Veritas NetBackup™ Appliance Security Guide
- About the NetBackup appliance Security Guide
- User authentication
- About user authentication on the NetBackup appliance
- About configuring user authentication
- About authenticating LDAP users
- About authenticating Active Directory users
- About authentication using smart cards and digital certificates
- About authenticating Kerberos-NIS users
- About the appliance login banner
- About user name and password specifications
- User authorization
- Intrusion prevention and intrusion detection systems
- About Symantec Data Center Security on the NetBackup appliance
- About the NetBackup appliance intrusion prevention system
- About the NetBackup appliance intrusion detection system
- Reviewing SDCS events on the NetBackup appliance
- Running SDCS in unmanaged mode on the NetBackup appliance
- Running SDCS in managed mode on the NetBackup appliance
- Log files
- Operating system security
- Data security
- Web security
- Network security
- Call Home security
- Remote Management Module (RMM) security
- STIG and FIPS conformance
- Appendix A. Security release content
- Index
About SSL usage
The Secure Socket Layer (SSL) protocol creates an encrypted connection between the appliance web server and the appliance web console, and other local servers. This type of connection allows for a more secure information transfer without the problems of eavesdropping, data tampering, or message forgery. To enable SSL on the appliance web server, you need an SSL certificate that identifies the appliance host.
The appliance uses self-signed certificates for client and host validation. The appliance certificate is generated using a 2048 bit RSA public key that is hashed with the SHA256 algorithm and signed with RSA encryption. For secure communications, the appliance uses only TLS v1.2 and later protocol.
Note:
Warnings such as SSL Certificate Cannot be Trusted or SSL Self-Signed Certificate can be avoided by replacing the default self-signed certificate with a custom CA issued certificate.
SSL certificates are also supported for secure communications between the appliance and various external servers, such as LDAP and Syslog.
Third-party certificates are used for SSL encryption and authentication. By default, a host ID-based certificate issued by the NetBackup Certificate Authority (NBCA) is deployed on the master and media servers during role configuration.
Starting from 3.2, NetBackup appliance also supports host ID-based certificates issued by an External Certificate Authority (ECA) for NetBackup. An ECA can be used as an alternative to the NBCA for providing host verification and security on new installations as well as upgraded appliances.
You can import external certificates on a NetBackup Appliance master or media server from the NetBackup Appliance Shell Menu. For more information, see the Veritas NetBackup Appliance Commands Reference Guide. You can also import external certificates on a NetBackup Appliance media server while configuring its role. For more information, see the Veritas NetBackup Appliance Initial Configuration Guide.
Additionally, to configure the ECA to the NetBackup Appliance infrastructure services such as mongodb, tomcat, and nginx, see the following topic:
Note:
You must deploy the same external certificate for both NetBackup and NetBackup Appliance layers. Note that separate certificates for NetBackup and NetBackup Appliance layers are not supported.