Search <book_title>...

NetBackup™ Cloud Administrator's Guide

Last Published: 2024-03-27

Product(s): NetBackup & Alta Data Protection (10.4)

Amazon S3 cloud storage server configuration options

Note:

To access these properties, in the web UI select Hosts > Host properties. Select the primary server and click Edit primary server. Then click Cloud Storage.

The following tables describe the SSL, HTTP header configuration, and proxy server options that are specific to all Amazon S3-compatible cloud providers.

Table: General settings tab options

Option	Description
Use SSL	Select Use SSL if you want to use the SSL (Secure Sockets Layer) protocol for user authentication or data transfer between NetBackup and cloud storage provider. Authentication only. Select this option if you want to use SSL only at the time of authenticating users while they access the cloud storage. Data transfer. Select this option if you want to use SSL to authenticate users and transfer the data from NetBackup to the cloud storage. Note: NetBackup supports only Certificate Authority (CA) signed certificates while it communicates with cloud storage in the SSL mode. Ensure that the cloud server (public or private) has a CA-signed certificate. If it does not have the CA-signed certificate, data transfer between NetBackup and cloud provider fails in the SSL mode. Note: The FIPS region of Amazon GovCloud cloud provider (that is s3-fips-us-gov-west-1.amazonaws.com) supports only secure mode of communication. Therefore, if you disable the Use SSL option while you configure Amazon GovCloud cloud storage with the FIPS region, the configuration fails. Note: Glacier service endpoint for the Amazon GovCloud cloud provider (that is glacier.us-gov-west-1.amazonaws.com) supports only secure mode of communication using the NetBackup GLACIER_VAULT storage class. Therefore, if you disable the Use SSL option while you configure Amazon GovCloud cloud storage with GLACIER_VAULT storage class, the configuration fails.
HTTP headers	Specify then appropriate value for the selected HTTP header. Click the Value column to see the drop-down list and select the value. x-amz-server-side-encryption. Select AE256 from the Value drop-down list, if you want to protect data in Amazon S3 cloud storage. AE256 stands for 256-bit Advanced Encryption Standard. By setting the header value to AE256, every object that Amazon S3 cloud storage receives is encrypted before it is stored in the cloud. Amazon S3 server-side encryption uses one of the strongest block ciphers available, that is AE256 to encrypt your data. Additionally, it encrypts the key itself with a primary key that it regularly rotates. Note: If you have already enabled the encryption option when you created the Amazon S3 cloud storage server, you do not need to enable this option. The data is already encrypted before NetBackup sends it over the network. Storage class is configured at the time of creating the storage server. After it is configured, the storage class is non-editable.

Option

Description

Use SSL

Select Use SSL if you want to use the SSL (Secure Sockets Layer) protocol for user authentication or data transfer between NetBackup and cloud storage provider.

Authentication only. Select this option if you want to use SSL only at the time of authenticating users while they access the cloud storage.
Data transfer. Select this option if you want to use SSL to authenticate users and transfer the data from NetBackup to the cloud storage.

Note:

NetBackup supports only Certificate Authority (CA) signed certificates while it communicates with cloud storage in the SSL mode. Ensure that the cloud server (public or private) has a CA-signed certificate. If it does not have the CA-signed certificate, data transfer between NetBackup and cloud provider fails in the SSL mode.

Note:

The FIPS region of Amazon GovCloud cloud provider (that is s3-fips-us-gov-west-1.amazonaws.com) supports only secure mode of communication. Therefore, if you disable the Use SSL option while you configure Amazon GovCloud cloud storage with the FIPS region, the configuration fails.

Note:

Glacier service endpoint for the Amazon GovCloud cloud provider (that is glacier.us-gov-west-1.amazonaws.com) supports only secure mode of communication using the NetBackup GLACIER_VAULT storage class. Therefore, if you disable the Use SSL option while you configure Amazon GovCloud cloud storage with GLACIER_VAULT storage class, the configuration fails.

HTTP headers

Specify then appropriate value for the selected HTTP header. Click the Value column to see the drop-down list and select the value.

x-amz-server-side-encryption. Select AE256 from the Value drop-down list, if you want to protect data in Amazon S3 cloud storage.
AE256 stands for 256-bit Advanced Encryption Standard.
By setting the header value to AE256, every object that Amazon S3 cloud storage receives is encrypted before it is stored in the cloud. Amazon S3 server-side encryption uses one of the strongest block ciphers available, that is AE256 to encrypt your data. Additionally, it encrypts the key itself with a primary key that it regularly rotates.
Note:
If you have already enabled the encryption option when you created the Amazon S3 cloud storage server, you do not need to enable this option. The data is already encrypted before NetBackup sends it over the network.
Storage class is configured at the time of creating the storage server. After it is configured, the storage class is non-editable.

Table: Proxy settings tab options

Option	Description
Use proxy server	Use proxy server option to use proxy server and provide proxy server settings. Once you select the Use Proxy Server option, you can specify the following details: Proxy host. Specify the IP address or name of the proxy server. Proxy port. Specify the port number of the proxy server. Proxy type. You can select one of the following proxy types: HTTP Note: You need to provide the proxy credentials for the HTTP proxy type. SOCKS SOCKS4 SOCKS5 SOCKS4A
Use proxy tunneling	You can enable proxy tunneling for HTTP proxy type. After you enable Use proxy tunneling, HTTP CONNECT requests are sent from the cloud media server to the HTTP proxy server. The TCP connection is directly forwarded to the cloud back-end storage. The data passes through the proxy server without reading the headers or data from the connection.
Authentication type	You can select one of the following authentication types if you use the HTTP proxy type. None - Authentication is not enabled. A username and password is not required. NTLM - Username and password needed. Basic - Username and password needed. Username. The username of the proxy server. Password. The password can be empty. You can use maximum 256 characters.

Option

Description

Use proxy server

Use proxy server option to use proxy server and provide proxy server settings. Once you select the Use Proxy Server option, you can specify the following details:

Proxy host. Specify the IP address or name of the proxy server.
Proxy port. Specify the port number of the proxy server.
Proxy type. You can select one of the following proxy types:
- HTTP
  Note:
  You need to provide the proxy credentials for the HTTP proxy type.
- SOCKS
- SOCKS4
- SOCKS5
- SOCKS4A

Use proxy tunneling

You can enable proxy tunneling for HTTP proxy type.

After you enable Use proxy tunneling, HTTP CONNECT requests are sent from the cloud media server to the HTTP proxy server. The TCP connection is directly forwarded to the cloud back-end storage.

The data passes through the proxy server without reading the headers or data from the connection.

Authentication type

You can select one of the following authentication types if you use the HTTP proxy type.

None - Authentication is not enabled. A username and password is not required.
NTLM - Username and password needed.
Basic - Username and password needed.

Username. The username of the proxy server.

Password. The password can be empty. You can use maximum 256 characters.

More Information

About the Amazon S3 cloud storage API type