Veritas NetBackup™ Appliance Security Guide

Last Published:
Product(s): Appliances (3.1.2)
  1. About the NetBackup appliance Security Guide
    1.  
      About the NetBackup appliance Security Guide
  2. User authentication
    1. About user authentication on the NetBackup appliance
      1.  
        User types that can authenticate on the NetBackup appliance
    2. About configuring user authentication
      1.  
        Generic user authentication guidelines
    3.  
      About authenticating LDAP users
    4.  
      About authenticating Active Directory users
    5.  
      About authenticating Kerberos-NIS users
    6.  
      About the appliance login banner
    7. About user name and password specifications
      1.  
        About STIG-compliant password policy rules
  3. User authorization
    1.  
      About user authorization on the NetBackup appliance
    2. About authorizing NetBackup appliance users
      1.  
        NetBackup appliance user role privileges
    3.  
      About the Administrator user role
    4.  
      About the NetBackupCLI user role
  4. Intrusion prevention and intrusion detection systems
    1.  
      About Symantec Data Center Security on the NetBackup appliance
    2.  
      About the NetBackup appliance intrusion prevention system
    3.  
      About the NetBackup appliance intrusion detection system
    4.  
      Reviewing SDCS events on the NetBackup appliance
    5.  
      Running SDCS in unmanaged mode on the NetBackup appliance
    6.  
      Running SDCS in managed mode on the NetBackup appliance
  5. Log files
    1.  
      About NetBackup appliance log files
    2.  
      Viewing log files using the Support command
    3.  
      Where to find NetBackup appliance log files using the Browse command
    4.  
      Gathering device logs on a NetBackup appliance
    5.  
      Log Forwarding feature overview
  6. Operating system security
    1.  
      About NetBackup appliance operating system security
    2.  
      Major components of the NetBackup appliance OS
    3.  
      Vulnerability scanning of the NetBackup appliance
  7. Data security
    1.  
      About data security
    2.  
      About data integrity
    3.  
      About data classification
    4. About data encryption
      1.  
        KMS support
  8. Web security
    1.  
      About SSL usage
    2.  
      Implementing third-party SSL certificates
  9. Network security
    1.  
      About IPsec Channel Configuration
    2.  
      About NetBackup appliance ports
    3.  
      About the NetBackup Appliance firewall
  10. Call Home security
    1. About AutoSupport
      1.  
        Data security standards
    2. About Call Home
      1.  
        Configuring Call Home from the NetBackup Appliance Shell Menu
      2.  
        Enabling and disabling Call Home from the appliance shell menu
      3.  
        Configuring a Call Home proxy server from the NetBackup Appliance Shell Menu
      4.  
        Understanding the Call Home workflow
    3. About SNMP
      1.  
        About the Management Information Base (MIB)
  11. Remote Management Module (RMM) I security
    1.  
      Introduction to IPMI configuration
    2.  
      Recommended IPMI settings
    3.  
      RMM ports
    4.  
      Enabling SSH on the Remote Management Module
    5.  
      Replacing the default IPMI SSL certificate
  12. STIG and FIPS conformance
    1.  
      OS STIG hardening for NetBackup appliances
    2.  
      Unenforced STIG hardening rules
    3.  
      FIPS 140-2 conformance for NetBackup appliances
  13. Appendix A. Security release content
    1.  
      NetBackup Appliance security release content

About user authentication on the NetBackup appliance

The NetBackup appliance is administered and managed through user accounts. You can create local user accounts, or register users and user groups that belong to a remote directory service. Each user account must authenticate itself with a user name and password to access the appliance. For a local user, the user name and password are managed on the appliance. For a registered remote user, the user name and password are managed by the remote directory service.

In order for a new user account to log on and access the appliance, you must first authorize it with a role. By default, a new user account does not have an assigned role, and therefore it cannot log on until you grant it a role.

Table: NetBackup appliance account types describes the user accounts that are available on the appliance.

Table: NetBackup appliance account types

Account name

Description

admin

The admin account is the default Administrator user on the NetBackup appliance. This account provides full appliance access and control for the default Administrator user.

New NetBackup appliances are shipped with the following default logon credentials:

  • User name: admin

  • Password: P@ssw0rd

When mounting or mapping shares from an appliance, make note of the following:

  • Windows: Only the local admin account is authorized to mount or map Windows CIFS shares.

  • Linux: Only users with a root access account can issue the mount command directly to mount NFS shares.

AMSadmin

The AMSadmin account provides full access to the following appliance interfaces:

  • Appliance Management Console

  • NetBackup Appliance Web Console

  • NetBackup Appliance Shell Menu

  • NetBackup Administration console

For complete details about this account, see the Veritas Appliance Management Guide.

maintenance

The maintenance account is used by Veritas Support through the NetBackup Appliance Shell Menu (after an administrative log-on). This account is used specifically to perform maintenance activity or to troubleshoot the appliance.

Note:

This account is also used to make GRUB changes, and for single user mode boot when the STIG option is enabled.

nbasecadmin

The nbasecadmin account is used by the Security Administrator user for role-based access control (RBAC) in NetBackup. Starting with appliance release 3.1.2, this user is created automatically when you perform the initial configuration on an appliance master server or when you upgrade an appliance master server.

Once created, this account is assigned the default appliance password. When this user first logs in to the NetBackup Appliance Shell Menu, they are prompted to change the default password for the account.

Note:

This user cannot log in to the NetBackup Web UI until the default password is changed.

After the default password has been changed, the nbasecadmin user is allowed the following access and privileges:

  • NetBackup Web UI

    Access to the NetBackup Web UI lets this user set user roles for other NetBackup users and manage all NetBackup security settings.

  • NetBackup Appliance Shell Menu

    Log in to the NetBackup Appliance Shell Menu to change the password for the account. Access is limited to the Main > Settings > Password view.

    This view is visible to the nbasecadmin user and all appliance local users that have No Role assigned on the appliance. When the nbasecadmin user is logged in to the shell menu, only the following menu items are available:

    Exit

    Password

By default, the nbasecadmin user has privileges to log in to the NetBackup Web UI and set the user roles for other users and manage all NetBackup security settings. The access rules for the nbasecadmin user can also be changed to allow more privileges. To access the NetBackup Web UI, this user can open a browser window and enter the URL https:<appliance master server host name>/webui.

For more information about RBAC and NetBackup user role management, see the NetBackup Web UI Security Administrator's Guide.

The following describes the accounts that are available only for internal users. These accounts do not allow system access through the NetBackup Appliance Web Console or the NetBackup Appliance Shell Menu.

Table: NetBackup appliance internal account types

Account name

Description

sisips

The sisips account is an internal user for implementing the SDCS policies.

root

The root account is a restricted user that is only accessed by Veritas Support to perform maintenance tasks. If you try to access this account, the following message is displayed:

Permission Denied !! Access to the root account requires 
overriding the Intrusion Security Policy.

Please refer to the appliance security guide for 
overriding instructions.

Warning:

Although you can override the Intrusion Security Policy (ISP) to gain access to the root account, doing so is not recommended. Overriding this policy puts the system at risk and makes it more vulnerable to an attack.

nbcopilotxxxx

Supports authentication for access from the master to the media server.

AppComm

Does not support authentication.

nbwebsvc

Does not support authentication.

See About authorizing NetBackup appliance users.