Search <book_title>...

Veritas NetBackup™ Security and Encryption Guide

Last Published: 2020-09-13

Product(s): NetBackup (8.3.0.1, 8.3)

About NetBackup certificate deployment security levels

Security levels for certificate deployment are specific to NetBackup CA-signed certificates. If the NetBackup web server is not configured to use NetBackup certificates for secure communication, the security levels cannot be accessed.

The NetBackup certificate deployment level determines the checks that are performed before the NetBackup CA issues a certificate to a NetBackup host. It also determines how frequently the NetBackup Certificate Revocation List (CRL) is refreshed on the host.

NetBackup certificates are deployed on hosts during installation (after the host administrator confirms the master server fingerprint) or with the nbcertcmd command. Choose a deployment level that corresponds to the security requirements of your NetBackup environment.

Note:

During NetBackup certificate deployment on a NAT client, you must provide an authorization token irrespective of the certificate deployment security level that is set on the master server. This is because, the master server cannot resolve the host name to the IP address from which the request is sent.

For more information about NAT support in NetBackup, refer to the NetBackup Administrator's Guide, Volume I.

Table: Description of NetBackup certificate deployment security levels

Security level	Description	CRL refresh
Very High	An authorization token is required for every new NetBackup certificate request. See Creating authorization tokens.	The CRL that is present on the host is refreshed every hour. See About the host ID-based certificate revocation list.
High (default)	No authorization token is required if the host is known to the master server. A host is considered to be known to the master server if the host can be found in the following entities: The host is listed for any of the following options in the NetBackup configuration file (Windows registry or the `bp.conf` file on UNIX): APP_PROXY_SERVER DISK_CLIENT ENTERPRISE_VAULT_REDIRECT_ALLOWED MEDIA_SERVER NDMP_CLIENT SERVER SPS_REDIRECT_ALLOWED TRUSTED_MASTER VM_PROXY_SERVER MSDP_SERVER For more details on the NetBackup configuration options, refer to the NetBackup Administrator's Guide, Volume I. The host is listed as a client name in the `altnames` file (ALTNAMESDB_PATH). The host appears in the EMM database of the master server. At least one catalog image of the client exists. The image must not be older than 6 months. The client is listed in at least one backup policy. The client is a legacy client. This is a client that was added using the Client Attributes host properties. See Creating authorization tokens.	The CRL that is present on the host is refreshed every 4 hours.
Medium	The certificates are issued without an authorization token if the master server can resolve the host name to the IP address from which the request was originated.	The CRL that is present on the host is refreshed every 8 hours.

Security level

Description

CRL refresh

Very High

An authorization token is required for every new NetBackup certificate request.

See Creating authorization tokens.

The CRL that is present on the host is refreshed every hour.

See About the host ID-based certificate revocation list.

High (default)

No authorization token is required if the host is known to the master server. A host is considered to be known to the master server if the host can be found in the following entities:

The host is listed for any of the following options in the NetBackup configuration file (Windows registry or the bp.conf file on UNIX):
- APP_PROXY_SERVER
- DISK_CLIENT
- ENTERPRISE_VAULT_REDIRECT_ALLOWED
- MEDIA_SERVER
- NDMP_CLIENT
- SERVER
- SPS_REDIRECT_ALLOWED
- TRUSTED_MASTER
- VM_PROXY_SERVER
- MSDP_SERVER
For more details on the NetBackup configuration options, refer to the NetBackup Administrator's Guide, Volume I.
The host is listed as a client name in the altnames file (ALTNAMESDB_PATH).
The host appears in the EMM database of the master server.
At least one catalog image of the client exists. The image must not be older than 6 months.
The client is listed in at least one backup policy.
The client is a legacy client. This is a client that was added using the Client Attributes host properties.

See Creating authorization tokens.

The CRL that is present on the host is refreshed every 4 hours.

Medium

The certificates are issued without an authorization token if the master server can resolve the host name to the IP address from which the request was originated.

The CRL that is present on the host is refreshed every 8 hours.

More Information

Using the Certificate Management utility to issue and deploy host ID-based certificates

Configuring the certificate deployment security levels