Veritas NetBackup™ Appliance Security Guide
- About the NetBackup Appliance Security Guide
- User authentication
- User authorization
- Intrusion prevention and intrusion detection systems
- Log files
- Operating system security
- Data security
- Web security
- Network security
- Call Home security
- Remote Management Module (RMM) security
- Appendix A. Security release content
About NetBackup appliance operating system security
The NetBackup appliances run a customized Linux operating system (OS) provided by Veritas. Each NetBackup appliance software release includes the latest appliance OS and NetBackup software. In addition to regular security patches and updates, the appliance OS includes the following security enhancements and features:
An updated and trimmed Red Hat Enterprise Linux (RHEL)-based OS platform that enables the packaging and installation of all the necessary software components on a compatible and a robust hardware platform.
Symantec Data Center Security: Server Advanced (SDCS) intrusion prevention and intrusion detection software that hardens the appliance OS and protects the backup data by isolating and sandboxing each process and all system files.
Regular scan of the NetBackup appliance with industry-recognized vulnerability scanners. Any discovered vulnerabilities are patched in regular releases of the appliance software and with emergency engineering binaries (EEBs). If security threats are identified between release schedules, you can contact Veritas Support for a known resolution.
Nonusers and unused service accounts are removed or disabled.
The appliance OS includes edited kernel parameters that secure the appliance against attacks such as denial of service (DoS). For example, the sysctl setting
net.ipv4.tcp_syncookies
has been added to/etc/sysctl.conf
configuration file to implement TCP SYN cookies.Unnecessary runlevel services are disabled. The appliance OS uses runlevels to determine the services that should be running and to allow specific work to be done on the system.
FTP, telnet, and rlogin (rsh) are disabled. Usage is limited to ssh, scp, and sftp.
TCP forwarding for SSH is disabled with the addition of
AllowTcpForwarding no
andX11Forwarding no
to/etc/ssh/sshd_config
.IP forwarding is disabled on the appliance OS and does not allow routing on the TCP/IP stack. This feature prevents a host on one subnet from using the appliance as a router to access a host on another subnet.
The NetBackup appliance does not allow IP aliasing (configuring multiple IP addresses) on the network interface. This feature prevents access to multiple network segments on one NIC port.
The UMASK value determines the file permission for newly created files. It specifies the permissions which should not be given by default to the newly created file. Although the default value of UMASK in most UNIX systems is 022, UMASK is set to 077 for the NetBackup Appliance.
The permissions of all the world-writable files that are found in the appliance OS are searched and fixed.
The permissions of all the orphaned and unowned files and directories that are found in the appliance OS are searched and fixed.