Veritas NetBackup™ 8.0 Security and Encryption Guide
- Increasing NetBackup security
- Security deployment models
- Port security
- About NetBackup daemons, ports, and communication
- Additional port information for products that interoperate with NetBackup
- About configuring ports
- Auditing NetBackup operations
- Configuring Enhanced Auditing
- Access control security
- NetBackup Access Control Security (NBAC)
- Configuring NetBackup Access Control (NBAC)
- Configuring Access Control host properties for the master and media server
- Access Control host properties dialog for the client
- Troubleshooting Access Management
- Windows verification points
- UNIX verification points
- Verification points in a mixed environment with a UNIX master server
- Verification points in a mixed environment with a Windows master server
- About determining who can access NetBackup
- Viewing specific user permissions for NetBackup user groups
- Security certificates in NetBackup
- Overview of security certificates in NetBackup
- About the Security Management utilities
- About host name-based certificates
- About host ID-based certificates
- Using the Certificate Management utility to issue and deploy host ID-based certificates
- About certificate deployment security levels
- Setting up trust with the master server (Certificate Authority)
- About reissuing host ID-based certificates
- About Token Management for host ID-based certificates
- About revoking host ID-based certificates
- Security certificate deployment in a clustered NetBackup setup
- About deployment of a host ID-based certificate on a clustered NetBackup host
- About deploying a new host ID-based certificate
- Data at rest encryption security
- About NetBackup client encryption
- Configuring standard encryption on clients
- About configuring standard encryption from the server
- Configuring legacy encryption on clients
- About configuring legacy encryption from the client
- About configuring legacy encryption from the server
- Additional legacy key file security for UNIX clients
- Data at rest key management
- About the Key Management Service (KMS)
- Installing KMS
- Configuring KMS
- About key groups and key records
- Overview of key record states
- Configuring NetBackup to work with KMS
- About using KMS for encryption
- KMS database constituents
- Command line interface (CLI) commands
- About exporting and importing keys from the KMS database
- Troubleshooting KMS
Updating port settings for the Media Manager in the vm.conf file
The vm.conf file specifies Media Manager connection options. If you want to override the default connection options, you need to edit the vm.conf file. The NetBackup administration console does not provide a way to change these settings. The path to the vm.conf is as follows:
On Linux or UNIX, the path is as follows:
/usr/openv/volmgr/vm.conf
On Windows systems, the path is as follows:
install_path\volmgr\vm.conf
Table: Port usage-related Media Manager configuration settings shows the vm.conf file settings that affect ports.
Table: Port usage-related Media Manager configuration settings
Setting | Description |
---|---|
CLIENT_PORT_WINDOW | Specifies the range of source ports that can be used on outgoing Media Manager connections. The format is as follows: CLIENT_PORT_WINDOW = min max The min argument defines the lowest source port number. The max argument defines the highest source port number. For min and max, specify 0 (zero) or specify integers from 1024 to 65535. If min is 0 or if max is less than min, then the operating system determines the source port number. By default, CLIENT_PORT_WINDOW = 0 0. For example, the following setting defines a source port range from 3000 to 8000: CLIENT_PORT_WINDOW = 3000 8000 |
CONNECT_OPTIONS | Note: The CONNECT_OPTIONS setting affects only connections to hosts that run NetBackup 7.0. When NetBackup connects to hosts that run NetBackup 7.0.1 and later, NetBackup uses the veritas_pbx port. Specifies the destination port number that can be used to connect to the Media Manager services. The format is as follows: CONNECT_OPTIONS = host 0 0 0|1|2 This setting accepts four space-separated arguments. The arguments are as follows. For host, specify the name of the media server to which other computers need to connect. After the host name, type 0 0. The arguments in these positions are not used. After 0 0, type 0, 1, or 2 to specify the connection method to the Media Manager service on the target computer. The connection method specifications are as follows:
You can specify multiple CONNECT_OPTIONS settings in the vm.conf file. For NetBackup, if the For example, the following settings specify that the Media Manager connections to server3 use vnetd as the destination port: CONNECT_OPTIONS = server3 0 0 1 |
RANDOM_PORTS | Specifies whether NetBackup chooses ports randomly or sequentially when it communicates with other NetBackup servers. The format is as follows: RANDOM_PORTS = YES | NO If RANDOM_PORTS = YES, or if there is no RANDOM_PORT entry, NetBackup selects a random port from the range specified by the CLIENT_PORT_WINDOW setting in the vm.conf file. If RANDOM_PORTS = NO, the NetBackup attempts the connection with the highest source port number in the range. If the source port does not work, NetBackup tries the next highest source port number. The port number is chosen from the list until it finds a source port number that works. |