NetBackup and Veritas Appliances Hardening Guide

To create a NetBackup WORM storage server instance

1. Make sure that the NetBackup WORM storage server application you want to use is located in the repository.
2. Perform the following tasks if you have not already:

   • Configure at least one network interface. You can configure a physical interface, add a VLAN tag, or create a bond.

   • Add at least one tenant.

   • Verify that the appliance is in lockdown mode. You can check or change the lockdown mode from the Lockdown mode page on the Flex Appliance Console. See the topic "Changing the lockdown mode" in the Flex Appliance Getting Started and Administration Guide for details.

3. Gather the following information for the new instance:

   Note:

   The hostname and IP address must not be in use anywhere else in your domain.

   • Tenant that you want to assign it to

   • Hostname (maximum of 63 characters including the domain name)

   • IP address

   • Network interface

   • Domain name

   • Name servers

   • Search domains

   • Primary server hostname (must be version 8.3.0.1 or later)

   • Media server hostname if applicable (must be version 8.3.0.1 or later)

   • Username for storage

     NetBackup requires this username to connect to the deduplication storage. The username must be between 4 and 30 characters and can include uppercase letters, lowercase letters, and numbers.

   • Password for storage

     NetBackup requires this password to connect to the deduplication storage. The password must be between 15 and 32 characters and must include at least one uppercase letter, one lowercase letter, one number, and one special character (_.+~={}?!).

   • KMS key group

   • KMS passphrase

   • Certificate Authority (CA) information for one of the following:

     For a NetBackup CA:

     • CA SHA-1 or SHA-256 certificate fingerprint

       If the primary server is a Flex instance, you can locate this information from the instance details page of the primary server instance. Click on the instance name under Application instances on the System topology page.

       If the primary server is not a Flex instance, see the NetBackup Security and Encryption Guide for the steps to locate this information from NetBackup.

     • (Optional) Token for host ID-based certificate

       Depending on the primary server security level, the host may require an authorization or a reissue token. If you do not specify a token when you create the instance, the wizard attempts to automatically obtain the certificate.

     For an external CA:

     • Trust store, in PEM format

     • Host certificate, in PEM format

     • Private key, in PEM format

     • (Optional) Passphrase of the private key

       A passphrase is required if the key is encrypted.

   • (Optional) Password for host name-based certificate

     A host name-based certificate is mandatory if Enhanced Auditing is enabled on the primary server. You can specify the password when you create the instance, or you can deploy the certificate from the primary server later.

4. On the primary server, use the nbsetconfig command or manually edit the NetBackup backup configuration file (bp.conf on Linux and UNIX, or the Windows registry) to add the following entry:

   MSDP_SERVER=<MSDP hostname>

   Where <MSDP hostname> is the hostname of the new WORM storage server instance.

5. If a firewall exists between the primary server and the new instance, open the following ports on the primary server to allow communication:

   • vnetd: 13724

   • bprd: 13720

   • PBX: 1556

   • If the primary server is a NetBackup appliance that uses TCP, open the following ports:

     443, 5900, and 7578.

6. From the System topology page of the Flex Appliance Console, navigate to the Application instances section.
   
7. Click Create instance.
8. Select the appropriate storage server application from the repository list that appears, making sure to verify the version number. Click Next.
9. Follow the prompts to create the instance. When you are done, you can view the progress in the Activity Monitor, which is accessible from the left pane of the Flex Appliance Console.

   Note:

   If you use DNS and the DNS server includes both IPv4 and IPv6 addresses, the instance must be configured with both as well.

   If you do not want to use DNS or want to bypass DNS for certain hosts, verify that the hostname resolution information is included in the Hosts file entries field. You must include entries for the primary server and any other NetBackup hosts that you want to communicate with the instance.

10. Once the instance has been created successfully, you must change the password from the known default password. To change the password, open an SSH session to the instance and log in with the following credentials:

    • Username: msdpadm

    • Password: P@ssw0rd

    Follow the prompt to enter a new password. When the password change is complete, you are logged out. You can log back in with the new password.

11. If you plan to create or already have multiple instances with deduplication storage, you must adjust the deduplication cache sizes so that the total memory of all instances does not exceed 75% of the physical RAM on the appliance.

    The default cache sizes are as follows:

    • MaxCacheSize: 512 MiB

    • MaxPredictiveCacheSize: 40%

    • MaxSamplingCacheSize: 20%

    To tune the cache sizes on this instance:

    • Run the following command to tune the MaxCacheSize:

      setting set-MSDP-param max-cache-size value=<value>

      Where <value> is the amount of the appliance RAM to use for the cache on the instance, as MiB, GiB, or a percent. For example, value=1GiB or value=39%.

    • Run the following command to tune the MaxPredictiveCacheSize:

      setting set-MSDP-param max-predictive-cache-size value=<value>

      Where <value> is the amount of the appliance RAM to use for the predictive cache, as MiB, GiB, or a percent. For example, value=1GiB or value=39%.

    • Run the following command to tune the MaxSamplingCacheSize:

      setting set-MSDP-param max-sampling-cache-size value=<value>

      Where <value> is the amount of the appliance RAM to use for the sampling cache, as MiB, GiB, or a percent. For example, value=1GiB or value=39%.

    • Restart the pdde-storage process with the following commands:

      sudo /etc/init.d/pdde-storage force-stop

      sudo /etc/init.d/pdde-storage start

12. The appliance automatically creates a PureDisk storage server for the WORM storage instance that has the same name as the instance. Use the following steps to create a disk pool on that storage server:

    From the NetBackup web UI, click Storage, click the Disk pools tab, and then click Add. Follow the prompts to configure the disk pool.

13. Use the following steps to create a deduplication storage unit for your instance:

    From the NetBackup web UI, click Storage, navigate to the Storage Units tab, and then click Add. Follow the prompts and make sure that the Enable WORM option is activated.