NetBackup and Veritas Appliances Hardening Guide

Last Published:
Product(s): Appliances (10.3, 5.3, 4.0), NetBackup & Alta Data Protection (10.3, 5.3, 4.0)
Platform: Flex Appliance OS,NetBackup Appliance OS,Linux,Windows,UNIX
  1. Top recommendations to improve your NetBackup and Veritas appliances security posture
    1.  
      Introduction
    2.  
      Keeping all systems and software updated
    3.  
      Enabling multifactor authentication
    4.  
      Enabling multiperson authorization
    5.  
      Increasing the security level
    6.  
      Implementing an immutable data vault
    7.  
      Securing credentials
    8.  
      Reducing network exposure
    9.  
      Enabling encryption
    10.  
      Enabling catalog protection
    11.  
      Enabling malware scanning and anomaly detection
    12.  
      Enabling security observability
    13.  
      Restricting user access
    14.  
      Configuring a sign-in banner
  2. Steps to protect Flex Appliance
    1.  
      About Flex Appliance hardening
    2. Managing multifactor authentication
      1.  
        Configuring or reconfiguring multifactor authentication
      2.  
        Enforcing multifactor authentication
    3.  
      Configuring the multi-factor authentication on NetBackup primary and media server instance
    4.  
      Configuring the multi-factor authentication on NetBackup WORM storage server instance
    5. Managing single sign-on (SSO)
      1.  
        Managing identity providers (IDPs)
      2.  
        Importing single sign-on (SSO) users
    6.  
      Managing user authentication with smart cards or digital certificates
    7. About lockdown mode
      1.  
        Changing the lockdown mode
    8.  
      Using network access control
    9.  
      Using an external certificate
    10.  
      Forwarding logs
    11.  
      Creating a NetBackup WORM storage server instance
    12. Configuring an isolated recovery environment using the web UI
      1.  
        Configuring the allowed subnets
      2.  
        Configuring the reverse connections
      3.  
        Configuring the reverse replication schedule
      4.  
        Adding a replication operation to SLP at the production primary server
    13.  
      Protecting the NetBackup catalog on a WORM storage server
    14.  
      Using a sign-in banner
  3. Steps to protect NetBackup Appliance
    1.  
      About NetBackup Appliance hardening
    2.  
      About multifactor authentication
    3. About single sign-on (SSO) authentication and authorization
      1.  
        Configure single sign-on (SSO) for a NetBackup Appliance
    4. About authentication using smart cards and digital certificates
      1.  
        2FA
      2.  
        Smart card Authentication for NetBackup Web UI
      3.  
        Smart card authentication for NetBackup Appliance Web UI
      4.  
        Smart card authentication for NetBackup Appliance Shell Menu
      5.  
        Configure role-based access control
      6.  
        Configure authentication for a smart card or digital certificate for the NetBackup Web UI
    5.  
      Disable user access to the NetBackup appliance operating system
    6.  
      About Network Access Control
    7. About data encryption
      1.  
        KMS support
    8.  
      FIPS 140-2 conformance for NetBackup Appliance
    9.  
      About implementing external certificates
    10.  
      About antimalware protection
    11. About forwarding logs to an external server
      1.  
        Uploading certificates for TLS
      2.  
        Enabling log forwarding
    12.  
      Creating the appliance login banner
  4. Steps to protect NetBackup
    1.  
      About NetBackup hardening
    2. About multifactor authentication
      1.  
        Configure multi-factor authentication for your user account
      2.  
        Enforce multi-factor authentication for all users
    3. Configure NetBackup for single sign-on (SSO)
      1.  
        Configure the SAML KeyStore
      2.  
        Configure the SAML keystore and add and enable the IDP configuration
      3.  
        Enroll the NetBackup primary server with the IDP
    4. Configure user authentication with smart cards or digital certificates
      1.  
        Configure smart card authentication with a domain
      2.  
        Configure smart card authentication without a domain
    5. Workflow to configure multi-person authorization for NetBackup operations
      1.  
        NetBackup operations that need multi-person authorization
      2.  
        RBAC roles and permissions for multi-person authorization
      3.  
        Configure multi-person authorization
    6. Access codes
      1.  
        Request CLI access through web UI authentication
      2.  
        Approve the CLI access request of another user
    7. Workflow to configure immutable and indelible data
      1.  
        About configuring disk pool storage
      2.  
        Use WORM setting
      3.  
        Creating a backup policy
    8. Add a configuration for an external CMS server
      1.  
        Add a credential for CyberArk
