Search <book_title>...

NetBackup™ Security and Encryption Guide

Last Published: 2024-03-27

Product(s): NetBackup & Alta Data Protection (10.4)

Prerequisites for a scan host

A scan host is a host machine that has the required malware tool configured. Once it is integrated with NetBackup, NetBackup initiates scanning on the scan host.

Ensure that you meet the following prerequisites:

The minimum required configuration for the scan host is 8 CPU and 32-GB RAM.
The malware tool must be installed and configured.
For the supported operating systems of the scan host, refer Software Compatibility List.
The scan host must have a share type configured, that is, an NFS or SMB client.
NetBackup footprint is not required on the scan host. The existing systems with the NetBackup client or media server can be used as scan host, too.
The scan host must be reachable from the media server over SSH.
Note:
SSH connection to scan host from the media server must be successful.
The malware tool extracts the archives to a temporary location for scanning purposes.
Linux scan host: /tmp is used
Windows scan host: %TEMP% is used
For archive scanning purposes, it is recommended to have free disk space of 10 GB on scan host.
Note:
Any other malware scanners installed on scan host with on-access/real time protection enabled can interfere with backup scanning. Hence it is advised to disable or add NFS/SMB mounts on the scan host to exclusion list of the scanner.
For example, on Windows scan host, user must disable the Real time protection option of the Windows Defender while malware scan is in progress.
For supporting non-English characters on Windows scan host, enable multibyte characters support.
For more information on enabling multibyte characters support in Microsoft Windows Server 2019, refer to Retrieve Data in UTF-8 on Windows.
Depending on the platform, perform the following:
(For Windows)
- OpenSSH must be configured on windows scan host. Create the firewall rule for OpenSSH so that scan host is accessible from media server.
Note the following:
- For Windows 2016, get OpenSSH from GIT hub repository and for Windows 2019, enable OpenSSH server feature. For more details, refer to Microsoft documentation.
- Microsoft Visual C/C++ Redistributable is an additional dependency if media server is updated to 10.1.1 and above.
  Visual C/C++ run-time library DLL is required to execute nbmalwareutil utility on windows scan host. The runtime DLL can be obtained from Microsoft Visual C++ Redistributable latest supported downloads.
(For Linux)
- For Linux scan host default login shell must be bash.
- For NetBackup malware detection utility to execute on scan host, install libnsl.so.1 library on scan host. If the latest version of libnsl library file is present (for example, /usr/lib64/libnsl.so.2), then create a softlink file /usr/lib64/libnsl.so.1 which points to /usr/lib64/libnsl.so.2 file.
  Example for creating softlink file:
  # cd /usr/lib64 # ln -sf libnsl.so.2 libnsl.so.1
  Note:
  For assistance on installing libnsl* library file, contact operating system administrator.
- For non-administrator user on windows: Non-administrator user of windows scan host must be added to the administrators group.
- For non-root user on Linux:
  - Allow ssh connection using non-root user.
    For example: Add the Allow Users root scanuser entry in the /etc/ssh/sshd_config file.
    Note:
    Scan user is a non-root user created in the system.
  - Provide user permission to mount and umount. Add user permission entry in sudoers file.
    For example: In the /etc/sudoers file add one of the following:
    scanuser ALL=(ALL) NOPASSWD:ALL
    scanuser ALL=(ALL) NOPASSWD:/bin/umount, /bin/mount
  - Configure malware tool using non-root user on the scan host.
    Note:
    If scanning is done using root user, then change the permission of the /tmp/malware folder to provide write permissions to the non-root user.
    Note:
    For example: chmod a+rwx /tmp/malware

Prerequisites for configuring scan host using Ansible

The minimum required configuration for the scan host is 8 CPU and 32-GB RAM.
For the supported operating systems of the scan host, refer Software Compatibility List.
NetBackup footprint is not required on the scan host. The existing systems with the NetBackup client or media server can be used as scan host, too.
(For Linux) The scan host must be reachable from the media server over SSH.
Note:
SSH connection to scan host from the media server must be successful.

See Configuring scan host using Ansible.

Prerequisites for Windows scan host for NFS share type

Run the scan host credential validation again from Web UI if changes are done to ID mapping.

Enable local passwd file mapping using PowerShell:

C:\Users\Administrator> Set-NfsMappingStore -EnableUNMLookup  $True  -UNMServer localhost
C:\Users\Administrator> nfsadmin mapping
 
The following are the settings on localhost
 
Mapping Server Lookup       : Enabled
Mapping Server              : localhost
AD Lookup                   : Disabled
AD Domain                   :

The entry must be as follows in the respective files (in file type format):
Note:
Ensure that the scanuser and scangroup are created. The scanuser must be part of the scangroup and Administrators group.
In C:\Windows\System32\drivers\etc\passwd file:
```
scanuser:x:1001:1001:Description:C:\Users\scanuser
```
In C:\Windows\System32\drivers\etc\group file:
```
scangroup:x:1001:1001
```
Restart nfsadmin client as follows:
nfsadmin client stop
nfsadmin client start

Verify the ID (UID/GID) mapping for user by running the following command using PowerShell:

Get-NfsMappedIdentity -AccountName scanuser -AccountType User

UserIdentifier      : 1001
GroupIdentifier     : 1001
UserName            : scanuser
PrimaryGroup        :
SupplementaryGroups :

Note:

For VMware and cloud workload policy scanning, UID and GID mapping must be set to 0.

(If scan host is created in Azure or AWS from marketplace images) Enable root access for scan host as follows:

Change the root password using the following command:
- sudo -i passwd
Change /etc/ssh/sshd_config file to provide the permit for root login as follows:
```
"PermitRootLogin yes" 
"PasswordAuthentication yes"
```
Restart the service with the following command:
- service sshd reload
Change /etc/cloud/cloud.cfg file as follows to enable root user:
disable_root 0