NetBackup™ Snapshot Manager for Cloud 安装和升级指南

在配置了 CIS Level 2 v2 的主机上安装 NetBackup Snapshot Manager

1. 准备具有 CIS Level 2 v2 基准的 Red Hat Enterprise Linux 8。
2. 对于 CIS 主机，支持 iptable 防火墙。
3. 确保满足以下部分中所述的所有“NetBackup Snapshot Manager 主机要求”：

4. 确保启用 IPv4 和 IPv6 转发。
5. 借助 OpenScap 工具，用 NetBackup Snapshot Manager 所需的以下规则集对计算机进行补救：

   xccdf_org.ssgproject.content_rule_package_iptables-services_removed
   
   xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding
   
   xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward
   

   以下示例中使用了 oscap 命令和 remediate 选项：

   # oscap xccdf eval --skip-rule xccdf_org.ssgproject.content_rule_accounts_tmout --results demo-remediate2.xml --profile xccdf_org.ssgproject.content_profile_cis --remediate /usr/share/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml

   上述命令将跳过 xccdf_org.ssgproject.content_rule_accounts_tmout 规则，并生成包含此已跳过规则的报告。

   使用 --skip-rule 参数跳过了以下规则集，以达到所需的 CIS 分数：

   xccdf_org.ssgproject.content_rule_accounts_tmout  
   xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action  
   xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action  
   xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action  
   xccdf_org.ssgproject.content_rule_banner_etc_issue  
   xccdf_org.ssgproject.content_rule_banner_etc_issue_net  
   xccdf_org.ssgproject.content_rule_grub2_uefi_password  
   xccdf_org.ssgproject.content_rule_mount_option_var_noexec
   xccdf_org.ssgproject.content_rule_package_bind_removed  
   xccdf_org.ssgproject.content_rule_package_cups_removed  
   xccdf_org.ssgproject.content_rule_package_dhcp_removed  
   xccdf_org.ssgproject.content_rule_package_dovecot_removed  
   xccdf_org.ssgproject.content_rule_package_httpd_removed  
   xccdf_org.ssgproject.content_rule_package_mcstrans_removed  
   xccdf_org.ssgproject.content_rule_package_net-snmp_removed  
   xccdf_org.ssgproject.content_rule_package_openldap-clients_removed  
   xccdf_org.ssgproject.content_rule_package_rsync_removed  
   xccdf_org.ssgproject.content_rule_package_samba_removed  
   xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed  
   xccdf_org.ssgproject.content_rule_package_squid_removed  
   xccdf_org.ssgproject.content_rule_package_talk_removed  
   xccdf_org.ssgproject.content_rule_package_telnet-server_removed  
   xccdf_org.ssgproject.content_rule_package_tftp-server_removed  
   xccdf_org.ssgproject.content_rule_package_vsftpd_removed  
   xccdf_org.ssgproject.content_rule_package_xinetd_removed  
   xccdf_org.ssgproject.content_rule_package_xorg-x11-server-common_removed  
   xccdf_org.ssgproject.content_rule_package_ypserv_removed  
   xccdf_org.ssgproject.content_rule_rsyslog_files_permissions  
   xccdf_org.ssgproject.content_rule_selinux_state  
   xccdf_org.ssgproject.content_rule_service_firewalld_enabled  
   xccdf_org.ssgproject.content_rule_set_firewalld_default_zone  
   xccdf_org.ssgproject.content_rule_sudo_require_authentication  
   xccdf_org.ssgproject.content_rule_sudo_require_reauthentication

   有关更多信息，请参考 Red Hat 系统设计指南。

6. 安装 NetBackup Snapshot Manager 并在 NetBackup 主服务器中注册。
7. 确保 Podman 通信正常运行。请参考 Red Hat 知识库文章。
8. 执行无代理配置以保护 CIS Level 2 v2 VM 工作负载时，请确保满足以下部分中所述的要求，并从无代理 VM 工作负载上的 /tmp 文件夹中删除 noexec 权限：