Please enter search query.
Search <book_title>...
Veritas NetBackup™ Security and Encryption Guide
Last Published:
2018-02-16
Product(s):
NetBackup (8.1.1)
- Increasing NetBackup security
- About NetBackup security and encryption
- NetBackup security implementation levels
- World-level security
- Enterprise-level security
- Datacenter-level security overview
- NetBackup Access Control (NBAC)
- Combined world, enterprise, and data center levels
- NetBackup security implementation types
- Operating system security
- NetBackup security vulnerabilities
- Standard NetBackup security
- Media Server Encryption Option (MSEO) security
- Client side encryption security
- NBAC on master, media server, and graphical user interface security
- NBAC complete security
- All NetBackup security
- Security deployment models
- Workgroups
- Single datacenters
- Multi-datacenters
- Workgroup with NetBackup
- Single datacenter with standard NetBackup
- Single datacenter with Media Server Encryption Option (MSEO)
- Single datacenter with client side encryption
- Single datacenter with NBAC on master and media servers
- Single datacenter with NBAC complete
- Single datacenter with all security implemented
- Multi-datacenter with standard NetBackup
- Multi-datacenter with Media Server Encryption Option (MSEO)
- Multi-datacenter with client side encryption
- Multi-datacenter with NBAC on master and media servers
- Multi-datacenter with NBAC complete
- Multi-datacenter with all NetBackup security
- Port security
- About NetBackup TCP/IP ports
- About NetBackup daemons, ports, and communication
- Standard NetBackup ports
- NetBackup master server outgoing ports
- NetBackup media server outgoing ports
- NetBackup enterprise media management (EMM) server outgoing ports
- Client outgoing ports
- Java server outgoing ports
- Java console outgoing ports
- About MSDP port usage
- About Cloud port usage
- Additional port information for products that interoperate with NetBackup
- About communication ports and firewall considerations in OpsCenter
- Ports required to communicate with backup products
- Web browser to launch OpsCenter user interface
- About OpsCenter user interface and OpsCenter server software communication
- About OpsCenter server to NetBackup master server (NBSL) communication
- About SNMP traps
- About communication between OpsCenter and Sybase database
- About email communication in OpsCenter
- About configuring ports
- Port requirements for NDMP backups
- Known firewall problems encountered when using NetBackup with third-party robotic products
- Auditing NetBackup operations
- About NetBackup auditing
- Viewing the current audit settings
- Configuring auditing on a NetBackup master server
- User identity in the audit report
- About Enhanced Auditing
- Enabling Enhanced Auditing
- Configuring Enhanced Auditing
- Disabling Enhanced Auditing
- Auditing host property changes
- Retaining and backing up audit trail records
- Viewing the audit report
- Using the command line -reason or -r option
- nbaudit log behavior
- Audit alert notification for audit failures
- Access control security
- NetBackup Access Control Security (NBAC)
- About using NetBackup Access Control (NBAC)
- NetBackup access management administration
- About NetBackup Access Control (NBAC) configuration
- Configuring NetBackup Access Control (NBAC)
- NBAC configuration overview
- Configuring NetBackup Access Control (NBAC) on standalone master servers
- Installing the NetBackup master server highly available on a cluster
- Configuring NetBackup Access Control (NBAC) on a clustered master server
- Configuring NetBackup Access Control (NBAC) on media servers
- Installing and configuring access control on clients
- About including authentication and authorization databases in the NetBackup hot catalog backups
- NBAC configure commands summary
- Unifying NetBackup Management infrastructures with the setuptrust command
- Using the setuptrust command
- Configuring Access Control host properties for the master and media server
- Access Control host properties dialog for the client
- Troubleshooting Access Management
- Troubleshooting NBAC issues
- Configuration and troubleshooting topics for NetBackup Authentication and Authorization
- Windows verification points
- UNIX verification points
- Verification points in a mixed environment with a UNIX master server
- Verification points in a mixed environment with a Windows master server
- About the nbac_cron utility
- Using the nbac_cron utility
- Using the Access Management utility
- About determining who can access NetBackup
- Viewing specific user permissions for NetBackup user groups
- Granting permissions
- Authorization objects
- Media authorization object permissions
