Veritas NetBackup™ Appliance Security Guide
- About the NetBackup appliance Security Guide
- User authentication
- User authorization
- Intrusion prevention and intrusion detection systems
- About Symantec Data Center Security on the NetBackup appliance
- About the NetBackup appliance intrusion prevention system
- About the NetBackup appliance intrusion detection system
- Reviewing SDCS events on the NetBackup appliance
- Running SDCS in unmanaged mode on the NetBackup appliance
- Running SDCS in managed mode on the NetBackup appliance
- Overriding the NetBackup appliance intrusion prevention system policy
- Re-enabling the NetBackup appliance intrusion prevention system policy
- Log files
- Operating system security
- Data security
- Web security
- Network security
- Call Home security
- Remote Management Module (RMM) I security
- STIG and FIPS conformance
- Appendix A. Security release content
Overriding the NetBackup appliance intrusion prevention system policy
To discourage accessing the root account, the appliance requires that you first disable the intrusion prevention system (IPS) policy. For example, using the elevate command under Support > Maintenance fails unless the IPS policy is disabled.
Warning:
Disabling the IPS policy is not recommended as it puts the system at risk and vulnerable to attack.
You can use the NetBackupCLI user role to run NetBackup commands without overriding the IPS policy. See About the NetBackupCLI user role.
Note:
Overriding the IPS policy disables only the appliance intrusion prevention system. The appliance intrusion detection system (IDS) logging is still enabled and every activity under the maintenance account is still logged.
To override the appliance IPS policy
- Log on to the NetBackup Appliance Shell Menu as an administrator.
- Enter the Support > Maintenance command to bring up the Maintenance Mode login prompt. Enter the Maintenance user account password to log into Maintenance Mode.
app123.Support> Maintenance <!-- Maintenance Mode --!> maintenance's password:
- In Maintenance Mode, type the following command to override the IPS policy:
/opt/Symantec/sdcssagent/IPS/sisipsoverride.sh
The following message is displayed:
Symantec Critical Protection Policy Override Agent Version: 6.7 (build 1060) Current Policy: NetBackup Appliance Prevention Policy, r123 Policy Prevention: Enabled Policy Override: Allowed Override State: Not overridden To override the policy and disable protection, enter your login password. Password:
- Enter the Maintenance user account password. The following options are displayed:
Choose the type of override that you wish to perform: 1. Override Prevention except for Self Protection 2. Override Prevention Completely Choice?
- Enter 1 to override prevention except for self-protection.
Note:
Veritas recommends that you use Option 1. Selecting Option 1 allows modification only to the NetBackup Appliance Shell Menu and not to the SDCS agent.
The following options are displayed:
Choose the amount of time after which to automatically re-enable: 1. 15 minutes 2. 30 minutes 3. 1 hour 4. 2 hours 5. 4 hours 6. 8 hours
- Enter the appropriate number from 1 to 7 based on the amount of time that is required to debug the support case.
The appliance displays the following message:
Enter a comment. Press Enter to continue.
- Enter a relevant comment as to why the override is required. For example:
Enter a comment. Press Enter to continue. Disabling the security policy for debugging support case no - XYZ
The appliance overrides the policy and displays the following message:
Please wait while the policy is being overridden. ........ The policy was successfully overridden. maintenance - !> elevate
You should now have access to the root account for debugging the appliance.