NetBackup™ Security and Encryption Guide
- Read this first for secure communications in NetBackup
- Communication failure scenarios
- Increasing NetBackup security
- Security deployment models
- Auditing NetBackup operations
- About audit events
- Section I. Identity and access management
- About identity and access management
- AD and LDAP domains
- Access keys
- API keys
- Auth.conf file
- Role-based access control
- Default RBAC roles
- NetBackup interface access for OS Administrators
- Smart card or digital certificate
- Single Sign-On (SSO)
- NetBackup Access Control Security (NBAC)
- Configuring NetBackup Access Control (NBAC)
- Configuring Access Control host properties for the primary and media server
- Access Control host properties dialog for the client
- Troubleshooting Access Management
- Windows verification points
- UNIX verification points
- Verification points in a mixed environment with a UNIX primary server
- Verification points in a mixed environment with a Windows primary server
- About determining who can access NetBackup
- Viewing specific user permissions for NetBackup user groups
- Minimizing security configuration risk
- Configuring multifactor authentication
- Configuring multi-person authorization
- Section II. Encryption of data-in-transit
- NetBackup CA and NetBackup certificates
- About the Security Management utilities
- About host management
- Adding shared or cluster mappings
- Allowing or disallowing automatic certificate reissue
- About global security settings
- About host name-based certificates
- About host ID-based certificates
- Using the Certificate Management utility to issue and deploy host ID-based certificates
- About NetBackup certificate deployment security levels
- Setting up trust with the primary server (Certificate Authority)
- About reissuing host ID-based certificates
- About Token Management for host ID-based certificates
- About the host ID-based certificate revocation list
- About revoking host ID-based certificates
- Host ID-based certificate deployment in a clustered setup
- About deployment of a host ID-based certificate on a clustered NetBackup host
- Migrating NetBackup CA
- Configuring data-in-transit encryption (DTE)
- Configure the DTE mode on a client
- Modify the DTE mode on a backup image
- How DTE configuration settings work in various NetBackup operations
- External CA and external certificates
- About external CA support in NetBackup
- Configuration options for external CA-signed certificates
- ECA_CERT_PATH for NetBackup servers and clients
- About certificate revocation lists for external CA
- About certificate enrollment
- Configure an external certificate for the NetBackup web server
- About external certificate configuration for a clustered primary server
- Regenerating keys and certificates
- NetBackup CA and NetBackup certificates
- Section III. Encryption of data at rest
- Data at rest encryption security
- About NetBackup client encryption
- Configuring standard encryption on clients
- About configuring standard encryption from the server
- Configuring legacy encryption on clients
- About configuring legacy encryption from the client
- About configuring legacy encryption from the server
- Additional legacy key file security for UNIX clients
- NetBackup key management service
- About FIPS enabled KMS
- Installing KMS
- Configuring KMS
- About key groups and key records
- Overview of key record states
- Configuring NetBackup to work with KMS
- About using KMS for encryption
- KMS database constituents
- KMS operations using command-line interface (CLI)
- About exporting and importing keys from the KMS database
- Troubleshooting KMS
- External key management service
- Configuring KMS credentials
- Configuring KMS
- Creating keys in an external KMS
- Working with multiple KMS servers
- Data at rest encryption security
- Ciphers used in NetBackup for secure communication
- FIPS compliance in NetBackup
- Disable FIPS mode for NetBackup
- NetBackup web services account
- Running NetBackup services with non-privileged user (service user) account
- Running NetBackup commands with non-privileged user account
- Immutability and indelibility of data in NetBackup
- Anomaly detection
- Section IV. Malware scanning
- Introduction
- How to setup Malware scanning
- Instant Access configurations
- Malware tools configurations
- Scan host configurations
- Prerequisites for a scan host
- Configuring scan host
- Configuring a scan host pool
- Managing a scan host
- Performing malware scan
- Managing scan tasks
- Malware scan configuration parameters
- Troubleshooting
Configure a NetBackup Malware Scanner Linux
To configure a NetBackup Malware Scanner for Linux
- Download NetBackup Malware Scanner from Veritas Download Center.
- Extract the downloaded zip file. Files must contain the following structure;
NBAntiMalwareClient_version number_LinuxR_x86 savapi-sdk-linux64.zip setup.sh cleanup.sh NBAntiMalwareClient_version number_LinuxS_x86 -> NBAntiMalwareClient_version number_LinuxR_x86 savapi-sdk-linux64.zip setup.sh cleanup.sh
Warning:
The
setup.sh
script modifies thebashrc
file on Linux. - Refer to the
Readme.txt
file for install, upgrade, or uninstall processes.To install or upgrade NetBackup Malware Scanner on Linux RHEL computer.
Navigate to
NBAntiMalwareClient_ version number_LinuxR_x86
folder and run thesetup.sh
script using scanuser.Enter the target location to install the NetBackup Malware Scanner.
To install or upgrade NetBackup Malware Scanner on Linux SUSE computer:
Navigate to
NBAntiMalwareClient_version number_LinuxS_x86
folder and run thesetup.sh
script using scanuser.Enter the target location to install the NetBackup Malware Scanner.
Note:
For Linux SUSE computer, if
.bashrc
file is not present then create an emtpy.bashrc
file in users home directory.To uninstall NetBackup Malware Scanner from Linux computer:
Run the
cleanup.sh
script.
- To validate that the scan works with the NetBackup Malware Scanner on a Linux setup, perform the following:
Run the ./update.sh script to get the latest signature update.
Navigate to NetBackup Malware Scanner installed path and run the avira_lib_dir_scan binary with the required scan path and
conf_path
parameters.Configuration file must be present in NetBackup Malware Scanner installed path.
For example,
avira_lib_dir_scan "/root/malwareSample" -log_path "/root/NBMalwareScanner.log" -conf_path "/root/NBMalwareScannerInstalledPath/savapi-sdk-linux64/bin/aviraconf.txt
Ensure that the output of the command is successful. For existing sample malware files, the output must be a list of infected files. Else the output must be empty.