NetBackup and Veritas Appliances Hardening Guide
- Top recommendations to improve your NetBackup and Veritas appliances security posture
- Introduction
- Keeping all systems and software updated
- Enabling multifactor authentication
- Enabling multiperson authorization
- Increasing the security level
- Implementing an immutable data vault
- Securing credentials
- Reducing network exposure
- Enabling encryption
- Enabling catalog protection
- Enabling malware scanning and anomaly detection
- Enabling security observability
- Restricting user access
- Configuring a sign-in banner
- Steps to protect Flex Appliance
- About Flex Appliance hardening
- Managing multifactor authentication
- Configuring the multi-factor authentication on NetBackup primary and media server instance
- Configuring the multi-factor authentication on NetBackup WORM storage server instance
- Managing single sign-on (SSO)
- Managing user authentication with smart cards or digital certificates
- About lockdown mode
- Using network access control
- Using an external certificate
- Forwarding logs
- Creating a NetBackup WORM storage server instance
- Configuring an isolated recovery environment using the web UI
- Protecting the NetBackup catalog on a WORM storage server
- Using a sign-in banner
- Steps to protect NetBackup Appliance
- About NetBackup Appliance hardening
- About multifactor authentication
- About single sign-on (SSO) authentication and authorization
- About authentication using smart cards and digital certificates
- Disable user access to the NetBackup appliance operating system
- About Network Access Control
- About data encryption
- FIPS 140-2 conformance for NetBackup Appliance
- About implementing external certificates
- About antimalware protection
- About forwarding logs to an external server
- Creating the appliance login banner
- Steps to protect NetBackup
- About NetBackup hardening
- About multifactor authentication
- Configure NetBackup for single sign-on (SSO)
- Configure user authentication with smart cards or digital certificates
- Workflow to configure multi-person authorization for NetBackup operations
- Access codes
- Workflow to configure immutable and indelible data
- Add a configuration for an external CMS server
- Configuring an isolated recovery environment on a NetBackup BYO media server
- About FIPS support in NetBackup
- Installing KMS
- Workflow for external KMS configuration
- Validating KMS credentials
- Configuring KMS credentials
- Configuring KMS
- Creating keys in an external KMS
- Workflow to configure data-in-transit encryption
- Workflow to use external certificates for NetBackup host communication
- About certificate revocation lists for external CA
- Configure an external certificate for the NetBackup web server
- Configuring the primary server to use an external CA-signed certificate
- Configuring an external certificate for a clustered primary server
- Configuring a NetBackup host (media server, client, or cluster node) to use an external CA-signed certificate after installation
- Configuration options for external CA-signed certificates
- ECA_CERT_PATH for NetBackup servers and clients
- ECA_TRUST_STORE_PATH for NetBackup servers and clients
- ECA_PRIVATE_KEY_PATH for NetBackup servers and clients
- ECA_KEY_PASSPHRASEFILE for NetBackup servers and clients
- ECA_CRL_CHECK for NetBackup servers and clients
- ECA_CRL_PATH for NetBackup servers and clients
- ECA_CRL_PATH_SYNC_HOURS for NetBackup servers and clients
- ECA_CRL_REFRESH_HOURS for NetBackup servers and clients
- ECA_DISABLE_AUTO_ENROLLMENT for NetBackup servers and clients
- ECA_DR_BKUP_WIN_CERT_STORE for NetBackup servers and clients
- MANAGE_WIN_CERT_STORE_PRIVATE_KEY option for NetBackup primary servers
- Guidelines for managing the primary server NetBackup catalog
- About protecting the MSDP catalog
- How to set up malware scanning
- About backup anomaly detection
- Send audit events to system logs
- Send audit events to log forwarding endpoints
- Display a banner to users when they sign in
- Steps to protect NetBackup Flex Scale
- About NetBackup Flex Scale hardening
- About the security meter
- STIG overview for NetBackup Flex Scale
- FIPS overview for NetBackup Flex Scale
- Managing the login banner
- Changing the password policy
- Support for immutability in NetBackup Flex Scale
- Authenticating users using digital certificates or smart cards
- About system certificates on NetBackup Flex Scale
- Deploying external certificates on NetBackup Flex Scale
- About multifactor authentication
- Considerations before configuring multifactor authentication
- Configuring multifactor authentication for your user account
- Disabling multifactor authentication for your user account
- Enforcing multifactor authentication for all users
- Configuring multifactor authentication for your user account when it is enforced in the cluster
- Resetting multifactor authentication for a user
- About single sign-on (SSO) configuration
Changing the password policy
You can customize the password policies by setting rules for the passwords that are used by the NetBackup Flex Scale local users. You can set rules for password complexity, password age, and password lockout. Password complexity specifies the number and type of characters a password must include. Password age defines the duration for which the password is valid. Password lockout specifies the number of failed attempts because of incorrect usage of passwords after which a user is prevented from logging in to the account.
