Veritas NetBackup™ Read This First Guide for Secure Communications
- NetBackup Read This First for Secure Communications
- About secure communications in NetBackup
- How host ID-based certificates are deployed during installation
- How certificates are deployed on hosts during upgrades
- How secure communication works with master server cluster nodes
- When an authorization token is required during certificate deployment
- Why do you need to map host names (or IP addresses) to host IDs
- How to reset host attributes or host communication status
- What has changed for catalog recovery
- What has changed with Auto Image Replication
- How the hosts with revoked certificates work
- How communication happens when a host cannot directly connect to the master server
- Are security certificates backed up
- How communication with legacy media servers happens in the case of cloud configuration
- How NetBackup 8.1 hosts communicate with NetBackup 8.0 and earlier hosts
- Communication failure scenarios
- Secure communication support for other hosts in NetBackup domain
What has changed for catalog recovery
In NetBackup 8.1, the master server requires you to recover its host identity when you restore NetBackup after a disaster. The host identity includes certificate information, security settings, and other information.
With the earlier host identity in place, the master server can communicate with media server and clients in the new NetBackup instance. A disaster recovery package is created during each catalog backup that retains the master server host identity. As the disaster recovery package contains sensitive data such as security certificates and security settings, it is encrypted with a passphrase.
The following diagram shows the workflow for the catalog recovery.
Set a passphrase for the disaster recovery package and then configure a catalog backup policy. Catalog backups use the passphrase that is configured at the time of policy execution.
To set a passphrase, use the Security Management > Global Security Settings > Disaster Recovery tab in the NetBackup Administration Console.
If you change the passphrase at any time, the passphrase of the disaster recovery packages that were created earlier is not changed. It only changes the passphrase of the disaster recovery packages that are created subsequently.
To recover older catalogs, you must use the corresponding passphrase.
Caution:
You must set the passphrase before you configure the catalog backup policy. If the passphrase is not set, catalog backups fail. If the catalog backup policy is upgraded from a previous version, catalog backups continue to fail until the passphrase is set.
A disaster recovery package is created during each catalog backup.
To verify the passphrase after the catalog backup is successful, run the following command:
nbhostidentity -testpassphrase -infile dr_package_location
Disaster recovery packages are stored along with the disaster recovery files and emailed to the recipient that you have specified during policy configuration.
Disaster strikes.
After a disaster, install NetBackup on the master server in a disaster recovery mode. This process prompts you to specify the disaster recovery package path and passphrase.
If the appropriate passphrase is specified, the master server host identity is recovered. You must provide the passphrase that corresponds to the disaster recovery package that you want to recover.
If you lost the passphrase, you must deploy security certificates on all NetBackup hosts manually.
For more details, refer to the following article:
You should perform the catalog recovery immediately after you have recovered the host identity to avoid any information loss specific to certificate-related activities that may have taken place after the host identity restore. Use the appropriate disaster recovery (DR) file and recover the required catalog.
The passphrase is not recovered during the host identity (or disaster recovery package) restore or during catalog recovery. You must set it again in the new NetBackup instance.
Note:
If you need to restore the host identity after the normal NetBackup installation (when the disaster recovery mode is not selected), you can use the nbhostidentity command.
To restore the host identity of NetBackup Appliance, you must use the nbhostidentity command after the normal installation.