- Policy authorization object permissions
- Drive authorization object permissions
- Report authorization object permissions
- NBU_Catalog authorization object permissions
- Robot authorization object permissions
- Storage unit authorization object permissions
- DiskPool authorization object permissions
- BUAndRest authorization object permissions
- Job authorization object permissions
- Service authorization object permissions
- HostProperties authorization object permissions
- License authorization object permissions
- Volume group authorization object permissions
- VolumePool authorization object permissions
- DevHost authorization object permissions
- Security authorization object permissions
- Fat server authorization object permissions
- Fat client authorization object permissions
- Vault authorization object permissions
- Server group authorization object permissions
- Key management system (kms) group authorization object permissions
- Upgrading NetBackup Access Control (NBAC)
- Upgrading NetBackup when an older version of NetBackup is using a root broker installed on a remote machine
- Security management in NetBackup
- Overview of security certificates in NetBackup
- About secure communication in NetBackup
- About the Security Management utilities
- About audit events
- About host management
- Hosts tab
- Adding host ID to host name mappings
- Add or Remove Host Mappings dialog box
- Removing host ID to host name mappings
- Mappings for Approval tab
- Viewing auto-discovered mappings
- Mapping Details dialog box
- Approving host ID to host name mappings
- Rejecting host ID to host name mappings
- Adding shared or cluster mappings
- Add Shared or Cluster Mappings dialog box
- Resetting NetBackup host attributes
- Allowing or disallowing automatic certificate reissue
- Adding or deleting comment for a host
- About global security settings
- About secure communication settings
- Disabling insecure communication
- About insecure communication with 8.0 and earlier hosts
- About communication with 8.0 or earlier host in multiple NetBackup domains
- Automatically mapping host ID to host names and IP addresses
- About disaster recovery settings
- Setting a passphrase to encrypt disaster recovery packages
- Disaster recovery packages
- About host name-based certificates
- About host ID-based certificates
- Web login requirements for nbcertcmd command options
- Using the Certificate Management utility to issue and deploy host ID-based certificates
- About certificate deployment security levels
- Automatic host ID-based certificate deployment
- Deploying host ID-based certificates
- Deploying host ID-based certificates in an asynchronous manner
- Implication of clock skew on certificate validity
- Setting up trust with the master server (Certificate Authority)
- Forcing or overwriting certificate deployment
- Retaining host ID-based certificates when reinstalling NetBackup on non-master hosts
- Deploying certificates on a client that has no connectivity with the master server
- About host ID-based certificate expiration and renewal
- Deleting sensitive certificates and keys from media servers and clients
- Cleaning host ID-based certificate information from a host before cloning a virtual machine
- About reissuing host ID-based certificates
- About Token Management for host ID-based certificates
- About the host ID-based certificate revocation list
- About revoking host ID-based certificates
- Deleting host ID-based certificates
- Security certificate deployment in a clustered NetBackup setup
- About deployment of a host ID-based certificate on a clustered NetBackup host
- Deploying host ID-based certificates on cluster nodes
- Revoking a host ID-based certificate for a clustered NetBackup setup
- Deploying a host ID-based certificate on a clustered NetBackup setup using reissue token
- Creating a reissue token for a clustered NetBackup setup
- Renewing a host ID-based certificate on a clustered NetBackup setup
- Viewing certificate details of a clustered NetBackup setup
- Removing CA certificates from a clustered NetBackup setup
- Generating a certificate on a clustered master server after disaster recovery installation
- About the communication between a NetBackup client located in a demilitarized zone and a master server through an HTTP tunnel
- Adding a NetBackup host manually
- Data at rest encryption security
- Data at rest encryption terminology
- Data at rest encryption considerations
- Encryption security questions to consider
- Comparison of encryption options
- About NetBackup client encryption
- Configuring standard encryption on clients
- Managing standard encryption configuration options
- Managing the NetBackup encryption key file
