Veritas NetBackup™ Appliance Security Guide
- About the NetBackup appliance Security Guide
- User authentication
- About user authentication on the NetBackup appliance
- About configuring user authentication
- About authenticating LDAP users
- About authenticating Active Directory users
- About authentication using smart cards and digital certificates
- About single sign-on (SSO) authentication and authorization
- About the appliance login banner
- About user name and password specifications
- User authorization
- Intrusion prevention and intrusion detection systems
- About Symantec Data Center Security on the NetBackup appliance
- About the NetBackup appliance intrusion prevention system
- About the NetBackup appliance intrusion detection system
- Reviewing SDCS events on the NetBackup appliance
- Running SDCS in unmanaged mode on the NetBackup appliance
- Running SDCS in managed mode on the NetBackup appliance
- Log files
- Operating system security
- Data security
- Web security
- Network security
- Call Home security
- Remote Management Module (RMM) security
- STIG and FIPS conformance
- Index
About authenticating Active Directory users
The NetBackup appliance uses the built-in Pluggable Authentication Module (PAM) plug-in to support the authentication of Active Directory (AD) users. This functionality allows users belonging to an AD service to be added and authorized to log on to a NetBackup appliance. AD is considered as another type of user directory with a schema installed on it by UNIX services.
The following describes the pre-requisites and requirements for using AD user authentication on the appliance:
Ensure that the AD service is available and is set up with the users and user groups that you want to register with the appliance.
Note:
As a best practice, do not use group names or user names that are already used for appliance local users or NetBackupCLI users. Additionally, do not use the appliance default names admin or maintenance for AD users.
Ensure that the authorized domain user credentials are used to configure the AD server with the appliance.
Configure the appliance with a DNS server that can forward DNS requests to an AD DNS server. Alternatively, configure the appliance to use the AD DNS server as the name service data source.
If AD requires communication with a Kerberos server for user authentication, in certain situations, network restrictions or firewall rules can prevent Kerberos traffic to port 88 on AD domain controllers. To prevent this issue, ensure that you open port 88 in the network firewall.
Before registering new AD users and user groups on the appliance, you must configure the appliance to communicate with the AD service. Once the configuration is complete, the appliance can access the AD server user information for authentication.
Configure AD authentication using one of the following methods:
page from the NetBackup Appliance Web Console.
Settings > Security > Authentication > ActiveDirectory commands from the NetBackup Appliance Shell Menu.
For detailed instructions on how to configure and manage AD user authentication on the appliance, refer to the NetBackup Appliance Administrator's Guide and the NetBackup Appliance Commands Reference Guide.