NetBackup and NetBackup Appliances Hardening Guide
- Top recommendations to improve your NetBackup and NetBackup appliances security posture
- Introduction
- Keeping all systems and software updated
- Enabling multifactor authentication
- Enabling multiperson authorization
- Increasing the security level
- Implementing an immutable data vault
- Securing credentials
- Reducing network exposure
- Enabling encryption
- Enabling catalog protection
- Enabling malware scanning and anomaly detection
- Enabling security observability
- Restricting user access
- Configuring a sign-in banner
- Steps to protect Flex Appliance
- About Flex Appliance hardening
- Managing multifactor authentication
- Managing multifactor authentication on a primary or a media server instance
- Managing multifactor authentication on a WORM storage server
- Managing single sign-on (SSO)
- Managing user authentication with smart cards or digital certificates
- About lockdown mode
- Using network access control
- Using an external certificate
- Forwarding logs
- Creating a NetBackup WORM storage server instance
- Configuring an isolated recovery environment using the web UI
- Protecting the MSDP catalog on a WORM storage server
- Using a sign-in banner
- Steps to protect NetBackup Appliance
- About NetBackup Appliance hardening
- About multifactor authentication
- About single sign-on (SSO) authentication and authorization
- About authentication using smart cards and digital certificates
- Disable user access to the NetBackup appliance operating system
- About Network Access Control
- About data encryption
- FIPS 140-2 conformance for NetBackup Appliance
- About implementing external certificates
- About antimalware protection
- About forwarding logs to an external server
- Creating the appliance login banner
- Steps to protect NetBackup
- About NetBackup hardening
- About multifactor authentication
- Configure NetBackup for single sign-on (SSO)
- Configure user authentication with smart cards or digital certificates
- Workflow to configure multi-person authorization for NetBackup operations
- Access codes
- Workflow to configure immutable and indelible data
- Add a configuration for an external CMS server
- Configuring an isolated recovery environment on a NetBackup BYO media server
- About FIPS support in NetBackup
- Installing KMS
- Workflow for external KMS configuration
- Validating KMS credentials
- Configuring KMS credentials
- Configuring KMS
- Creating keys in an external KMS
- Workflow to configure data-in-transit encryption
- Workflow to use external certificates for NetBackup host communication
- About certificate revocation lists for external CA
- Configure an external certificate for the NetBackup web server
- Configuring the primary server to use an external CA-signed certificate
- Configuring an external certificate for a clustered primary server
- Configuring a NetBackup host (media server, client, or cluster node) to use an external CA-signed certificate after installation
- Configuration options for external CA-signed certificates
- ECA_CERT_PATH for NetBackup servers and clients
- ECA_TRUST_STORE_PATH for NetBackup servers and clients
- ECA_PRIVATE_KEY_PATH for NetBackup servers and clients
- ECA_KEY_PASSPHRASEFILE for NetBackup servers and clients
- ECA_CRL_CHECK for NetBackup servers and clients
- ECA_CRL_PATH for NetBackup servers and clients
- ECA_CRL_PATH_SYNC_HOURS for NetBackup servers and clients
- ECA_CRL_REFRESH_HOURS for NetBackup servers and clients
- ECA_DISABLE_AUTO_ENROLLMENT for NetBackup servers and clients
- ECA_DR_BKUP_WIN_CERT_STORE for NetBackup servers and clients
- MANAGE_WIN_CERT_STORE_PRIVATE_KEY option for NetBackup primary servers
- Guidelines for managing the primary server NetBackup catalog
- About protecting the MSDP catalog
- How to set up malware scanning
- About backup anomaly detection
- Send audit events to system logs
- Send audit events to log forwarding endpoints
- Display a banner to users when they sign in
- Steps to protect NetBackup Flex Scale
- About NetBackup Flex Scale hardening
- About the security meter
- STIG overview for NetBackup Flex Scale
- FIPS overview for NetBackup Flex Scale
- Managing the login banner
- Changing the password policy
- Support for immutability in NetBackup Flex Scale
- Authenticating users using digital certificates or smart cards
- About system certificates on NetBackup Flex Scale
- Deploying external certificates on NetBackup Flex Scale
- About multifactor authentication
- Considerations before configuring multifactor authentication
