Search <book_title>...

Veritas NetBackup™ Virtual Appliance Documentation

Last Published: 2017-07-25

Product(s): Appliances (3.0)

Overriding the NetBackup Virtual Appliance intrusion prevention system policy

To discourage accessing the root account, the appliance requires that you first disable the intrusion prevention system (IPS) policy. For example, using the elevate command under Support > Maintenance fails unless the IPS policy is disabled.

Warning:

Disabling the IPS policy is not recommended as it puts the system at risk and vulnerable to attack.

You can use the NetBackupCLI user role to run NetBackup commands without overriding the IPS policy. See About the NetBackupCLI user role.

Note:

Overriding the IPS policy disables only the appliance intrusion prevention system. The appliance intrusion detection system (IDS) logging is still enabled and every activity under the maintenance account is still logged.

To override the appliance IPS policy

Log on to the NetBackup Virtual Appliance Shell Menu as an administrator.
Enter the Support > Maintenance command to bring up the Maintenance Mode login prompt. Enter the Maintenance user account password to log into Maintenance Mode.
```
app123.Support> Maintenance
<!-- Maintenance Mode --!>
maintenance's password:
```

In Maintenance Mode, type the following command to override the IPS policy:

/opt/Symantec/sdcssagent/IPS/sisipsoverride.sh

The following message is displayed:

Symantec Critical Protection Policy Override

Agent Version: 6.5.0 (build 355)

Current Policy: NetBackup Appliance Prevention Policy, r33

Policy Prevention: Enabled

Policy Override: Allowed

Override State: Not overridden

To override the policy and disable protection, 
enter your login password.

Password:

Enter the Maintenance user account password. The following options are displayed:

Choose the type of override that you wish to perform:

1. Override Prevention except for Self Protection

2. Override Prevention Completely

Choice?

Enter 1 to override prevention except for self-protection.
Note:
Veritas recommends that you use Option 1. Selecting Option 1 allows modification only to the NetBackup Virtual Appliance Shell Menu and not to the SDCS agent.
The following options are displayed:
```
Choose the amount of time after which to automatically re-enable:

1. 15 minutes

2. 30 minutes

3. 1 hour

4. 2 hours

5. 4 hours

6. 8 hours
```
Enter the appropriate number from 1 to 7 based on the amount of time that is required to debug the support case.
The appliance displays the following message:
```
Enter a comment. Press Enter to continue.
```

Enter a relevant comment as to why the override is required. For example:

Enter a comment. Press Enter to continue.

Disabling the security policy for 
debugging support case no - XYZ

The appliance overrides the policy and displays the following message:

Please wait while the policy is being overridden.
........

The policy was successfully overridden.
maintenance - !> elevate

You should now have access to the root account for debugging the appliance.

More Information

Re-enabling the NetBackup Virtual Appliance intrusion prevention system policy

About the NetBackup Virtual Appliance intrusion prevention system