Search <book_title>...

NetBackup and Veritas Appliances Hardening Guide

Last Published: 2024-04-04

Product(s): Appliances (10.3, 5.3, 4.0, 3.2), NetBackup & Alta Data Protection (10.3, 5.3, 4.0, 3.2)

Platform: Flex Appliance OS,NetBackup Appliance OS,NetBackup Flex Scale OS,Linux,UNIX,Windows

Authenticating users using digital certificates or smart cards

You can configure NetBackup Flex Scale to authenticate users with a smart card or a digital certificate. After configuration, the users can use the Sign in with certificate or smart card option to sign in to NetBackup Flex Scale UI using smart cards or digital certificates.

Before you configure user authentication using smart cards or digital certificates, note the following:

Digital certificate or smart card authentication can be configured for LDAP, AD, and local users.
Ensure that LDAP is configured if you want to authenticate LDAP users by using digital certificate or smart card.
Ensure that AD is configured if you want to authenticate AD users by using digital or smart.
Ensure that you create a local user if you want to authenticate local users by using digital or smart card.
Smart card authentication requires a list of trusted root or intermediate CA certificates. You must add the CA certificates that are associated with the user digital certificates or the user smart cards.

To authenticate users with a certificate or smart card for media server only deployment:

Use a user account with an Appliance Administrator role to log in to the NetBackup Flex Scale infrastructure management UI https://consoleIP:14161where consoleIP is the public IP address that you specified for the infrastructure management UI during the cluster configuration.
In the left pane click Settings > Security > Smart card authentication.
Use the slider to turn on smart card authentication.
In the Configure smart card authentication dialog box, specify the following options:
- In the user authentication domain list, specify the following information:
  - None, which is a default option, indicates that only local users can be authenticated using smart card.
  - For an AD user, select the configured AD server.
  - For an LDAP user, select the configured LDAP server.
- Under Certificate mapping attribute, to specify the user using the username format, click Common name. To specify the user using the username and domain format (for example, username@test.com) click User principal name.
- Optionally, enter the Online Certificate Status Protocol (OCSP) URI. OSCP is used for checking the validity of the certificate. The OCSP responder is a remote independent entity (certificate vendor authority). If you do not provide the OCSP URI, the URI in the user certificate is used.
- Click Save.
To the right of CA certificates click Add.
You can upload a CA certificate or a chain certificate. The leaf certificate can be created directly from root certificate or from an intermediate certificate. Chain certificate is a concatenation of root and intermediate certificate.
Click Browse to select the CA certificate or drag and drop the CA certificate and click Add.
Certificates must be in PEM format, with certificate file type as .pem. Only one certificate can be added at a time. The web server is restarted after you add the certificate and the certificate is added to the web server trust store /shared/cluster_certs/cac/. The selected CA certificate is displayed under CA certificates.
Upload the client certificate to the browser's certificate store. See the browser documentation for importing client certificates.
Add Appliance administrator user role to a smart card user. To add the Appliance administrator role to an AD, LDAP, or a local user, navigate to Settings > User management.
To log on using the smart card, when you enter the URL for the UI, you are prompted to select the certificate that you added to the browser trust store. Select the certificate to authenticate. Selecting the certificate is a one-time activity. You can now use the Sign in with certificate or smart card option to sign in to the UI.

To authenticate users with a certificate or smart card for a cluster where both the primary server and media servers are deployed:

Use a user account with both Appliance Administrator and NetBackup Administrator role to log in to the NetBackup Flex Scale web interface https://ManagementServerIPorFQDN/webui whereManagementServerIPorFQDN is the public IP address, the FQDN, or the short host name that you specified for the NetBackup Flex Scale management server during the cluster configuration.
At the top right, click Settings > Smart card authentication and follow the steps mentioned in the "Configuring authentication options" section of the NetBackup™ Web UI Administrator's Guide. After configuring smart card authentication, you need to perform additional steps before you can log in using a smart card. Continue to step 3.
Get the NetBackup Flex Scale web UI's root CA and intermediate certificates and upload it to browser:
- Navigate to Cluster Management > Cluster settings > Security > Certificates and click Download root certificate.
- The downloaded certificate contains two certificate keys in a single file. Separate the downloaded certificate in two files:
  - root_ca.pem: Upload to the browser's trusted root certificate store.
  - stem_ca.pem: Upload to the browser's intermediate certificate store.
Get NetBackup web root CA certificates and upload it to the browser. To get the NetBackup web certificate:
- Get the NetBackup web root CA certificate using swagger or using CURL API:
```
curl -X 'GET' \'https://primary-server-FQDN/netbackup/security/cacert' \ -H 'accept: application/vnd.netbackup+json;version=9.0'
```
- Copy the web root certificate from the received response to a file. Ensure that you replace the \n character with newline.
- Upload the web root CA certificate to update the SAN entries in the NetBackup web certificate.
- If you use Mozilla Firefox browser, enable network.cors_preflight.allow_client_cert to set it to true.
Log in to the NetBackup Flex Scale UI by clicking Sign in with certificate or smart card on login screen and when prompted select the certificate that you uploaded to the browser trust store.