Veritas NetBackup™ Appliance Security Guide

To implement third-party SSL certificates:

1. Prepare the keystore file for web services.

   This task varies with the type of PKCS (Public-key Cryptography Standards) you use. No matter which PKCS type you choose, the certificate must contain the following extension:

   SubjectAlternativeName [

   DNSName: hostnames and IP addresses

   Where hostnames is the fully qualified domain name of the appliance and IP address corresponds to the fully qualified domain name of the appliance.

   The following describes the preparation required to use PKCS# 7 and PKCS# 12 standard formats:

   • PKCS#7 (X.509) format

     Use the following link:

     convert certificate

   • PKCS#12 format

     Do the following:

     • To convert a PEM formatted x509 Cert and Private Key to a PKCS# 12, type the following commands:

       openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name tomcat -CAfile ca.crt -caname root

       For more information on openssl usage, refer to https://www.openssl.org/.

     • At the bottom of the certificate file server.crt, make sure that you include the chain of intermediary certificate authority (CA) certificates, up to but not including the root CA certificate.

     • Make sure that you secure the PKCS #12 file with a password. When the password is not applied to the file, you may get a null reference exception when you try to import the file.

     • To convert the PKCS #12 file to a Java Keystore, type the following commands:

       keytool -importkeystore -deststorepass appliance -destkeypass appliance -destkeystore keystore -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass some- password -alias tomcat

       Note:

       Make sure to specify the same password for the -deststorepass and -destkeypass options. Otherwise, you may get an exception when the web server starts. For the password, only alphanumeric characters are supported. The default password is appliance. Also, make sure to specify tomcat for the -alias option. Otherwise, you may get an exception when the web server starts.

       For more information on keytool usage, refer to the following link:

       http://docs.oracle.com/javase/8/docs/technotes/tools/solaris/keytool.html

2. Type the following command to shut down the database and relevant services:

   systemctl stop nginx

   /opt/IMAppliance/scripts/infraservices.sh database stop

   /opt/IMAppliance/scripts/infraservices.sh webserver stop

3. Replace the existing keystore file with your new keystore file in the following directory:

   /opt/apache-tomcat/security/

4. Set the permissions to the new keystore file:

   chmod 700 /opt/apache-tomcat/security

   chmod 600 /opt/apache-tomcat/security/keystore

   chown - R tomcat:tomcat /opt/apache-tomcat/security

5. Type the following command to update the web server configuration if you choose to use your own non-default password in the previous steps:

   /opt/apache-tomcat/vrts/scripts/tomcat_instance.py update --keystore --password <your password>

6. Update the Tomcat_Keystore and Tomcat_Keystore_Passwd settings in the /etc/rc.d/init.d/as-functions file.
7. Get the server_cert file from /etc/vxos-ssl/cert.conf and import the certificates into it with the following command:

   /usr/bin/openssl pkcs12 -in server.p12 -out <server_cert> -passin pass: <keyPassword> -passout pass: <keyPassword>

8. Get the client_cert file from /etc/vxos-ssl/cert.conf and replace the content of the file with the Root CA certificate.
9. If the customized password is different than the pem_password in /etc/vxos-ssl/cert.conf, modify /etc/vxos-ssl/cert.conf to use the customized password.
10. Type the following commands to restart nginx:

    /usr/sbin/update-nginx-conf.sh

    systemctl stop nginx

    systemctl start nginx

11. Type the following commands to restart the web service:

    /opt/IMAppliance/scripts/infraservices.sh database start

    /opt/IMAppliance/scripts/infraservices.sh webserver start

12. Type the following commands to restart the AutoSupport Service:

    service as-alertmanager stop

    service as-analyzer stop

    service as-transmission stop

    service as-alertmanager start

    service as-analyzer start

    service as-transmission start

13. For each master server that is associated with a version 3.1.2 or greater NetBackup Appliance media server, run the following command on each master server for each 3rd party root CA SSL certificate that you need to deploy. The command must be run from the root level.

    • For a NetBackup UNIX-based or appliance master server:

      /usr/openv/java/jre/bin/keytool -importcert -storepass 'cat /usr/openv/var/global/jkskey' -keystore /usr/openv/var/global/wsl/credentials/truststoreMSDP -file <path to root CA certificate file> -alias <descriptive label for root CA certificate>

    • For a NetBackup Windows-based master server:

      • Get the keystore password from the jkskey file at the following path. You can use a text editor or a shell/command utility such as "type" to read the jkskey file.

        Note:

        Replace C: with the appropriate drive letter where NetBackup is installed.

        C:\Program Files\Veritas\NetBackup\var\global\jkskey

        Caution:

        The above path leads to a file that contains the NetBackup password for the Java keystore files that are used by the NetBackup Web Management Console. That file should be treated as confidential and sensitive, and it should never be edited. Otherwise, NetBackup will fail to work.

      • Enter the following command and replace keystore password with the password from the previous task:

        Note:

        Replace C: with the appropriate drive letter where NetBackup is installed.

        "C:\Program Files\Veritas\NetBackup\jre\bin\keytool" -importcert -keystore "C:\Program Files\Veritas\NetBackup\var\global\wsl\credentials\truststoreMSDP" -storepass <keystore password> -file "<path to root CA certificate file>" -alias <descriptive label for root CA certificate>