Search <book_title>...

Veritas NetBackup™ Security and Encryption Guide

Last Published: 2017-09-25

Product(s): NetBackup (8.1)

About pushing the legacy encryption pass phrases to clients

To send a pass phrase to a NetBackup client, you can use the bpinst options -passphrase_prompt or -passphrase_stdin. The NetBackup client uses the pass phrase to create or update data in its key file.

The key file contains the data that the client uses to generate DES keys to encrypt backups as follows:

If you use the -passphrase_prompt option, you are prompted at your terminal for a zero to 62 character pass phrase. The characters are hidden while you type the pass phrase. You are prompted again to retype the pass phrase to make sure that is the one you intended to enter.
If you use the -passphrase_stdin option, you must enter the zero to 62 character pass phrase twice through standard input. Generally, the -passphrase_prompt option is more secure than the -passphrase_stdin option, but -passphrase_stdin is more convenient if you use bpinst in a shell script.

To enter a pass phrase for the client named client1 from a NetBackup server through standard input, you would enter commands like the following:

bpinst -LEGACY_CRYPT -passphrase_stdin client1 <<EOF
This pass phase is not very secure
This pass phase is not very secure
EOF

To enter a pass phrase for the client named client2 from a NetBackup server, you would enter commands like the following:

bpinst -LEGACY_CRYPT -passphrase_prompt client2
Enter new NetBackup pass phrase: ********************
Re-enter new NetBackup pass phrase: ********************

You may enter new pass phrases fairly often. The NetBackup client keeps information about old pass phrases in its key file. It can restore the data that was encrypted with DES keys generated from old pass phrases.

Caution:

You must ensure that pass phrases, whether they are new or were in use previously, are secure and retrievable. If a client's key file is damaged or lost, you need all of the previous pass phrases to recreate the key file. Without the key file, you cannot restore the files that were encrypted with the pass phrases.

You must decide whether to use the same pass phrase for many clients. Using the same pass phrase is convenient because you can use a single bpinst command to specify a pass phrase for each client. You can also do redirected restores between clients when they use the same pass phrase.

Note:

If you want to prevent redirected restores, you should specify different pass phrases by entering a separate bpinst command for each client.

For clustered environments you can do the following:

Push the configuration to the client only from the active node.
Specify the host names of the individual nodes (not the virtual names) in the list of clients.

Note:

The master server USE_VXSS setting in bp.conf should be set to AUTOMATIC. Use this setting when pushing from an NBAC enabled master to a host that does not have NetBackup previously installed. Also use this setting when NBAC has not enabled the master server'sUSE_VXSS setting in bp.conf.