NetBackup and NetBackup Appliances Hardening Guide
- Top recommendations to improve your NetBackup and NetBackup appliances security posture
- Introduction
- Keeping all systems and software updated
- Enabling multifactor authentication
- Enabling multiperson authorization
- Increasing the security level
- Implementing an immutable data vault
- Securing credentials
- Reducing network exposure
- Enabling encryption
- Enabling catalog protection
- Enabling malware scanning and anomaly detection
- Enabling security observability
- Restricting user access
- Configuring a sign-in banner
- Steps to protect Flex Appliance
- About Flex Appliance hardening
- Managing multifactor authentication
- Managing multifactor authentication on a primary or a media server instance
- Managing multifactor authentication on a WORM storage server
- Managing single sign-on (SSO)
- Managing user authentication with smart cards or digital certificates
- About lockdown mode
- Using network access control
- Using an external certificate
- Forwarding logs
- Creating a NetBackup WORM storage server instance
- Configuring an isolated recovery environment using the web UI
- Protecting the MSDP catalog on a WORM storage server
- Using a sign-in banner
- Steps to protect NetBackup Appliance
- About NetBackup Appliance hardening
- About multifactor authentication
- About single sign-on (SSO) authentication and authorization
- About authentication using smart cards and digital certificates
- Disable user access to the NetBackup appliance operating system
- About Network Access Control
- About data encryption
- FIPS 140-2 conformance for NetBackup Appliance
- About implementing external certificates
- About antimalware protection
- About forwarding logs to an external server
- Creating the appliance login banner
- Steps to protect NetBackup
- About NetBackup hardening
- About multifactor authentication
- Configure NetBackup for single sign-on (SSO)
- Configure user authentication with smart cards or digital certificates
- Workflow to configure multi-person authorization for NetBackup operations
- Access codes
- Workflow to configure immutable and indelible data
- Add a configuration for an external CMS server
- Configuring an isolated recovery environment on a NetBackup BYO media server
- About FIPS support in NetBackup
- Installing KMS
- Workflow for external KMS configuration
- Validating KMS credentials
- Configuring KMS credentials
- Configuring KMS
- Creating keys in an external KMS
- Workflow to configure data-in-transit encryption
- Workflow to use external certificates for NetBackup host communication
- About certificate revocation lists for external CA
- Configure an external certificate for the NetBackup web server
- Configuring the primary server to use an external CA-signed certificate
- Configuring an external certificate for a clustered primary server
- Configuring a NetBackup host (media server, client, or cluster node) to use an external CA-signed certificate after installation
- Configuration options for external CA-signed certificates
- ECA_CERT_PATH for NetBackup servers and clients
- ECA_TRUST_STORE_PATH for NetBackup servers and clients
- ECA_PRIVATE_KEY_PATH for NetBackup servers and clients
- ECA_KEY_PASSPHRASEFILE for NetBackup servers and clients
- ECA_CRL_CHECK for NetBackup servers and clients
- ECA_CRL_PATH for NetBackup servers and clients
- ECA_CRL_PATH_SYNC_HOURS for NetBackup servers and clients
- ECA_CRL_REFRESH_HOURS for NetBackup servers and clients
- ECA_DISABLE_AUTO_ENROLLMENT for NetBackup servers and clients
- ECA_DR_BKUP_WIN_CERT_STORE for NetBackup servers and clients
- MANAGE_WIN_CERT_STORE_PRIVATE_KEY option for NetBackup primary servers
- Guidelines for managing the primary server NetBackup catalog
- About protecting the MSDP catalog
- How to set up malware scanning
- About backup anomaly detection
- Send audit events to system logs
- Send audit events to log forwarding endpoints
- Display a banner to users when they sign in
- Steps to protect NetBackup Flex Scale
- About NetBackup Flex Scale hardening
- About the security meter
- STIG overview for NetBackup Flex Scale
- FIPS overview for NetBackup Flex Scale
- Managing the login banner
- Changing the password policy
- Support for immutability in NetBackup Flex Scale
- Authenticating users using digital certificates or smart cards
- About system certificates on NetBackup Flex Scale
- Deploying external certificates on NetBackup Flex Scale
- About multifactor authentication
