NetBackup™ Security and Encryption Guide

The following are prerequisites for using the Instant Access MSDP build-your-own (BYO) server feature:

• The Instant Access feature is supported on an MSDP BYO storage server with Red Hat Enterprise Linux 7.6 or later.

• The Instant Access feature is not supported on SUSE Linux.

• You must set up Active Directory-based user authentication for the Instant Access.

  For more information, see Active Directory-based authentication section in the Veritas NetBackup™ Deduplication Guide.

• NFS services must be installed and running if you want to use the instant access over NFS.

• Samba services must be installed and running if you want to use instant access over CIFS/SMB.

  You must configure Samba users on the corresponding storage server and enter the credentials on the client.

  For more information, see Active Directory-based authentication section in the Veritas NetBackup™ Deduplication Guide.

• (For NFS) Ensure that the nfs-utils is installed using the following command:

  yum install nfs-utils -y

• (For SMB)

  • Ensure that the Linux samba and samba winbind packages are installed using the following command:

    yum install samba samba-common samba-winbind samba-winbind-clients samba-winbind-modules -y

  • Ensure that the following commands are run to grant permissions to the SMB shares:

    setsebool -P samba_export_all_rw on

    setsebool -P samba_export_all_ro on

• NGINX is installed and running.

  • Installing NGINX from Red Hat Software Collections:

    Refer to https://www.softwarecollections.org/en/scls/rhscl/rh-nginx114/ for instructions.

    Because the package name depends on the NGINX version, run yum search rh-nginx to check if a new version is available. (For NetBackup 8.3, an EEB is required if NGINX is installed from Red Hat Software Collections.)

  • Installing NGINX from the EPEL repository:

    Refer to https://fedoraproject.org/wiki/EPEL for installation instructions of the repository and further information.

    The EPEL repository is a volunteer-based community effort and not commercially supported by Red Hat.

  • Before you start the storage configuration, ensure that the new BYO NGINX configuration entry /etc/nginx/conf.d/byo.conf is included as part of the HTTP section of the original /etc/nginx/nginx.conf file.

  • If SE Linux has been configured, ensure that the policycoreutils and policycoreutils-python packages are installed from the same RHEL yum source (RHEL server), and then run the following commands:

    semanage port -a -t http_port_t -p tcp 10087

    setsebool -P httpd_can_network_connect 1

    Enable the logrotate permission in SE Linux using the following command:

    semanage permissive -a logrotate_t

• After NGINX is installed, the HTTP web service at port 80 is enabled by default. Remove /etc/nginx/conf.d/default.conf or edit the file to disable the HTTP web service if it is not needed.

• Ensure that the /mnt folder on the storage server is not directly mounted by any mount points. Mount points should be mounted to its subfolders.

• If you configure the Instant Access feature on BYO after storage is configured or upgraded without the NGINX service installed, run the command:

  /usr/openv/pdde/vpfs/bin/vpfs_config.sh --configure_byo

• Ensure that the required network ports are open.

  See "NetBackup media server ports" in the NetBackup Network Ports Reference Guide.