NetBackup Flex Appliance Getting Started and Administration Guide
- Product overview
- Release notes
- Flex Appliance 6.0 new features, enhancements, and changes
- Flex Appliance 6.1 new features, enhancements, and changes
- Flex Appliance 6.2 new features, enhancements, and changes
- Supported update paths to this release
- Operational notes
- Flex Appliance 6.0 release content
- Flex Appliance 6.1 release content
- Flex Appliance 6.2 release content
- Getting started
- Managing network settings for instances
- Managing users
- Overview of the Flex Appliance default users
- Managing Flex Appliance Console users and tenants
- Adding a tenant
- Editing a tenant
- Removing a tenant
- Adding a local user to the Flex Appliance Console
- Connecting a remote user domain to the Flex Appliance Console
- Editing a remote user domain in the Flex Appliance Console
- Importing a remote user or user group to the Flex Appliance Console
- Managing single sign-on (SSO)
- Managing identity providers (IDPs)
- Importing a single sign-on user or user group to the Flex Appliance Console
- Managing user authentication with smart cards or digital certificates
- Changing a local user password in the Flex Appliance Console
- Expiring local user passwords in the Flex Appliance Console
- Unlocking a user account in the Flex Appliance Console
- Managing open sessions
- Removing user or service accounts from the Flex Appliance Console
- Changing the password policy
- Changing the hostadmin user password in the Flex Appliance Shell
- Changing the sysadmin user password in the Veritas Remote Management Interface
- Managing multifactor authentication
- Using Flex Appliance Console accounts for API automation
- Using Flex Appliance
- Managing the repository
- Creating application instances
- Managing application instances from Flex Appliance and NetBackup
- Managing application instances from Flex Appliance
- Upgrading application instances
- Updating an application instance to a newer revision
- About Flex Appliance updates
- Changing the BIOS password
- Locating the node serial number
- Remote replication
- About remote replication
- Pairing appliances for remote replication
- Creating a replica
- Managing remote replication
- Remote replication best practices
- Monitoring remote replication
- Editing the replication network
- Repairing a lost connection between paired appliances
- Pausing and resuming replication
- Resolving discrepancies between an active and a replica instance
- Changing the replication role of an instance
- Unlinking active and replica instances
- Forgetting a paired appliance
- Appliance security
- Monitoring the appliance
- Registering an appliance
- Configuring alerts
- Viewing performance metrics
- Monitoring the appliance from the System Health Insights portal
- Viewing the hardware status
- Viewing hardware faults
- Viewing system data
- Clearing the hardware status
- Forwarding logs
- Providing access for external monitoring
- Revoking access for external monitoring
- Reconfiguring the appliance
- Reconfiguring the appliance network
- Changing DNS or Hosts file settings
- Shutting down the appliance
- Performing a factory reset
- Performing a reimage
- Recovering storage data after a factory reset or a reimage
- Performing a storage reset
- Removing a node
- Viewing or resetting the storage shelf order on a 52xx appliance
- Troubleshooting guidelines
Security overview
Flex Appliance includes multiple features to ensure the security of your data. Each element of the appliance is tested for vulnerabilities using both industry standards and advanced security products. These measures ensure that exposure to unauthorized access and resulting data loss or theft is minimized.
Flex Appliance also uses the Security Technical Implementation Guide (STIG) template to meet security requirements per the Defense Information Systems Agency (DISA) profile.
The security features in this release include but are not limited to the following:
OS security hardening, including Security-Enhanced Linux (SELinux).
Forced password changes during initial configuration to make sure that the default password does not remain active on the system.
The ability to set your own password policy, including the option to use STIG for validation.
No root access from the Flex Appliance Console.
Lockdown mode and WORM storage support, which let you set additional access restrictions and block data deletion during a specified retention period.
Lockdown mode also restricts root access from the Flex Appliance Shell.
See About lockdown mode.
The ability to add a sign-in banner that appears before a user signs in to the Flex Appliance Console and the Flex Appliance Shell.
Support for external certificates.
Support for multifactor authentication, including the ability to enforce it for all Flex Appliance Console users.
Session timeouts that automatically sign users out of the Flex Appliance Console and the Flex Appliance Shell after 10 minutes of inactivity.
Conformance to the Federal Information Processing Standards (FIPS) 140-2.
Password protection in the Flex Appliance Console that locks local user accounts after three sign-in attempts with incorrect passwords. If a security administrator account becomes locked, it is unlocked automatically after 30 minutes. If a different local user account becomes locked, that user and a security administrator must work together to unlock it.
Sign-in protection in the Flex Appliance Console that locks user accounts with multifactor authentication for 15 minutes after three sign-in attempts with incorrect codes.
Login protection in the Flex Appliance Shell that locks the hostadmin account for 15 minutes after three login attempts with incorrect passwords or multifactor authentication codes.
Password protection that restricts access to the GRUB menu except with assistance from Technical Support. If you need to edit GRUB, contact Technical Support and ask your representative to reference article 100048098.
Support for Transport Layer Security (TLS) anonymous authentication versions 1.3 and 1.2 for all connections to the appliance except for SNMP connections. Version 1.3 is used by default, while version 1.2 is available for backwards compatibility.
SNMP connections use the User-based Security Model (USM).
Mandatory access controls that limit resource access only to those programs and activities that require it, regardless of their system privileges.
A built-in firewall that blocks all access except for the ports that are required for backup and management.
Namespaces that partition system resources into distinct, isolated compartments. Each instance gets its own "view" of these resources, which prevents processes within one instance from seeing or interfering with processes or resources in another instance or on the appliance.
Instances are also assigned limited-service privileges that define which executables and system calls are allowed without the need for elevated system privileges. Moreover, NetBackup services are separated from the backup images that are stored on WORM instances.
Also note the following information regarding the appliance security:
IP forwarding is enabled in Flex Appliance by design; it is used to facilitate network communication between application instances and external networks.
Simultaneous multithreading (smt) is enabled by default on the 53xx appliance.
The following vulnerabilities affect this feature:
CVE-2018-12130
CVE-2018-12126
CVE-2018-12127
CVE-2019-11091
You can disable smt to address these vulnerabilities; however, significant performance degradation may occur. If you want to disable smt, contact Technical Support and ask your representative to reference article 100046154.