Search <book_title>...

Veritas NetBackup™ Appliance Security Guide

Last Published: 2023-06-08

Product(s): Appliances (5.1.1)

Platform: NetBackup Appliance OS

KMS support

NetBackup appliance supports encryption that is managed by NetBackup Key Management Service (KMS) which is integrated with NetBackup Enterprise Server 7.1. KMS is supported on primary and media server appliances. Regenerating the data encryption key is the only supported method of recovering KMS on an appliance primary server.

The following describes the KMS key features:

Does not require an additional license.
Is a primary server-based symmetric key management service.
Can be administered as a primary server with tape devices connected to it or to another NetBackup appliance.
Manages symmetric cryptography keys for tape drives that conform to the T10 standard (such as LTO4 or LTO5).
Designed to use volume pool-based tape encryption.
Can be used with tape hardware that has built-in hardware encryption capability.
Can be managed by a NetBackup CLI administrator using the NetBackup Appliance Shell Menu or the KMS Command Line Interface (CLI).

About the keys used under KMS

The KMS generates keys from passcodes or auto-generates keys. Table: KMS files lists the associated KMS files that hold the information about the keys.

Table: KMS files

KMS files	Description
Keystore file	The keystore file (`KMS_DATA`) contains all of the key group and key records, along with some metadata.
KPK file	The KPK file (`KMS_KPKF`) contains the KPK that is used to encrypt the ciphertext portions of the key records that are stored in the keystore file.
HMK file	The HMK file (`KMS_HMKF`) contains the HMK that is used to encrypt the entire contents of the keystore file. The keystore file header is an exception. It contains some metadata like the KPK ID and the HMK ID, which is not encrypted.

Configuring KMS

To configure KMS on an appliance primary server, you must log in as a NetBackupCLI user.

Before you proceed, ensure that the NetBackupCLI user is assigned the required RBAC permissions to configure and enable KMS. Use a NetBackup administrator account such as nbasecadmin to log in to the NetBackup Web UI and assign the Default Security Administrator role to the NetBackupCLI user.

For steps on managing role-based access control, see the NetBackup Web UI Administrator's Guide.

Note:

If required, you can create a new NetBackupCLI user for configuring and enabling KMS. For more information about the NetBackupCLI user, See About the NetBackupCLI user role.

The following describes how to configure and enable KMS on an appliance.

To configure and enable KMS on an appliance

Log in to the appliance primary server as a NetBackupCLI user.
Enter into a restricted shell environment by using the Command command as follows:
[nb-appliance.NBCLIUSER>]# Command
Authenticate your CLI access using the following steps:
- Generate an access code by running the following command:
  #bpnbat -login -logintype webui -requestApproval
  Make a note of the access code that is displayed in the command window.
- Sign in to the NetBackup web UI as a NetBackup Command Line (CLI) Admin user and approve the CLI access request by entering the access code that you generated earlier.
  Once the request is approved, you will see a confirmation message in the restricted shell command window.
For more information about access key and approval requests, refer to the NetBackup Security and Encryption Guide.
Create an empty database using the nbkms command, as follows:
[nbucliuser-!>]# nbkms -createemptydb
Start nbkms. For example:
[nbucliuser-!>]# nbkms
Create a Key group. For example:
[nbucliuser-!>]# nbkmsutil -createkg -kgname KMSKeyGroupName
Create an active key. For example:
[nbucliuser-!>]# nbkmsutil -createkey -kgname KMSKeyGroupName -keyname KMS KeyName

Enabling KMS encryption for MSDP

Verify that KMS is configured and running on the primary server. You can then enable KMS encryption for MSDP on all of the media servers that are associated with the primary server.

For steps on how to manage role-based access control, see the NetBackup Web UI Administrator's guide.

Note:

If required, you can create a new NetBackupCLI user for configuring and enabling KMS. For more information about the NetBackupCLI user, See About the NetBackupCLI user role.

The following describes how to enable KMS encryption for MSDP on an appliance.

To enable KMS encryption for MSDP

Log in to the appliance media server as a NetBackupCLI user.
Change the following options in the order as shown:
- nbucliuser-!> pdcfg --write=/msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=KMSOptions --option=KMSType --value=0
- nbucliuser-!> pdcfg --write=/msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=KMSOptions --option=KMSServerName --value=<primary server hostname
- nbucliuser-!> pdcfg --write=/msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=KMSOptions --option=KMSKeyGroupName --value=msdp
- nbucliuser-!> pdcfg --write=/msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=KMSOptions --option=KeyName --value=<KMS KeyName>
- nbucliuser-!> pdcfg --write=/msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=KMSOptions --option=KMSEnable --value=true
- nbucliuser-!> pdcfg --write= /msdp/data/dp1/pdvol/etc/puredisk/contentrouter.cfg --section=ContentRouter --option=ServerOptions --value=verify_so_references,fast,encrypt
  Repeat this step on all media servers that are associated with the primary server.
Identify yourself to the system by logging on to the NetBackup web application. Run the following command:
sudo /usr/openv/netbackup/bin/bpnbat -login -loginType WEB
Authentication Broker: ApplianceHostname
Authentication Port: 0
Authentication Type: unixpwd
LoginName: Username
Password: Password
Ensure that the KMS is registered with NetBackup Web Service.
sudo /usr/openv/netbackup/bin/nbkmscmd -discoverNbkms
Stop and restart the NetBackup services with the following commands:
- bp.kill_all
- bp.start_all
To verify that KMS encryption for MSDP is enabled on the media server, run a backup job on the server, then run the following command:
crcontrol --getmode