Veritas NetBackup™ Appliance Security Guide
- About the NetBackup appliance Security Guide
- User authentication
- About user authentication on the NetBackup appliance
- About configuring user authentication
- About authenticating LDAP users
- About authenticating Active Directory users
- About authentication using smart cards and digital certificates
- About single sign-on (SSO) authentication and authorization
- About the appliance login banner
- About user name and password specifications
- User authorization
- Intrusion prevention and intrusion detection systems
- About Symantec Data Center Security on the NetBackup appliance
- About the NetBackup appliance intrusion prevention system
- About the NetBackup appliance intrusion detection system
- Reviewing SDCS events on the NetBackup appliance
- Running SDCS in unmanaged mode on the NetBackup appliance
- Running SDCS in managed mode on the NetBackup appliance
- Log files
- Operating system security
- Data security
- Web security
- Network security
- Call Home security
- Remote Management Module (RMM) security
- STIG and FIPS conformance
- Index
About SSL usage
The Secure Socket Layer (SSL) protocol creates an encrypted connection between the appliance web server and the appliance web console, and other local servers. This type of connection allows for a more secure information transfer without the problems of eavesdropping, data tampering, or message forgery. To enable SSL on the appliance web server, you need an SSL certificate that identifies the appliance host.
SSL certificates are also supported for secure communications between the appliance and various external servers, such as LDAP, HTTPs proxy, and Syslog.
The appliance uses self-signed certificates for client and host validation. A host certificate issued by an internal CA is deployed on the primary and media servers during role configuration. The self-signed certificate is generated using a 2048 bit RSA public key that is hashed with the SHA256 algorithm and signed with RSA encryption. For secure communications, the appliance uses only TLS v1.2 and later protocols.
NetBackup appliance also supports host certificates issued by an external certificates. You can use these as an alternative to the internal CA to provide host verification and security to meet your organization's standards.
Refer to the following table for different types of external certificates used in NetBackup appliance.
Table: Types of external certificate certificates
Certificate type | Description |
|---|---|
Host certificate | The appliance's host certificate is based on the X.509 or PKCS#7 standard. The certificate is encoded in either DER (binary) or PEM (text) format. Veritas recommends that you use RSA public and private keys of length 2048 bits or higher. Note: Ensure that the SubjectAlternativeName certificate extension contains all the appliance host names and IP addresses by which the appliance is reached. Include the fully qualified host names and the short names. |
Host private key (corresponding to the host certificate) | The appliance's host private key must be in PKCS#8 standard and encoded in PEM format. |
(Optional) Intermediary CA certificates | Intermediary CA certificates form a certificate chain from the appliance host certificate to the root CA certificate. These certificates are only required if the host certificates are issued by a CA other than the root CA. |
Root CA certificates | These include the root CA certificates of the Appliance certificate chain and its peers. If the appliance needs to interact with the hosts that have certificates from different CAs, you must have all those intermediary and root CA certificates ready in a file called cacerts.pem. |