Search <book_title>...

Veritas NetBackup™ Security and Encryption Guide

Last Published: 2017-09-25

Product(s): NetBackup (8.1)

Upgrading NetBackup when an older version of NetBackup is using a root broker installed on a remote machine

You can use the following steps for upgrading NetBackup when an older version of NetBackup is using a root broker installed on a remote computer.

Upgrading NetBackup when an older version of NetBackup is using a root broker installed on a remote machine

Before upgrading to NetBackup, stop the NetBackup services and disable NBAC by setting USE_VXSS=PROHIBITED. To set the new value for USE_VXSS, run the following command. Then start the NetBackup upgrade.

On UNIX platforms, use

/usr/openv/netbackup/bin/admincmd/bpsetconfig
bpsetconfig> USE_VXSS=PROHIBITED
bpsetconfig>Crtl + D (to save and quit).

On Windows, use

C:\Program Files\Veritas\NetBackup\bin\admincmd\bpsetconfig
bpsetconfig> USE_VXSS=PROHIBITED
bpsetconfig> Crtl + Z + Enter (to save and quit).

Once the NetBackup upgrade is completed then migrates the remote root broker (RB) and local shared authentication broker (AB) into NetBackup by using the atutil tool which is shipped with NetBackup.
Copy the atutil utility from the NetBackup computer to the root broker computer.
On UNIX Platforms, copy the /usr/openv/netbackup/sec/at/bin/atutil file from NetBackup computer to the root broker computer.
On Windows, copy the C:\Program Files\Veritas\NetBackup\sec\at\bin\atutil.exe file from NetBackup computer to the root broker computer.
Change directory to where the atutil command was copied. Then export the root broker by running the atutil export -r -f <RB output xml file> -p <password> command.
Copy the exported file to NetBackup computer.
Import the root broker into the NetBackup computer by executing the following command.
On UNIX platforms, execute /usr/openv/netbackup/sec/at/bin/atutil import -z /usr/openv/var/global/vxss/eab/data/ -f <RB output xml file> -p <password>
On Windows, execute C:\Program Files\Veritas\NetBackup\sec\at\bin\atutil import -z C:\Program Files\Veritas\NetBackup\var\global\vxss\eab\data -f <RB output xml file> -p <password>
On cluster computers, the -z option should point to the shared drive.
Configure the NetBackup authentication service in R+AB mode by running the following command.
On UNIX platforms, run /usr/openv/netbackup/sec/at/bin/vssregctl -s -f /usr/openv/var/global/vxss/eab/data/root/.VRTSat/profile/VRTSatlocal.conf -b "Security\Authentication\Authentication Broker" -k Mode -t int -v 3
On Windows, run C:\Program Files\Veritas\NetBackup\sec\at\bin\vssregctl -s -f C:\Program Files\VERITAS\NetBackup\var\global\vxss\eab\data\systemprofile\VRTSatlocal.conf -b "Security\Authentication\Authentication Broker" -k Mode -t int -v 3
On cluster computers set the - f option to point to the shared drive.

Set the value of USE_VXSS to AUTOMATIC to start the authentication service. To set a new value for USE_VXSS run following command.

On UNIX platforms,

/usr/openv/netbackup/bin/admincmd/bpsetconfig
bpsetconfig> USE_VXSS=AUTOMATIC
bpsetconfig> Crtl + D (to save and quit).

On Windows,

C:\Program Files\Veritas\NetBackup\bin\admincmd\bpsetconfig
bpsetconfig> USE_VXSS=AUTOMATIC
bpsetconfig> Crtl + Z + Enter (to save and quit).

Start the NetBackup authentication service by running the following command.
On UNIX platforms, run /usr/openv/netbackup/bin/nbatd.
On Windows, run net start nbatd.
Reset the value of USE_VXSS to PROHIBITED.
On UNIX platforms manually edit the /usr/openv/netbackup/bp.conf file and set USE_VXSS to PROHIBITED.
On Windows, open the registry entry for HKEY_LOCAL_MACHINE\SOFTWARE\Veritas\NetBackup\CurrentVersion\Config and set the value of USE_VXSS to PROHIBITED.