- Considerations before configuring multifactor authentication
- Configuring multifactor authentication for your user account
- Disabling multifactor authentication for your user account
- Enforcing multifactor authentication for all users
- Configuring multifactor authentication for your user account when it is enforced in the cluster
- Resetting multifactor authentication for a user
- About single sign-on (SSO) configuration
- Configuring isolated recovery environment (IRE)
- Steps to protect Access Appliance
- About Access Appliance hardening
- FIPS 140-2 conformance for Access Appliance
- Managing the login banner using the UI
- Managing the password policy using the UI
- Support for immutability in Access Appliance
- About system certificates on Access Appliance
- About single sign-on (SSO) configuration
- Configuring user authentication using digital certificates or smart cards
- About multifactor authentication
- Considerations when configuring multifactor authentication
- Configuring multifactor authentication for your user account
- Disabling multifactor authentication for your user account
- Enforcing multifactor authentication for all users
- Configuring multifactor authentication for your user account when it is enforced in the cluster
- Resetting multifactor authentication for a user
- Configuring an isolated recovery environment using the command line
- Forwarding logs to an external server
Configuring LDAP server settings
You can set the LDAP base Distinguished Name (base DN). LDAP records are structured in a hierarchical tree. You access records through a particular path, in this case, a Distinguished Name, or DN. The base DN indicates where in the LDAP directory hierarchy you want to start your search.
Note:
For Access Appliance to access an LDAP directory service, you must specify the LDAP server DNS name or IP address.
To set the base DN for the LDAP server
- To set the base DN for the LDAP server, enter the following:
Network> ldap set basedn value
where value is the LDAP base DN in the following format:
dc=yourorg,dc=com
To set the LDAP server hostname or IP address
- To set the LDAP server hostname or IP address, enter the following:
Network> ldap set server value
where value is the LDAP server hostname or IP address.
To set the LDAP server port number
- To set the LDAP server port number, enter the following:
Network> ldap set port value
where value is the LDAP server port number.
To set Access Appliance to use LDAP over SSL
- To set Access Appliance to use LDAP over SSL, enter the following:
Network> ldap set ssl {on|off}
To set the bind DN for the LDAP server
- To set the bind DN for the LDAP server, enter the following:
Network> ldap set binddn value
where value is the LDAP bind DN in the following format:
cn=binduser,dc=yourorg,dc=com
The value setting is mandatory.
You are prompted to supply a password. You must use the password used to connect to the LDAP service on the specified LDAP server.
To set the root bind DN for the LDAP server
- To set the root bind DN for the LDAP server, enter the following:
Network> ldap set rootbinddn value
where value is the LDAP root bind DN in the following format:
cn=admin,dc=yourorg,dc=com
You are prompted to supply a password. You must use the password used to connect to the LDAP service on the specified LDAP server.
To set the LDAP users, groups, or netgroups base DN
- To set the LDAP users, groups, or netgroups base DN, enter the following:
Network> ldap set users-basedn value
Network> ldap set groups-basedn value
Network> ldap set netgroups-basedn value
users-basedn value
Specifies the value for the users-basedn. For example:
ou=users,dc=example,dc=com (default)
groups-basedn value
Specifies the value for the groups-basedn. For example:
ou=groups,dc=example,dc=com (default)
netgroups-basedn value
Specifies the value for the netgroups-basedn. For example:
ou=netgroups,dc=example,dc=com (default)
To display the LDAP configured settings
- To display the LDAP configured settings, enter the following:
Network> ldap get {server|port|basedn|binddn|ssl|rootbinddn| users-basedn|groups-basedn|netgroups-basedn}
To clear the LDAP settings
- To clear the previously configured LDAP settings, enter the following:
Network> ldap clear {server|port|basedn|binddn|ssl|rootbinddn| users-basedn|groups-basedn|netgroups-basedn}
To clear all the LDAP settings
- To clear the LDAP client configuration settings for all parameters, enter the following:
Network> ldap clearall