Backup Exec 21 Administrator's Guide
- Introducing Backup Exec
- Installation
- Methods for installing the Agent for Windows
- Using a command prompt to install the Agent for Windows on a remote computer
- Using a command script to install the Agent for Windows
- Installing the Remote Administrator
- Installing Backup Exec using the command line (silent mode)
- Updating Backup Exec with Veritas Update
- Backup Exec license contract information
- About upgrading to Backup Exec
- Getting Started
- Backups
- Backing up data
- Restores
- How Backup Exec catalogs work
- Job management and monitoring
- About the Job Monitor
- About the Job History
- Viewing the job log
- Error-handling rules for failed or canceled jobs
- Alerts and notifications
- Enabling active alerts and alert history to display on the Home tab
- Adding a recipient group for alert notifications
- Sending a notification when a job completes
- SNMP traps for Backup Exec alerts
- Disk-based and network-based storage
- Configuring disk storage
- Configuring disk cartridge storage
- Backup sets
- Cloud-based storage devices
- Amazon S3 cloud-based storage
- Google cloud-based storage
- Microsoft Azure cloud-based storage
- Private cloud-based storage
- About S3-Compatible Cloud Storage
- About the Backup Exec™ CloudConnect Optimizer
- Legacy backup-to-disk folders
- Legacy backup-to-disk folders
- Legacy backup-to-disk folders
- Tape storage
- Robotic libraries in Backup Exec
- Creating robotic library partitions
- Managing tapes
- Creating media sets for tapes
- Labeling tape media
- Default media vaults
- Storage device pools
- Storage operations
- Conversion to virtual machines
- Configuration and settings
- Changing network and security options for Backup Exec
- Using Backup Exec with firewalls
- Deleting DBA-initiated job templates
- Backup Exec logon accounts
- Reports
- Creating a custom report
- List of Backup Exec standard reports
- Instant Cloud Recovery
- Preconfigurations to be completed in the Azure portal
- GDPR Guard
- Troubleshooting Backup Exec
- Troubleshooting failed components in the SAN
- Generating a diagnostic file for troubleshooting Backup Exec
- Using Backup Exec in cluster environments
- Configurations for Backup Exec and Microsoft Cluster Servers
- Disaster recovery of a cluster
- Simplified Disaster Recovery
- Setting or changing the alternate location for the disaster recovery information file
- Creating a Simplified Disaster Recovery disk image
- Preparing to recover from a disaster by using Simplified Disaster Recovery
- Recovering a computer with Simplified Disaster Recovery
- Performing manual disaster recovery
- Integration with Veritas™ Information Map
- Integration with Veritas SaaS Backup
- Forever Incremental Backup
- Appendix A. Backup Exec Agent for Windows
- About the Backup Exec Agent Utility for Windows
- Appendix B. Backup Exec Deduplication Feature
- Creating or importing deduplication disk storage
- Selecting storage devices for direct access sharing
- Appendix C. Backup Exec Agent for VMware
- About establishing trust for a vCenter/ESX(i) server
- Backing up VMware virtual machines
- About instant recovery of a VMware virtual machine
- About Recovery Ready for VMware virtual machines
- Appendix D. Backup Exec Agent for Microsoft Hyper-V
- Backing up Microsoft Hyper-V virtual machines
- About instant recovery of a Hyper-V virtual machine
- About Recovery Ready for Hyper-V virtual machines
- Appendix E. Backup Exec Agent for Microsoft SQL Server
- Backing up SQL databases and transaction logs
- Restoring SQL databases and transaction logs
- Disaster recovery of a SQL Server
- Appendix F. Backup Exec Agent for Microsoft Exchange Server
- Backing up Exchange data
- Appendix G. Backup Exec Agent for Microsoft SharePoint
- Backing up Microsoft SharePoint data
- Appendix H. Backup Exec Agent for Oracle on Windows or Linux Servers
- Configuring the Oracle Agent on Windows computers and Linux servers
- Configuring an Oracle instance on Windows computers
- Viewing an Oracle instance on Windows computers
- About authentication credentials on the Backup Exec server
- About backing up Oracle databases
- About restoring Oracle resources
- Appendix I. Backup Exec Agent for Enterprise Vault
- About backup methods for Enterprise Vault backup jobs
- Restoring Enterprise Vault
- About the Backup Exec Migrator for Enterprise Vault
- Configuring the Backup Exec Migrator
- About retrieving migrated Enterprise Vault data
- About the Partition Recovery Utility
- Appendix J. Backup Exec Agent for Microsoft Active Directory
- Appendix K. Backup Exec Central Admin Server Feature
- About installing the Central Admin Server feature
- What happens when CAS communication thresholds are reached
- About job delegation in CAS
- How to use Backup Exec server pools in CAS
- How centralized restore works in CAS
- Appendix L. Backup Exec Advanced Disk-based Backup Feature
- Appendix M. Backup Exec NDMP Feature
- About restoring and redirecting restore data for NDMP servers
- Viewing the properties of an NDMP server
- Viewing storage properties for an NDMP server
- Appendix N. Backup Exec Agent for Linux
- About installing the Agent for Linux
- About establishing trust for a remote Linux computer in the Backup Exec list of servers
- Editing configuration options for Linux computers
- About backing up a Linux computer by using the Agent for Linux
- About restoring data to Linux computers
- Editing the default backup job options for Linux computers
- Uninstalling the Agent for Linux
- Appendix O. Backup Exec Remote Media Agent for Linux
- About installing the Remote Media Agent for Linux
- About establishing trust for a Remote Media Agent for Linux computer in the Backup Exec list of servers
- About the Backup Exec operators (beoper) group for the Remote Media Agent for Linux
- About adding a Linux server as a Remote Media Agent for Linux
- Editing properties for the Remote Media Agent for Linux
- Creating a simulated tape library
- Viewing simulated tape libraries properties
- Appendix P. Accessibility and Backup Exec
- About keyboard shortcuts in Backup Exec
- Backup and Restore tab keyboard shortcuts
- Storage tab keyboard shortcuts
Configuring encryption for the connection to the Backup Exec Database
The Backup Exec Database contains sensitive information about your organization, including user account credentials and backed up data. Securing Microsoft SQL Server's connection to the Backup Exec Database is an important step in protecting your network from outside access. Microsoft recommends that you use SSL encryption any time data that is transmitted between SQL Server and an application travels across a network.
