NetBackup and NetBackup Appliances Hardening Guide

Last Published:
Product(s): Appliances (11.0, 8.5, 8.4, 6.3, 6.2, 6.1, 6.0, 5.5.0.1, 3.5), NetBackup (11.0, 8.5, 8.4, 6.3, 6.2, 6.1, 6.0, 5.5.0.1, 3.5)
Platform: Veritas 3340,Veritas 3350,Veritas 3360,Flex Appliance OS,NetBackup Appliance OS,NetBackup Flex Scale OS
  1. Top recommendations to improve your NetBackup and NetBackup appliances security posture
    1.  
      Introduction
    2.  
      Keeping all systems and software updated
    3.  
      Enabling multifactor authentication
    4.  
      Enabling multiperson authorization
    5.  
      Increasing the security level
    6.  
      Implementing an immutable data vault
    7.  
      Securing credentials
    8.  
      Reducing network exposure
    9.  
      Enabling encryption
    10.  
      Enabling catalog protection
    11.  
      Enabling malware scanning and anomaly detection
    12.  
      Enabling security observability
    13.  
      Restricting user access
    14.  
      Configuring a sign-in banner
  2. Steps to protect Flex Appliance
    1.  
      About Flex Appliance hardening
    2. Managing multifactor authentication
      1.  
        Configuring or reconfiguring multifactor authentication
      2.  
        Enforcing multifactor authentication
    3. Managing multifactor authentication on a primary or a media server instance
      1.  
        Configuring or disabling multifactor authentication on a primary server instance
      2.  
        Configuring or disabling multifactor authentication on a media server instance
      3.  
        Enforcing multifactor authentication on a primary or a media server instance
    4. Managing multifactor authentication on a WORM storage server
      1.  
        Configuring or disabling multifactor authentication on a WORM storage server
    5. Managing single sign-on (SSO)
      1.  
        Managing identity providers (IDPs)
    6.  
      Managing user authentication with smart cards or digital certificates
    7. About lockdown mode
      1.  
        Changing the lockdown mode
    8.  
      Using network access control
    9.  
      Using an external certificate
    10.  
      Forwarding logs
    11.  
      Creating a NetBackup WORM storage server instance
    12. Configuring an isolated recovery environment using the web UI
      1.  
        Configuring the allowed subnets
      2.  
        Configuring the reverse connections
      3.  
        Configuring the reverse replication schedule
      4.  
        Adding a replication operation to SLP at the production primary server
    13.  
      Protecting the MSDP catalog on a WORM storage server
    14.  
      Using a sign-in banner
  3. Steps to protect NetBackup Appliance
    1.  
      About NetBackup Appliance hardening
    2.  
      About multifactor authentication
    3. About single sign-on (SSO) authentication and authorization
      1.  
        Configure single sign-on (SSO) for a NetBackup Appliance
    4. About authentication using smart cards and digital certificates
      1.  
        2FA
      2.  
        Smart card Authentication for NetBackup Web UI
      3.  
        Smart card authentication for NetBackup Appliance Web UI
      4.  
        Smart card authentication for NetBackup Appliance Shell Menu
      5.  
        Configure role-based access control
      6.  
        Configure authentication for a smart card or digital certificate for the NetBackup Web UI
    5.  
      Disable user access to the NetBackup appliance operating system
    6.  
      About Network Access Control
    7. About data encryption
      1.  
        KMS support
    8.  
      FIPS 140-2 conformance for NetBackup Appliance
    9.  
      About implementing external certificates
    10.  
      About antimalware protection
    11. About forwarding logs to an external server
      1.  
        Uploading certificates for TLS
      2.  
        Enabling log forwarding
    12.  
      Creating the appliance login banner
  4. Steps to protect NetBackup
    1.  
      About NetBackup hardening
    2. About multifactor authentication
      1.  
        Configure multifactor authentication for your user account
      2.  
        Enforce multifactor authentication for all users
    3. Configure NetBackup for single sign-on (SSO)
      1.  
        Configure the SAML KeyStore
      2.  
        Configure the SAML keystore and add and enable the IDP configuration
      3.  
        Enroll the NetBackup primary server with the IDP
    4. Configure user authentication with smart cards or digital certificates
      1.  
        Configure smart card authentication with a domain
      2.  
        Configure smart card authentication without a domain
    5. Workflow to configure multi-person authorization for NetBackup operations
      1.  
        NetBackup operations that need multi-person authorization
      2.  
        RBAC roles and permissions for multi-person authorization
      3.  
        Configure multi-person authorization
    6. Access codes
      1.  
        Request CLI access through web UI authentication