- Configuring multifactor authentication for your user account
- Disabling multifactor authentication for your user account
- Enforcing multifactor authentication for all users
- Configuring multifactor authentication for your user account when it is enforced in the cluster
- Resetting multifactor authentication for a user
- About single sign-on (SSO) configuration
- Configuring isolated recovery environment (IRE)
- Steps to protect Access Appliance
- About Access Appliance hardening
- FIPS 140-2 conformance for Access Appliance
- Managing the login banner using the UI
- Managing the password policy using the UI
- Support for immutability in Access Appliance
- About system certificates on Access Appliance
- About single sign-on (SSO) configuration
- Configuring user authentication using digital certificates or smart cards
- About multifactor authentication
- Considerations when configuring multifactor authentication
- Configuring multifactor authentication for your user account
- Disabling multifactor authentication for your user account
- Enforcing multifactor authentication for all users
- Configuring multifactor authentication for your user account when it is enforced in the cluster
- Resetting multifactor authentication for a user
- Configuring an isolated recovery environment using the command line
- Forwarding logs to an external server
Selecting or changing the lockdown mode
The user can select the lockdown mode during initial configuration. After cluster configuration, user has the option to see/change the lockdown mode using the GUI as well as CLISH. The user can switch between the following modes without any restriction:
From Normal to Enterprise mode
From Normal to Compliance mode
From Enterprise to Compliance mode
You can change the mode from Enterprise to Normal, from Compliance to Normal or from Compliance to Enterprise only if:
Locked data is not present in deduplication storage or deduplication is not configured in WORM mode.
WORM enabled file system for any other use cases, such as NFS and CIFS are not present.
WORM policies are not activated in the GUI.
All the file systems are not in offline state.
The user can set minimum and maximum retention time for backup images in Enterprise and Compliance mode only. The retention period range is between 1 hour and 60 years. The retention period can be in second(s) or hour(s) if you use CLISH. The retention period can be in hour(s), day(s), month(s), or year(s) if you use the GUI. Creation of images with retention time less than the minimum retention time or greater than the maximum retention time is not allowed. This minimum and maximum retention time should be set by the appliance administrator as per the retention requirement of their use case.
If Enterprise or Compliance mode has been configured, retention values can be set on files and objects within the range of the minimum retention period and maximum retention period of the WORM-enabled shares or S3 buckets in which they are present.
Once the lockdown mode is set, only Appliance administrators can change the lockdown mode.
The lockdown modes are maintained during upgrade.
Only the Appliance administrator can remove the retention locks if the lockdown mode is enterprise.
The user cannot change the mode if any existing operation is in progress.
To change the lockdown mode using the GUI
- Go to Settings > Security management > Immutability and click Lockdown mode.
- On the Lockdown mode page, click Edit.
- Select the mode that you want to enable and click Save.
You can also modify the lockdown mode using the cluster lockdown-mode commands from CLISH.
cluster> lockdown-mode set <mode> [minret] [maxret]
Where
mode | Specifies the lockdown mode [ normal | compliance | enterprise ] |
minret | Specifies the minimum retention value range |
maxret | Specifies the maximum retention value range |
You can also list the lockdown configuration of a cluster using the cluster lockdown-mode get command.
If lockdown mode is set to compliance or enterprise for any node, it is not available for factory reset.
During add and replace node operations, the new node is automatically placed in the existing lockdown mode of the cluster. The lockdown mode of the replaced node is set to normal and the node is available for factory reset.
Cluster maintenance shell is enabled with two-factor authentication (2FA).
The lockdown mode settings are done at a cluster level and are applicable for all the services, such as NFS and CIFS that are configured on that cluster.