NetBackup and Veritas Appliances Hardening Guide
- Top recommendations to improve your NetBackup and Veritas appliances security posture
- Introduction
- Keeping all systems and software updated
- Enabling multifactor authentication
- Enabling multiperson authorization
- Increasing the security level
- Implementing an immutable data vault
- Securing credentials
- Reducing network exposure
- Enabling encryption
- Enabling catalog protection
- Enabling malware scanning and anomaly detection
- Enabling security observability
- Restricting user access
- Configuring a sign-in banner
- Steps to protect Flex Appliance
- About Flex Appliance hardening
- Managing multifactor authentication
- Configuring the multi-factor authentication on NetBackup primary and media server instance
- Configuring the multi-factor authentication on NetBackup WORM storage server instance
- Managing single sign-on (SSO)
- Managing user authentication with smart cards or digital certificates
- About lockdown mode
- Using network access control
- Using an external certificate
- Forwarding logs
- Creating a NetBackup WORM storage server instance
- Configuring an isolated recovery environment using the web UI
- Protecting the NetBackup catalog on a WORM storage server
- Using a sign-in banner
- Steps to protect NetBackup Appliance
- About NetBackup Appliance hardening
- About multifactor authentication
- About single sign-on (SSO) authentication and authorization
- About authentication using smart cards and digital certificates
- Disable user access to the NetBackup appliance operating system
- About Network Access Control
- About data encryption
- FIPS 140-2 conformance for NetBackup Appliance
- About implementing external certificates
- About antimalware protection
- About forwarding logs to an external server
- Creating the appliance login banner
- Steps to protect NetBackup
- About NetBackup hardening
- About multifactor authentication
- Configure NetBackup for single sign-on (SSO)
- Configure user authentication with smart cards or digital certificates
- Workflow to configure multi-person authorization for NetBackup operations
- Access codes
- Workflow to configure immutable and indelible data
- Add a configuration for an external CMS server
- Configuring an isolated recovery environment on a NetBackup BYO media server
- About FIPS support in NetBackup
- Installing KMS
- Workflow for external KMS configuration
- Validating KMS credentials
- Configuring KMS credentials
- Configuring KMS
- Creating keys in an external KMS
- Workflow to configure data-in-transit encryption
- Workflow to use external certificates for NetBackup host communication
- About certificate revocation lists for external CA
- Configure an external certificate for the NetBackup web server
- Configuring the primary server to use an external CA-signed certificate
- Configuring an external certificate for a clustered primary server
- Configuring a NetBackup host (media server, client, or cluster node) to use an external CA-signed certificate after installation
- Configuration options for external CA-signed certificates
- ECA_CERT_PATH for NetBackup servers and clients
- ECA_TRUST_STORE_PATH for NetBackup servers and clients
- ECA_PRIVATE_KEY_PATH for NetBackup servers and clients
- ECA_KEY_PASSPHRASEFILE for NetBackup servers and clients
- ECA_CRL_CHECK for NetBackup servers and clients
- ECA_CRL_PATH for NetBackup servers and clients
- ECA_CRL_PATH_SYNC_HOURS for NetBackup servers and clients
- ECA_CRL_REFRESH_HOURS for NetBackup servers and clients
- ECA_DISABLE_AUTO_ENROLLMENT for NetBackup servers and clients
- ECA_DR_BKUP_WIN_CERT_STORE for NetBackup servers and clients
- MANAGE_WIN_CERT_STORE_PRIVATE_KEY option for NetBackup primary servers
- Guidelines for managing the primary server NetBackup catalog
- About protecting the MSDP catalog
- How to set up malware scanning
- About backup anomaly detection
- Send audit events to system logs
- Send audit events to log forwarding endpoints
- Display a banner to users when they sign in
Guidelines for managing the primary server NetBackup catalog
Consider the following:
Catalog backup can be performed while regular backup activity takes place. It is a policy-based backup. It also allows for incremental backups, which can significantly reduce catalog backup times for large catalogs.
Warning:
Failure to backup the primary server NetBackup catalog may result in data loss if a catastrophic failure occurs to the file systems housing the various parts of the catalog.
Note:
Veritas recommends schedule-based, incremental catalog backups with periodic full backups.
Be cautious in using Accelerator full backups daily as a replacement for daily incremental backups. While Accelerator full backups are quick to run, the catalog size will be a full catalog backup instead of an incremental and can grow quickly in size. Backups of client data that contain millions of small files in combination with the use of Accelerator and frequent full backups can also cause the catalog to bloat.
Store the catalog on a separate file system.
The primary server NetBackup catalog can grow quickly depending on backup frequency, retention periods, and the number of files being backed up. With the catalog data on its own file system, catalog growth does not affect other disk resources, root file systems, or the operating system.
Information is available on how to move the catalog.
The following directories and files that are related to the catalog can also be moved. Using an SSD device also improves performance:
On a Linux/UNIX host:
/usr/openv/netbackup/db/error(directory)/usr/openv/netbackup/db/images(directory)/usr/openv/netbackup/db/jobs(directory)/usr/openv/netbackup/db/rb.db(file)
On a Windows host:
C:\Program Files\VERITAS\NetBackup\db\error(directory)C:\Program Files\VERITAS\NetBackup\db\images(directory)C:\Program Files\VERITAS\NetBackup\db\jobs(directory)C:\Program Files\VERITAS\NetBackup\db\rb.db(file)
Change the location of the NetBackup relational database files.
The location of the NetBackup relational database files can be changed or split into multiple directories, for better performance. For example, by placing the transaction log file (
NBDB.log) on a physically separate drive, you gain better protection against disk failure and increased efficiency in writing to the log file.The following directories and files that are related to the catalog can also be moved. Using an SSD device also improves performance:
On a Linux/UNIX host:
/usr/openv/tmp(directory)/usr/openv/var(directory)/usr/openv/db/data(directory)/usr/openv/db/staging(directory)
On a Windows host:
C:\Program Files\VERITAS\NetBackup\Temp(directory)C:\Program Files\VERITAS\NetBackup\var(directory)C:\Program Files\VERITAS\NetBackupDB\data(directory)C:\Program Files\VERITAS\NetBackupDB\staging(directory)
Refer to the procedure in the "NetBackup relational database" appendix of the NetBackup Administrator's Guide, Volume I.
Set a delay to compress the catalog.
The default value for this parameter is 0, which means that NetBackup does not compress the catalog. As your catalog increases in size, you may want to use a value between 10 days and 30 days for this parameter. When you restore old backups, NetBackup automatically uncompresses the files as needed, with minimal performance effect.
Adjust the batch size for sending metadata to the catalog.
This setting affects overall backup performance, not the performance of catalog backups.
Best practices for primary server NetBackup catalog layout:
https://www.veritas.com/content/support/en_US/article.100003918