      2.  
        Approve the CLI access request of another user
    7. Workflow to configure immutable and indelible data
      1.  
        About configuring disk pool storage
      2.  
        Use WORM setting
      3.  
        Creating a backup policy
    8. Add a configuration for an external CMS server
      1.  
        Add a credential for CyberArk
    9. Configuring an isolated recovery environment on a NetBackup BYO media server
      1.  
        Configuring A.I.R. for replicating backup images from production environment to IRE BYO environment
    10. About FIPS support in NetBackup
      1.  
        Enable FIPS mode on NetBackup during installation
      2.  
        Enable FIPS mode on a NetBackup host after installation
      3.  
        Enable FIPS mode for the NetBackup Authentication Broker service
      4.  
        Enable FIPS mode for the NetBackup Administration Console
      5.  
        NB_FIPS_MODE option for NetBackup servers and clients
    11.  
      Installing KMS
    12. Workflow for external KMS configuration
      1.  
        Validating KMS credentials
      2.  
        Configuring KMS credentials
      3.  
        Configuring KMS
      4.  
        Creating keys in an external KMS
      5. Workflow to configure data-in-transit encryption
        1.  
          Configure the global data-in-transit encryption setting
        2. Configure the DTE mode on a client
          1.  
            DTE_CLIENT_MODE for clients
        3. How DTE configuration settings work in various NetBackup operations
          1.  
            Backup
          2.  
            Restore
          3.  
            MSDP backup, restore, and optimized duplication
          4.  
            Universal-Share policy backup
          5.  
            Catalog backup and recovery
          6.  
            Duplication
          7.  
            Synthetic backup
          8.  
            Verify
          9.  
            Import
          10.  
            Replication
        4.  
          Configure the DTE mode on the media server
        5. Modify the DTE mode on a backup image
          1.  
            DTE_IGNORE_IMAGE_MODE for NetBackup servers
    13. Workflow to use external certificates for NetBackup host communication
      1. About certificate revocation lists for external CA
        1.  
          How CRLs from ECA_CRL_PATH are used
        2.  
          How CRLs from CDP URLs are used
      2.  
        Configure an external certificate for the NetBackup web server
      3.  
        Configuring the primary server to use an external CA-signed certificate
      4. Configuring an external certificate for a clustered primary server
        1. Configuration options for external CA-signed certificates for a virtual name
          1.  
            CLUSTER_ECA_CERT_PATH for clustered primary server
          2.  
            CLUSTER_ECA_TRUST_STORE_PATH for clustered primary server
          3.  
            CLUSTER_ECA_PRIVATE_KEY_PATH for clustered primary server
          4.  
            CLUSTER_ECA_KEY_PASSPHRASEFILE for clustered primary server
      5. Configuring a NetBackup host (media server, client, or cluster node) to use an external CA-signed certificate after installation
        1.  
          Enrolling an external certificate for a remote host
      6. Configuration options for external CA-signed certificates
        1. ECA_CERT_PATH for NetBackup servers and clients
          1.  
            Specifying Windows certificate store for ECA_CERT_PATH
        2.  
          ECA_TRUST_STORE_PATH for NetBackup servers and clients
        3.  
          ECA_PRIVATE_KEY_PATH for NetBackup servers and clients
        4.  
          ECA_KEY_PASSPHRASEFILE for NetBackup servers and clients
        5.  
          ECA_CRL_CHECK for NetBackup servers and clients
        6.  
          ECA_CRL_PATH for NetBackup servers and clients
        7.  
          ECA_CRL_PATH_SYNC_HOURS for NetBackup servers and clients
        8.  
          ECA_CRL_REFRESH_HOURS for NetBackup servers and clients
        9.  
          ECA_DISABLE_AUTO_ENROLLMENT for NetBackup servers and clients
        10.  
          ECA_DR_BKUP_WIN_CERT_STORE for NetBackup servers and clients
        11.  
          MANAGE_WIN_CERT_STORE_PRIVATE_KEY option for NetBackup primary servers
    14.  
      Guidelines for managing the primary server NetBackup catalog
    15. About protecting the MSDP catalog
      1. About the MSDP shadow catalog
        1.  
          Changing the MSDP shadow catalog path
        2.  
          Changing the MSDP shadow catalog schedule
        3.  
          Changing the number of MSDP catalog shadow copies
      2.  
        About the MSDP catalog backup policy
    16. How to set up malware scanning
      1.  
        Prerequisites for a scan host
      2.  
        Configure a new scan host pool
    17. About backup anomaly detection
      1.  
        Detecting backup anomalies on the primary server
      2.  
        Detecting backup anomalies on the media server
      3.  
        Configure backup anomaly detection settings
      4.  