    9. Configuring an isolated recovery environment on a NetBackup BYO media server
      1.  
        Configuring A.I.R. for replicating backup images from production environment to IRE BYO environment
    10. About FIPS support in NetBackup
      1.  
        Enable FIPS mode on NetBackup during installation
      2.  
        Enable FIPS mode on a NetBackup host after installation
      3.  
        Enable FIPS mode for the NetBackup Authentication Broker service
      4.  
        Enable FIPS mode for the NetBackup Administration Console
      5.  
        NB_FIPS_MODE option for NetBackup servers and clients
    11.  
      Installing KMS
    12. Workflow for external KMS configuration
      1.  
        Validating KMS credentials
      2.  
        Configuring KMS credentials
      3.  
        Configuring KMS
      4.  
        Creating keys in an external KMS
      5. Workflow to configure data-in-transit encryption
        1.  
          Configure the global data-in-transit encryption setting
        2. Configure the DTE mode on a client
          1.  
            DTE_CLIENT_MODE for clients
        3. How DTE configuration settings work in various NetBackup operations
          1.  
            Backup
          2.  
            Restore
          3.  
            MSDP backup, restore, and optimized duplication
          4.  
            Universal-Share policy backup
          5.  
            Catalog backup and recovery
          6.  
            Duplication
          7.  
            Synthetic backup
          8.  
            Verify
          9.  
            Import
          10.  
            Replication
        4.  
          Configure the DTE mode on the media server
        5. Modify the DTE mode on a backup image
          1.  
            DTE_IGNORE_IMAGE_MODE for NetBackup servers
    13. Workflow to use external certificates for NetBackup host communication
      1. About certificate revocation lists for external CA
        1.  
          How CRLs from ECA_CRL_PATH are used
        2.  
          How CRLs from CDP URLs are used
      2.  
        Configure an external certificate for the NetBackup web server
      3.  
        Configuring the primary server to use an external CA-signed certificate
      4. Configuring an external certificate for a clustered primary server
        1. Configuration options for external CA-signed certificates for a virtual name
          1.  
            CLUSTER_ECA_CERT_PATH for clustered primary server
          2.  
            CLUSTER_ECA_TRUST_STORE_PATH for clustered primary server
          3.  
            CLUSTER_ECA_PRIVATE_KEY_PATH for clustered primary server
          4.  
            CLUSTER_ECA_KEY_PASSPHRASEFILE for clustered primary server
      5. Configuring a NetBackup host (media server, client, or cluster node) to use an external CA-signed certificate after installation
        1.  
          Enrolling an external certificate for a remote host
      6. Configuration options for external CA-signed certificates
        1. ECA_CERT_PATH for NetBackup servers and clients
          1.  
            Specifying Windows certificate store for ECA_CERT_PATH
        2.  
          ECA_TRUST_STORE_PATH for NetBackup servers and clients
        3.  
          ECA_PRIVATE_KEY_PATH for NetBackup servers and clients
        4.  
          ECA_KEY_PASSPHRASEFILE for NetBackup servers and clients
        5.  
          ECA_CRL_CHECK for NetBackup servers and clients
        6.  
          ECA_CRL_PATH for NetBackup servers and clients
        7.  
          ECA_CRL_PATH_SYNC_HOURS for NetBackup servers and clients
        8.  
          ECA_CRL_REFRESH_HOURS for NetBackup servers and clients
        9.  
          ECA_DISABLE_AUTO_ENROLLMENT for NetBackup servers and clients
        10.  
          ECA_DR_BKUP_WIN_CERT_STORE for NetBackup servers and clients
        11.  
          MANAGE_WIN_CERT_STORE_PRIVATE_KEY option for NetBackup primary servers
    14.  
      Guidelines for managing the primary server NetBackup catalog
    15. About protecting the MSDP catalog
      1. About the MSDP shadow catalog
        1.  
          Changing the MSDP shadow catalog path
        2.  
          Changing the MSDP shadow catalog schedule
        3.  
          Changing the number of MSDP catalog shadow copies
      2.  
        About the MSDP catalog backup policy
    16. How to set up malware scanning
      1.  
        Prerequisites for a scan host
      2.  
        Configuring a new scan host pool
    17. About backup anomaly detection
      1.  
        Detecting backup anomalies on the primary server
      2.  
        Detecting backup anomalies on the media server
      3.  
        Configure backup anomaly detection settings
      4.  
        View backup anomalies
    18.  
      Send audit events to system logs
    19.  
      Send audit events to log forwarding endpoints
    20.  
      Display a banner to users when they sign in

About multifactor authentication

Starting with NetBackup Appliance release 5.3, multifactor authentication is supported.

