Veritas Solution Guide for Sheltered Harbor

To configure the Sheltered Harbor solution

1. Run either of the following commands on the command prompt:

   • nbshvault --configure

   • nbshvault --configure [--config-dir config-dir-path]

   If you have provided the config-dir option during configuration, you should use the config-dir option in the command as well.

2. Enter the Institution ID.
3. Enter the following logging information about the Sheltered Harbor solution:

   • Maximum log file size (default size is 10 MB).

     The Sheltered Harbor solution rotates the log when the log file size exceeds to the maximum log file size.

   • Verbose value (default value is 2).

     You need to specify the verbose value between 2 to 5 to see warning, and critical level message in the log file. To see the debug level messages, specify the verbose value as 6.

4. Enter the Sheltered Harbor license file path.

   Note:

   Sheltered Harbor validates licenses of financial institutions every year. The license file needs to be provisioned on the NetBackup client where the Sheltered Harbor solution runs.

   Note:

   Ensure that you have the read permissions to the license file to run the nbshvault command.

5. Enter monitoring log type such as Live monitor or Stage monitor to send an attestation message after successful data vaulting. 
6. Select the solution type such as Veritas Alta™ Solution for Sheltered Harbor or Veritas NetBackup™ Solution for Sheltered Harbor.

   Note:

   Veritas Alta™ Solution for Sheltered Harbor is the default option selected.

7. Enter the NetBackup API key path when you select the solution type as Veritas NetBackup™ Solution for Sheltered Harbor.

   For more information about NetBackup API key, see https://www.veritas.com

   Note:

   You need to create NetBackup API key using NetBackup web UI beforehand with the required RBAC permissions. You must add the NetBackup API key in the text file with the following format <primary server name>:<NetBackup API key>.

   Ensure that you have the read permissions to the API key path.

8. Enter the primary server backup policy.

   Note:

   The storage unit value in the primary server backup policy needs to be configured with the immutable cloud storage bucket or with the storage lifecycle policy replicating the image to IRE domain on immutable storage.

9. Enter the following details for KMIP based KMS and Azure key vault:

   Select KMIP based KMS or Azure Key Vault.

   For example, (KMIP, Azure).

   If you enter KMIP based KMS, do the following:

   • Enter the KMS server name:

   • Enter the KMIP port [5696 is default]:

   • Enter the absolute path of certificate file:

   • Enter the absolute path of private key file:

   • Enter the absolute path of CA certificate file:

   • Enter the envelope private encryption key ID:

   • Enter the envelope public encryption key ID:

   • Enter the envelope private sign key ID:

   • Enter the envelope public sign key ID:

   If you enter Azure Key Vault, do the following:

   • Enter Vault URI of Azure Key Vault:

   • Enter an authentication option for Azure Key Vault:

     • 1. Managed Identity

     • 2. Service principal with a Client Secret [1,2] : 2

   • Enter Azure client ID:

   • Enter Azure tenant ID:

   • Enter Azure Client secret path: /root/sharbor/storage/tsp/jsonf.json

   • Do you want to use online certificate status protocol (OCSP) [y,n] [n is default]:

   • Enter Azure envelope private encryption key ID: SH

   • Enter Azure envelope public encryption key ID: SH

   • Enter Azure envelope private sign key ID: SH

   • Enter Azure envelope public sign key ID: SH

10. If you want to configure the solution, the following information is asked:

    • Enter the proxy server hostname or IP address

    • Enter the proxy port [3128 is default]

    • Enter the proxy type

      • HTTP

      • HTTPS

      • SOCKS5 [1,2,3] [1 is default]

    • Do you want to configure proxy server authentication ? [y,n] (n):

    • Enter the username:

    • Enter the absolute path of the proxy server password file

Registration procedure

1. Run either of the following commands on the command prompt:

   • nbshvault --register

   • nbshvault --register [--config-dir config-dir-path]

   If you have provided the config-dir option during configuration, you should use the config-dir option in the command as well.

2. Enter the institution ID, and registration ID (provided by the Sheltered Harbor).

   The following example shows the register operation:

   nbshvault --register
   This operation generates private key and sends registration message 
   to the Sheltered Harbor monitoring log. 
   Do you want to continue? [y,n] (y) y 
   Enter the institution ID:
   Enter the registration key provided by Sheltered Harbor:
   Institution ID is already registered.

   On successfully running the command, the following message is displayed on the console:

   Registration successful. Status: 'Institution' is 
   registered successfully. Please use the same public/private key for 
   attestation Message: On Boarding Created

Backup procedure

1. Run either of the following commands:

   • nbshvault -b | --backup

   • nbshvault -b | --backup [config-dir config-dir-path]

   If you have provided the config-dir option during configuration, you should use the the same option for the command as well.

2. Enter the Institution ID.
3. Enter the input storage path and transfer storage path.

   Note:

   Use the --force option along with --backup when the backup JSON file is provided to continue with backup even though attestation for the last backup has failed.

   The backup and attest command options cannot run in parallel as they process the same set of files.

   The following example shows the backup operation:

   nbshvault -b
   This command backs up the data as per the Sheltered Harbor 
   compliance specifications. Do you want to continue? [y,n] (y)
   Enter the institution ID:
   Enter the input storage path:
   Enter the transfer storage path:
   

Restore procedure

1. Run either of the following commands on the command prompt:

   • nbshvault -r | --restore

   • nbshvault -r | --restore [--config-dir config-dir-path]

   If you have provided the config-dir option during configuration, you should use the same option in the command.

2. Enter the institution ID.
3. Enter the recovery storage path and restored data storage path.

   The following example shows the restore operation:

   nbshvault -r
   This command performs data restoration as per the 
   Sheltered Harbor compliance specifications. Do you want to continue? [y,n] (y)
   Enter the institution ID:
   Enter the recovery storage path: /root/recovery_storage/
   Enter the restored data storage path: /root/d4/
   

Attestation procedure

• Run either of the following commands on the command prompt to send the attestation message to complete the backup operation:

  • nbshvault --attest

  • nbshvault --attest [config-dir config-dir-path]