        View backup anomalies
    18.  
      Send audit events to system logs
    19.  
      Send audit events to log forwarding endpoints
    20.  
      Display a banner to users when they sign in
  5. Steps to protect NetBackup Flex Scale
    1.  
      About NetBackup Flex Scale hardening
    2.  
      About the security meter
    3. STIG overview for NetBackup Flex Scale
      1.  
        STIG-compliant password policy rules
      2.  
        Enabling STIG for NetBackup Flex Scale
      3.  
        Viewing the NetBackup Flex Scale STIG status
    4. FIPS overview for NetBackup Flex Scale
      1.  
        Viewing the NetBackup Flex Scale FIPS status
    5.  
      Managing the login banner
    6.  
      Changing the password policy
    7. Support for immutability in NetBackup Flex Scale
      1.  
        About lockdown modes
      2.  
        Selecting or changing the lockdown mode
      3.  
        Restricted access to Remote Management Platform (HPe iLO)
      4.  
        Configuring immutability using GUI
    8.  
      Authenticating users using digital certificates or smart cards
    9.  
      About system certificates on NetBackup Flex Scale
    10. Deploying external certificates on NetBackup Flex Scale
      1.  
        Deploying ECA using the GUI
      2.  
        Log locations
      3.  
        Considerations for performing other operations when ECA is deployed
    11. About multifactor authentication
      1.  
        Considerations before configuring multifactor authentication
      2.  
        Configuring multifactor authentication for your user account
      3.  
        Disabling multifactor authentication for your user account
      4.  
        Enforcing multifactor authentication for all users
      5.  
        Configuring multifactor authentication for your user account when it is enforced in the cluster
      6.  
        Resetting multifactor authentication for a user
    12. About single sign-on (SSO) configuration
      1.  
        Configuring SSO on a NetBackup Flex Scale cluster on which both primary and media servers are deployed
      2.  
        Configuring SSO on a NetBackup Flex Scale cluster on which only media servers are deployed
    13.  
      Configuring isolated recovery environment (IRE)
  6. Steps to protect Access Appliance
    1.  
      About Access Appliance hardening
    2. FIPS 140-2 conformance for Access Appliance
      1.  
        Viewing FIPS status for Access Appliance
      2.  
        Enabling FIPS for Access Appliance
      3.  
        Disabling FIPS mode for NetBackup MSDP
      4.  
        Managing the FIPS mode using the command-line interface
    3. Managing the login banner using the UI
      1.  
        Managing the banner from the command-line interface
    4. Managing the password policy using the UI
      1.  
        Managing the password policy from the command-line interface
    5. Support for immutability in Access Appliance
      1.  
        About lockdown modes
      2.  
        Selecting or changing the lockdown mode
      3.  
        Configuring immutability using GUI
    6. About system certificates on Access Appliance
      1.  
        About external certificates on Access Appliance
      2.  
        Deploying ECA using the GUI
      3.  
        Log locations
    7. About single sign-on (SSO) configuration
      1. Configuring SSO on Access Appliance
        1.  
          Adding and removing user roles using GUI
      2.  
        Limitations and log locations
    8. Configuring user authentication using digital certificates or smart cards
      1.  
        Adding CA certificates for smart card authentication
      2.  
        Deleting CA certificates
      3.  
        About configuring LDAP settings
      4.  
        Configuring LDAP server settings
      5.  
        Configuring AD server settings
    9. About multifactor authentication
      1.  
        Considerations when configuring multifactor authentication
      2.  
        Configuring multifactor authentication for your user account
      3.  
        Disabling multifactor authentication for your user account
      4.  
        Enforcing multifactor authentication for all users
      5.  
        Configuring multifactor authentication for your user account when it is enforced in the cluster
      6.  
        Resetting multifactor authentication for a user
    10. Configuring an isolated recovery environment using the command line
      1.  
        Configuring an isolated recovery environment on a storage server
      2.  
        Managing an isolated recovery environment on a storage server
      3.  
        Configuring data transmission between a production environment and an IRE storage server
    11. Forwarding logs to an external server
      1.  
        Configuring log forwarding using the UI
      2.  
        Modifying log forwarding settings using the UI
      3.  
        Removing log forwarding using the UI
      4.  
        Setting up log forwarding using the command-line interface
      5.  
        Viewing the configured settings from the appliance shell menu

