Absence of security certificate on a NetBackup host – Deploying a security certificate

Description

Deploying a security certificate on a NetBackup host

NetBackup hosts may require a security certificate for authentication for various purposes. If so, you must use a NetBackup command to deploy a certificate for each host that requires one.

When using the NetBackup Administration Console to log into a host that does not have a security certificate installed, the following message appears, stating that a security certificate is mandatory.

Choose one of the following procedures to deploy a security certificate on NetBackup hosts:

Notes: 

• You must be a NetBackup administrator to deploy certificates.
• Deploying a security certificate is a one-time activity for a given NetBackup host.

Deploying a security certificate for a master server including a master server in a cluster 
Perform this procedure for the master server.  If the master server is part of a cluster, perform this procedure on the active node.

To deploy a security certificate for a NetBackup master server

1. Run the following command on the master server:

Windows: install_path\NetBackup\bin\admincmd\bpnbaz -ConfigureAuth -force

UNIX: /usr/openv/netbackup/bin/admincmd/bpnbaz -ConfigureAuth -force

2. Stop and restart all NetBackup processes and services:

3. If the master server is part of a cluster, restart the NetBackup Service Layer service and the NetBackup Vault Manager service on the active node of the master server.

Deploying a security certificate for media servers or clients
This procedure works well when deploying certificates to many hosts at one time. As with NetBackup deployment in general, this method assumes that the network is secure.

To deploy a security certificate for media servers or clients

1. Run the following command on the master server, depending on your environment. Specify the name of an individual host, specify -AllMediaServers, or specify -AllClients.

Windows: install_path\NetBackup\bin\admincmd\bpnbaz -ProvisionCert host_name | -AllMediaServers | -AllClients

UNIX: /usr/openv/netbackup/bin/admincmd/bpnbaz -ProvisionCert host_name | -AllMediaServers | -AllClients

NetBackup appliance (as a NetBackup command line user): bpnbaz -ProvisionCert Media_server_name

2. Restart the NetBackup Service Layer service on the master server.

No services need to be restarted if the target host is a NetBackup client.

Creating a host identity and then deploying a security certificate for a media server or client
This procedure works best when deploying certificates to a small number of hosts. The same password must be entered once on the master server, and then again on the target host, so this method is considered to be more secure.

To create a host identity and then deploy a security certificate for a media server or client

1. Run the following command on the master server to create an identity for the target NetBackup host:

Windows: install_path\NetBackup\bin\bpnbat -addmachine target_hostname

UNIX: /usr/openv/netbackup/bin/bpnbat -addmachine target_hostname

Enter a password of your choice when prompted and make a note of it.

2. Run the following command on the target NetBackup host to obtain a certificate from the master server and deploy it:

Windows: install_path\NetBackup\bin\bpnbat -loginmachine

UNIX: /usr/openv/netbackup/bin/bpnbat -loginmachine

Enter the master server name as the authentication broker name when prompted. Enter the same computer name and password that were used to create the target host identity on the master server.

Note: If a target host has multiple host names, repeat the steps for each host name.