Veritas NetBackup™ Appliance Security Guide

The following list describes the typical scenarios for successfully executing NetBackup commands:

• Authorization prompt: web login is required

  Some NetBackup commands may require a web login. You will see the following prompt:

  A web login is required. Run the 'bpnbat -login -loginType WEB|WEBUI|APIKEY' command to login. EXIT STATUS 5930: The request could not be authorized.

  To authenticate such requests, you must log in to the NetBackup Web Management Service as a NetBackup administrator and run the following command:

  myappliance.NBCLIUSER> bpnbat -login -logintype WEB

  The following shows an example WEB login:

  Authentication Broker: ApplianceHostname
  Authentication Port: 0
  Authentication Type: unixpwd
  LoginName: Username
  Password: Password
  Operation completed successfully.

• Authorization prompt: web ui login required

  Some NetBackup commands may require an approval using an access token. To authenticate such requests, generate an access code by running the following command:

  # bpnbat -login -logintype webui -requestApproval

  Make a note of the access code that is displayed in the command window.

  Sign in to the NetBackup web UI as a NetBackup Command Line (CLI) Admin user and approve the CLI access request by entering the access code that you generated earlier. For more information about access key and approval requests, refer to the NetBackup Security and Encryption Guide.

• Authorization prompt: superuser privileges required

  Some NetBackup commands may require superuser privileges. You will see the following prompt:

  EXIT STATUS 140: user id was not superuser

  To authenticate such requests, use sudo to elevate the privileges and run the NetBackup commands using the absolute path. For example:

  # sudo /usr/openv/netbackup/bin/nbkmscmd -discoverNbkms

  If the authentication messages persist even after you have used the absolute path and sudo, you can use the WEB login method described earlier and run the following command for authenticating the request:

  # sudo /usr/openv/netbackup/bin/bpnbat -login -loginType WEB

General considerations:

• The authentication cases described earlier are typical scenarios. Some NetBackup commands may require other authentication methods. Refer to the NetBackup Commands Reference Guide for more information on the exact permissions that are required by various NetBackup commands and command parameters.

• Some NetBackup commands are run as root by default. You can verify whether a particular command requires root privileges by running the following command:

  nbucliuser-!> alias | grep NetBackup command

  For example, nbkms command runs as root by default:

  nbucliuser-!> alias | grep nbkms

  alias nbkms='sudo -n /usr/openv/netbackup/bin/nbkms'

• Some NetBackup commands are run by the current NetBackupCLI user by default. But there are some NetBackup command parameters that require root privileges. In such cases, you can use 'sudo <absolute path of command> <parameters>' to run the command.

  If you see a prompt "sudo: a password is required", it means that the command cannot be run as root. Contact Veritas Technical Support for help with such scenarios.

Appliance users that need to run NetBackup commands to access special directive files as a NetBackupCLI user, must do the following to ensure successful operation:

• Add the /home/nbusers path to the NetBackup bpcd allowed list.

• Add the special directive commands to the /home/nbusers directory.