Configuring log forwarding using the UI

You can forward the appliance system logs (syslogs) to an external log management server. Your log management server must support the Rsyslog client.

To configure log forwarding:

  1. Sign in to the Access Appliance UI by using the http://console-ip:14161 URL, where console-ip is the management console IP address.
  2. Do one of the following:

    • Click Dashboard > Security Meter > View details > Auditing and alerting > Log forwarding

    • Click Settings > Security management > Log forwarding

  3. Click Configure.
  4. Enter the following details:

    Field

    Description

    Server FQDN or IP address

    FQDN or the IP address of the external log management server.

    Server port

    Port number of the external log management server. Default port is 514. You can specify a different port if the log server is configured to listen on that port.

    Protocol

    Select either UDP or TCP. TCP is the default protocol. With TCP protocol, you can optionally enable TLS log transmission.

    Note:

    Enabling TLS requires that you upload certificates obtained from CA authority and a private key to the appliance.

    Log polling interval

    Duration in minutes after which the log server polls for the system logs. Logs on the remote log server will be available after that duration.

    Set the interval in minutes. The options are 15, 30, 45, 60, Continuous. If you select Continuous, the appliance continuously forwards logs to the log server.

    Device vendor

    Unique name for the external log server. You can use any name to identify to which server the appliance is forwarding the logs to.

    Enable TLS log transmission

    If you want to secure the transmission of logs from the appliance to the log server, select Enable TLS log transmission and upload the required certificate files. Veritas recommends that you enable TLS for security purposes.

    This option provides end-to-end security of data sent over the network from the appliance to the log server. You need a CA certificate and the client private key to configure TLS log transmission.

    This option is available only if you select the TCP protocol.

    If you enable secure log transmission, upload CA certificate (X.509 certificate for the certificate authority in PEM format), client certificate (X.509 certificate for the appliance to communicate with the log management server, in PEM format), and client certificate key (RSA key of the client certificate) onto your log server and then upload the certificates to the appliance.

    Modules

    Types of logs that are forwarded to the log server. Only the OS logs are forwarded and the syslog option is selected by default.

  5. Click Enable.

    A notification about the task is displayed on the top of the page. To monitor the progress, click View details. After the configuration is completed successfully, a notification is displayed on top of the page. The log forwarding status is shown Enabled and the start time for forwarding the logs is displayed.

See Forwarding logs to an external server.

See Removing log forwarding using the UI.

See Modifying log forwarding settings using the UI.