The default password policy for a local user is as follows:
Password complexity:
Minimum characters: 8
Minimum numbers: 1
Minimum lowercase characters: 1
Minimum uppercase characters: 1
Minimum special characters: 1
Note:
Ensure that you change the password policy from the NetBackup Flex Scale infrastructure management UI or the NetBackup Flex Scale web UI. If you change the password policy in the NetBackup UI, the changes are not reflected in NetBackup Flex Scale.
To edit the password policy:
- Use any one of the following options to log in using the user account that you created:
Use a user account with both Appliance Administrator and NetBackup Administrator role, or a user account with only an Appliance administrator role to log in to the NetBackup Flex Scale web interface
https://ManagementServerIPorFQDN/webuiwhere ManagementServerIPorFQDN is the public IP address, the FQDN, or the short host name that you specified for the NetBackup Flex Scale management server and API gateway during the cluster configuration, and then in the left pane click Cluster Management > Cluster settings > User management.Use a user account with an Appliance Administrator role to log in to the NetBackup Flex Scale infrastructure management console
https://ManagementServerIPorFQDN:14161where ManagementServerIPorFQDN is the public IP address, the FQDN, or the short host name that you specified for the NetBackup Flex Scale management server and API gateway during the cluster configuration, and then in the left pane click Settings > User management.Note:
If you access the NetBackup Flex Scale infrastructure management console by using the short host name from a node, set the DNS settings (name server, domain name, and search domain) or ensure that the entry for mapping the short host name to an IP address exists in the hosts file of the node.
- Click Manage password policy.
- On the Manage password policy page, click Edit.
- If you want your password policy to comply with STIG, select Reset to STIG default values to fill in the default values for all the parameters.
- Edit the parameters as required. To ignore a rule, leave the corresponding parameter blank. After making the changes click Save.
Table:
Parameter | Description |
|---|---|
Minimum characters | Minimum number of characters to include in a password |
Minimum uppercase characters | Minimum number of uppercase characters to include in a password |
Maximum repetitive characters of the same class | Maximum number of consecutive uppercase, lowercase, numeric, and special characters |
Minimum numbers | Minimum number of numeric characters |
Minimum special characters | Minimum number of special characters in a password |
Minimum character classes | Minimum character classes to include in a password. Character classes include uppercase, lowercase, numeric, and special characters. |
Minimum lowercase characters | Minimum number of lowercase characters |
Maximum repetitive characters | Maximum number of characters that can be repeated in a password. |
Character difference with old password | Number of characters the new password must differ by from the previous password |
Days after which password can be changed | Number of days after which a password can be changed |
Days after which password must be changed | Number of days after which a password must be changed |
Days before warning message | Number of days before the password expires to display a warning |
Minimum different passwords before allowing reuse | Number of unique passwords before a previous password can be reused |
Number of incorrect login attempts before lockout | Number of failed login attempts after which the account gets locked |
Time before locked account is reenabled | Duration in seconds the account remains locked |
Time between login failures before account lockout | Number of seconds between consecutive failed login attempts |