows: Non-administrator user of windows scan host must be added to the administrators group.
- For non-root user on Linux:
  - Allow ssh connection using non-root user.
    For example: Add the Allow Users root scanuser entry in the /etc/ssh/sshd_config file.
    Note:
    Scan user is a non-root user created in the system.
  - Provide user permission to mount and umount. Add user permission entry in sodoers file.
    For example: In the /etc/sudoers file add one of the following:
    scanuser ALL=(ALL) NOPASSWD:ALL
    scanuser ALL=(ALL) NOPASSWD:/bin/umount, /bin/mount
  - Configure malware tool using non-root user on the scan host.
    Note:
    If scanning is done using root user, then change the permission of the /tmp/malware folder to provide write permissions to the non-root user.
    Note:
    For example: chmod a+rwx /tmp/malware

Prerequisites for Windows scan host for NFS share type

Run the scan host credential validation again from Web UI if changes are done to ID mapping.

Enable local passwd file mapping:

C:\Users\Administrator> Set-NfsMappingStore -EnableUNMLookup  $True  -UNMServer localhost
C:\Users\Administrator> nfsadmin mapping
 
The following are the settings on localhost
 
Mapping Server Lookup       : Enabled
Mapping Server              : localhost
AD Lookup                   : Disabled
AD Domain                   :

The entry must be as follows in the respective files (in file type format):
In C:\Windows\System32\drivers\etc\passwd file:
```
scanuser:x:1001:1001:Description:C:\Users\scanuser
```
In C:\Windows\System32\drivers\etc\group file:
```
scangroup:x:1001:1001
```
Restart nfsadmin client as follows:
nfsadmin client stop
nfsadmin client start

Verify the ID (UID/GID) mapping for user by running the following command using PowerShell:

Get-NfsMappedIdentity -AccountName Administrator -AccountType User
 
UserIdentifier      : 0
GroupIdentifier     : 0
UserName            : Administrator
PrimaryGroup        :
SupplementaryGroups :

Note:

For VMware and cloud workload policy scanning, UID and GID mapping must be set to 0.

(If scan host is created in Azure or AWS from marketplace images) Enable root access for scan host as follows:

Change the root password using the following command:
- sudo -i passwd
Change /etc/ssh/sshd_config file to provide the permit for root login as follows:
```
"PermitRootLogin yes" 
"PasswordAuthentication yes"
```
Restart the service with the following command:
- service sshd reload
Change /etc/cloud/cloud.cfg file as follows to enable root user:
disable_root 0