Multifactor authentication requires users to verify their appliance login identity by means of a system-generated code that is required in addition to the standard login password. When multifactor authentication is enabled, each time you log in to the appliance you enter your username and password as usual. Next, you are prompted through a remote device, such as a smartphone, to enter a second factor to verify your identity. When you open the app on your smartphone, it shows a unique 6-digit code that you must enter to complete the login.

Note:

You cannot use multifactor authentication if Smart Card configuration is enabled.

An administrator must configure their user account for multifactor authentication before other users can con configure their user accounts. Configuration for the feature is done from the following NetBackup Appliance Shell Menu view:

Main > Settings > Security > Authentication > MFA

For complete details and descriptions of the command options for this feature, see the NetBackup Appliance Commands Reference Guide.

After the first administrator has configured their user account for multifactor authentication, all of the following appliance users can configure their user accounts:

  • Active Directory (AD)

  • LDAP

  • Local users

  • NetBackup CLI users

  • No-role users

Note:

NetBackupCLI and no-role users must log in to the appliance and run the multifactor-authentication command, then run the available submenu commands. For complete details, see the Settings > Security > Authentication > MFA description in the NetBackup Appliance Commands Reference Guide.

First-time configuration for multifactor authentication

This section describes how an administrator configures their user account for multifactor authentication to allow all other users to configure their user accounts later.

Requirements for administrator configuration:

  • Minimum of two administrator accounts - The appliance must have at least two administrator accounts before they can configure multifactor authentication for their user accounts. If only one administrator user account exists when another user tries to configure the feature, an error message appears to inform them to add another administrator user account.

  • Minimum of one NTP server - At least one NTP server must be configured and added before the first administrator can configure multifactor authentication for their user account. A message appears if an NTP server is needed.

    Note:

    The NTP server is typically configured when you perform the initial configuration on the appliance. If you did not configure an NTP server at that time, you must log in to the appliance shell menu and configure at least one NTP server with the Main > Network > NTPServer command. For details, see the NetBackup Appliance Commands Reference Guide.

  • After the above configurations are completed, all other appliance users can configure their user accounts.

The following procedure describes the first-time configuration for an administrator to configure their user account for multifactor authentication.

For first-time administrator user account configuration for multifactor authentication

  1. Log in to the shell menu as an administrator with the following command:

    Main > Settings > Security > Authentication > MFA Configure

  2. Follow the prompts to configure multifactor authentication for your user account.
  3. After completing the previous steps, have another administrator log in to the appliance with the following command to configure their user account to use multifactor configuration:

    Main > Settings > Security > Authentication > MFA Configure

  4. To enforce multifactor authentication for all users of the appliance, run the following command:

    Main > Settings > Security > Authentication > MFA Enforce

    Note:

    You can run this command only after you have completed steps 1, 2, and 3.

Configure multifactor authentication for a user account

After the two required administrators have completed their user account configurations, all other appliance users can configure their user accounts.

Requirements for user configuration:

  • If multifactor authentication is configured but not enforced for all users (global enforcement), a user can configure or unconfigure multifactor authentication for their account at any time.

  • If multifactor authentication is configured and is also enforced for all users, a user can unconfigure multifactor authentication for their account only within a defined grace period. The grace period default is 90 days. After the grace period has expired, the user is forced to configure multifactor authentication during login, but they cannot unconfigure it.

To configure multifactor authentication for a user account

  1. Log in to the appliance shell menu and run the following command to configure your user account for multifactor authentication:

    Main > Settings > Security > Authentication > MFA Configure

    For NetBackupCLI users and no-role users, log in to the appliance and run the multifactor-authentication command, then run the Configure submenu command.

  2. Follow the prompts to configure multifactor authentication for your user account.