Veritas NetBackup™ Appliance Security Guide
- About the NetBackup appliance Security Guide
- User authentication
- About user authentication on the NetBackup appliance
- About configuring user authentication
- About authenticating LDAP users
- About authenticating Active Directory users
- About authentication using smart cards and digital certificates
- About single sign-on (SSO) authentication and authorization
- About the appliance login banner
- About user name and password specifications
- User authorization
- Intrusion prevention and intrusion detection systems
- About Symantec Data Center Security on the NetBackup appliance
- About the NetBackup appliance intrusion prevention system
- About the NetBackup appliance intrusion detection system
- Reviewing SDCS events on the NetBackup appliance
- Running SDCS in unmanaged mode on the NetBackup appliance
- Running SDCS in managed mode on the NetBackup appliance
- Log files
- Operating system security
- Data security
- Web security
- Network security
- Call Home security
- Remote Management Module (RMM) security
- STIG and FIPS conformance
- Index
OS STIG hardening for NetBackup appliance
The Security Technical Implementation Guides (STIGs) provide technical guidance for increasing the security of information systems and software to help prevent malicious computer attacks. This type of security is also referred to as hardening.
Starting with software version 3.1, you can enable OS STIG hardening rules for increased security. These rules are based on the following profile from the Defense Information Systems Agency (DISA):
STIG for Red Hat Enterprise Linux 8 Server - V1R6
To enable these rules, use the following command:
Main_Menu > Settings > Security > Stig Enable, followed by the maintenance password.
Note the following about enabling STIG:
When the option is enabled, a list of the enforced rules appears. The command output also shows exceptions to any rules that are not enforced.
This command does not allow individual rule control.
For appliances (nodes) in a high availability (HA) setup, this feature must be enabled manually on each node to ensure correct operation after a switchover.
Once the option is enabled, a factory reset is required to disable the associated rules.
If Lightweight Directory Access Protocol (LDAP) is configured, it is recommended that you set it up to use Transport Layer Security (TLS) before you enable the option.
When STIG is not enabled on the appliance, you can have unlimited concurrent SSH sessions and 10 web console sessions. After STIG is enabled, the maximum number of concurrent SSH and web console sessions is limited to 10 each. Use the Security > Sessions command to set a limit to the number of concurrent sessions. Once the limit is set, a factory reset is required to change it back to unlimited.
When you enable STIG, OS log forwarding is enabled automatically. For more details about log forwarding, see the NetBackup Appliance Commands Reference Guide.
After STIG is enabled, you are required to change the Maintenance account password every 60 days to prevent account expiration. Failure to do so causes upgrade issues if the account has expired.
Note:
If you have enabled the STIG feature on an appliance and you need to upgrade it or install an EEB on it, do not plan such installations during the 4:00am - 4:30am time frame. By following this best practice, you can avoid interrupting the automatic update of the AIDE database and any monitored files, which can cause multiple alert messages from the appliance.
Starting with the 4.1 release, all STIG rule lists are available in separate documents on the Veritas Support site. Two checklists are currently available, one for the OS and one for Application Security STIG. For instructions about how to obtain these documents, go to the Latest releases page on the Veritas Download Center, navigate to and click Learn more.