Symantec NetBackup™ Appliance Security Guide
- About the NetBackup Appliance Security Guide
- User authentication
- User authorization
- Intrusion prevention and intrusion detection systems
- About Symantec Data Center Security on the NetBackup Appliance
- About the NetBackup Appliance intrusion prevention system
- About the NetBackup Appliance intrusion detection system
- Reviewing SDCS events on the NetBackup appliance
- Running SDCS in unmanaged mode on the NetBackup appliance
- Running SDCS in managed mode on the NetBackup appliance
- Overriding the NetBackup Appliance intrusion prevention system policy
- Re-enabling the NetBackup Appliance intrusion prevention system policy
- Log files
- Operating system security
- Data security
- Web security
- Network security
- Call Home security
- IPMI security
- STIG and FIPS conformance
- Appendix A. Security release content
Implementing third-party SSL certificates
You can manually add and implement third-party certificates for the web service support. The appliance uses the Java KeyStore as the repository of security certificates. A Java KeyStore (JKS) is a repository of security certificates, like the authorization certificates or the public key certificates that are used for instance in SSL encryption. To implement the third-party certificates in the appliance you must log in as the root account.
To implement third-party SSL certificates:
- Prepare the keystore file for web services.
The procedure varies with the type of PKCS (Public-key Cryptography Standards) you use. And, no matter what PKCS type you choose, the keystore file must contain the following keywords:
SubjectAlternativeName [
DNSName: localhost
IPAddress: 127.0.0.1
]
The following table describes the steps to use PKCS# 7 and PKCS# 12 standard formats.
PKCS format
Preparing keystore files
PKCS#7 or X.509 format
You can use the following link: https://knowledge.verisign.com/support/ssl-certificates-support/index.html
PKCS#12 format
Convert PEM formatted x509 Cert and Key to a PKCS# 12, using the following commands:
openssl pkcs12 export -in server.crt -inkey server.key -out server.p12 -name some-alias -CAfile ca.crt -caname root
For more information on openssl usage, refer to http://www.openssl.org/.
Note:
Ensure that you put a password on the PKCS #12 file. When the password is not applied to the file, you may get a null reference exception when you try to import the file
Convert the pkcs12 file to a Java Keystore using the following commands:
keytool -importkeystore -deststorepass changeit -destkeypass changeit -destkeystore server.keystore -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass some- password -alias some-alias
For more information on keytool usage, refer to http://docs.oracle.com/javase/6/docs/technotes/tools/solaris/keytool.html
- Shut down the web service.
Use the following command to shut down the web service:
/etc/init.d/nbappws stop
/opt/IMAppliance/scripts/infraservices.sh webserver stop
- Replace the existing keystore file with your new keystore file. The default file name is
/opt/apache-tomcat/security/keystore. - Correct the following information in the configuration files:
Change the keystoreFil and keystorePass settings in the
/opt/SYMCnbappws/config/server.xml.Change the keystoreFil and keystorePass settings in the
/opt/SYMCnbappws/webserver/conf/server.xml.Change the keystoreFil and keystorePass settings in the
/opt/apache-tomcat/conf/server.xml.Change the javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword settings in the
/opt/SYMCnbappws/bin/startgui.sh.Change the javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword settings in the
/opt/apache-tomcat/bin/setenv.sh.
- Startup web service using the following command:
/etc/init.d/nbappws start
/opt/IMAppliance/scripts/infraservices.sh webserver start