Export the shared AB domain and import it into NetBackup by running the following command.

On UNIX platforms, execute the following commands in sequence.

/usr/openv/netbackup/sec/at/bin/atutil export -t ab -f
 <AB output xml file> -p <password>
/usr/openv/netbackup/sec/at/bin/atutil import -z
/usr/openv/var/global/vxss/eab/data/ -f <AB output xml file> -p
 <password>.

On Windows, execute the following commands in sequence.

C:\Program Files\Veritas\NetBackup\sec\at\bin\atutil export -t
 ab -d broker -f <AB output xml file> -p <password>
C:\Program Files\Veritas\NetBackup\sec\at\bin\atutil import -z
 C:\Program Files\Veritas\NetBackup\var\global\vxss\eab\data -f
<AB output xml file> -p <password>

On cluster computers the - z option should point to the shared drive.

Start the NetBackup authorization service by executing the following commands.
On UNIX platforms, run /usr/openv/netbackup/bin/nbazd -f.
On Windows, run net start nbazd.
Log on to the shared AZ service.
On UNIX platforms, run /opt/VRTSaz/bin/vssaz login --domain localhost.
On Windows x86 platforms, run C:\Program Files\VERITAS\Security\Authorization\bin\ vssaz login --domain localhost.
On Windows X64 platforms, run C:\Program Files (x86)\VERITAS\Security\Authorization\bin\ vssaz login --domain localhost.
Find the NetBackup APS name from the shared AZ using the following command.
On UNIX platforms, run /opt/VRTSaz/bin/vssaz listaps.
On Windows x86 platforms, run C:\Program Files\VERITAS\Security\Authorization\bin\ vssaz listaps.
On Windows X64 platforms, run C:\Program Files (x86)\VERITAS\Security\Authorization\bin\ vssaz listaps.
Export the NetBackup resource collection from the shared AZ by running the following command.
On UNIX platforms, run /opt/VRTSaz/bin/vssaz rcexport --toplevelrcname <NBU APS name>.
On Windows x86 platforms, run C:\Program Files\VERITAS\Security\Authorization\bin\vssaz rcexport --toplevelrcname <NBU APS name>.
On Windows x64 platforms, run C:\Program Files (x86)\VERITAS\Security\Authorization\bin\vssaz rcexport --toplevelrcname <NBU APS name>.
Log out from the shared AZ using the following command.
On UNIX platforms, run /opt/VRTSaz/bin/vssaz logout.
On Windows x86 platforms, run C:\Program Files\VERITAS\Security\Authorization\bin\ vssaz logout.
On Windows x64 platforms, run C:\Program Files (x86)\VERITAS\Security\Authorization\bin\ vssaz logout.
Log on to NetBackup AZ using the following command.
On UNIX platforms, run /usr/openv/netbackup/sec/az/bin/vssaz login --domain localhost.
On Windows, run C:\Program Files\Veritas\NetBackup\sec\az\bin\ vssaz login --domain localhost.
Import the NetBackup resource collection from shared AZ into NetBackup using the following command.
On UNIX platforms, run /usr/openv/netbackup/sec/az/bin/vssaz rcimport --location /var/VRTSaz/objdb/export/<OID>/rc_<OID>.xml.
On Windows x86 platforms, run C:\Program Files\Veritas\NetBackup\sec\az\bin\ vssaz rcimport --location C:\Program Files\VERITAS\Security\Authorization\data\objdb\export \<OID>\rc_<OID>.xml.
On Windows x64 platforms, run C:\Program Files\Veritas\NetBackup\sec\az\bin\ vssaz rcimport --location C:\Program Files (x86)\VERITAS\Security\Authorization\data\objdb\export \<OID>\rc_<OID>.xml.
Restart the NetBackup service in USE_VXSS = PROHIBITED mode.
Run the setupmaster command.
Restart the NetBackup service.