Data transmission between the Backup Exec services and the SQL instance can travel across the network in the following scenarios:
You configure the Backup Exec Database as a centralized database and it is located on a central administration server in a CAS environment. Data can also travel across the network in variations of this scenario, for example when you use a managed Backup Exec server or when you use shared storage.
You use a remote SQL instance for the Backup Exec Database so that the Backup Exec services must access the database across the network.
Backup Exec automatically enables SSL encryption if you use the default, local SQL Express instance called "BKUPEXEC". If you configure Backup Exec to use any other SQL Server instance, you must configure encryption yourself.
SQL Server uses certificates to encrypt data. You can generate your own certificates or you can let SQL Server use an automatically generated, self-signed certificate. By default, Backup Exec uses the self-signed certificates that SQL Server automatically generates. However, It is recommended that you create and use your own certificates for additional security.
Note:
Using encryption may affect the performance of communications between SQL Server and the Backup Exec Database. It involves an extra round trip across the network as well as time to encrypt and decrypt the data.
Refer to the Microsoft knowledge base for more information about Secure Sockets Layer (SSL) and encrypting connections to SQL Server.
For information about the best practices to manage the database encryption, refer to the Backup Exec Best Practices.
You can use your own certificates or you can let SQL Server use an automatically generated, self-signed certificate. It is recommended that you use your own certificates for improved security. Once you have generated and installed your certificate, you can proceed to configure the secure SQL connection to the Backup Exec Database.
Microsoft has requirements that must be followed when you use your own certificates for SQL Server. Certificates can be either self-signed or issued from a certification authority. Certification authorities can be either a local authority in your organization's domain or a known third-party authority.
For more information about Microsoft's certification requirements, refer to the following Microsoft article:
Encrypting Connections to SQL Server
Before you configure encryption, you must import the certificates that you want to use into the local certificate store of the computer that hosts the Backup Exec Database.
For more information about importing and installing a certificate on the server, refer to the following Microsoft article:
How to: Enable Encrypted Connections to the Database Engine (SQL Server Configuration Manager
When you import certificates, you should use the same user account under which the SQL Server service runs:
If the SQL Server is running under a default computer account such as LocalSystem, NetworkService, or LocalService, then you should use the
option when you import the certificate. Selecting to manage certificates for the computer account ensures that the certificate is placed under the Personal store of the default computer account.If the SQL Server is running under a specific domain account, you must be logged in using the same domain account to import the certificate. When you log into the Microsoft Management Console, select the
option. Selecting to manage certificates for the user account ensures that the certificate is placed under the Personal store of the user who is also running the SQL service account.
Backup Exec automatically enables encryption for SQL connections if you use the default, local SQL Express instance called "BKUPEXEC". If you configure Backup Exec to use any other SQL Server instance, you must configure encryption yourself. You should configure the secure connection on the computer on which the SQL instance hosts the Backup Exec Database.
In some Backup Exec environments, you may need to configure the secure connection more than once:
For clustered Backup Exec environments | You must configure a secure SQL connection on each node in the cluster. If the cluster has not been created yet, configure the secure SQL connection before you run the Cluster Configuration Wizard in Backup Exec. If the cluster has already been created:
|
For Central Admin Server feature (CAS) environments | You must configure a secure SQL connection on each computer in the CAS environment, including the central administration server and any managed Backup Exec servers. |
Use the SQL Server Configuration manager to edit the properties of the protocols for the server that you want to configure. If you want to configure encryption for the default, local database instance that Backup Exec installs, edit the Protocols for BKUPEXEC. Select the certificate that you want to use, if you created a certificate. Then select whether you want to force encryption for the database connection. When you have finished, restart SQL Server and the Backup Exec services from the Services Manager.
For more information or instructions for configuring encrypted connections for SQL, refer to the Microsoft knowledge base.