- About configuring standard encryption from the server
- Restoring an encrypted backup file to another client
- About configuring standard encryption directly on clients
- Setting standard encryption attribute in policies
- Changing the client encryption settings from the NetBackup server
- Configuring legacy encryption on clients
- About configuring legacy encryption from the client
- About configuring legacy encryption from the server
- Restoring a legacy encrypted backup created on another client
- About setting legacy encryption attribute in policies
- Changing client legacy encryption settings from the server
- Additional legacy key file security for UNIX clients
- Media server encryption
- Data at rest key management
- Federal Information Processing Standards (FIPS)
- About FIPS enabled KMS
- About the Key Management Service (KMS)
- Installing KMS
- Configuring KMS
- Creating the key database
- About key groups and key records
- Overview of key record states
- About backing up the KMS database files
- About recovering KMS by restoring all data files
- Recovering KMS by restoring only the KMS data file
- Recovering KMS by regenerating the data encryption key
- Problems backing up the KMS data files
- Solutions for backing up the KMS data files
- Creating a key record
- Listing keys from a key group
- Configuring NetBackup to work with KMS
- About using KMS for encryption
- KMS database constituents
- Command line interface (CLI) commands
- CLI usage help
- Create a new key group
- Create a new key
- Modify key group attributes
- Modify key attributes
- Get details of key groups
- Get details of keys
- Delete a key group
- Delete a key
- Recover a key
- About exporting and importing keys from the KMS database
- Modify host master key (HMK)
- Get host master key (HMK) ID
- Get key protection key (KPK) ID
- Modify key protection key (KPK)
- Get keystore statistics
- Quiesce KMS database
- Unquiesce KMS database
- Key creation options
- Troubleshooting KMS
- Regenerating keys and certificates
- About regenerating keys and certificates
- Regenerating NetBackup authentication broker keys and certificates
- Regenerating host identity keys and certificates
- Regenerating web service keys and certificates
- Regenerating nbcertservice keys and certificates
- Regenerating tomcat keys and certificates
- Regenerating JWT keys
- Regenerating NetBackup gateway certificates
- Regenerating web trust store certificates
- Regenerating VMware vCenter plug-in certificates
- Regenerating OpsCenter Administrator Console session certificates
- Regenerating OpsCenter keys and certificates
- Regenerating NetBackup encryption key file
- NetBackup web services account
Forcing or overwriting certificate deployment
In some situations it may be necessary to use the -force option with the nbcertcmd -getCertificate command. For example, to force certificate deployment to a host or to overwrite the existing host ID-based certificate information and fetch a new certificate.
Forcing certificate deployment
A host may already have a host ID-based certificate, but needs to overwrite the old certificate with a new one. This is required, for example, when a master server is replaced with a new server. Since the clients have the old certificate to the old server, when the nbcertcmd -getCertificate command is run on the clients, it fails with the following error:
Certificate already exists for the server.
Use the following procedure to overwrite the existing host ID-based certificate information and fetch a new certificate.
To force certificate deployment on a host
- The host administrator runs the following command on the non-master host:
nbcertcmd -getCertificate -server master_server_name -force
Depending on the security setting on the master server, a token may also need to be specified.
Use the -cluster option to deploy a cluster certificate.
Overwrite the existing host ID-based certificate information and fetch a new certificate
A host may have been issued a certificate, but over time the certificate has become corrupted or the certificate file has been deleted.
The administrator of the non-master host can run the following command to confirm the condition of the certificate:
nbcertcmd -listCertDetails
If the certificate is corrupt, the command fails with the following error:
Certificate could not be read from the local certificate store.
If no certificate details display, the certificate is not available.
Use the following procedure to overwrite the existing host ID-based certificate information and to fetch a new certificate.
To fetch a new host ID-based certificate
- The host administrator runs the following command on the non-master host:
nbcertcmd -getCertificate -force
Depending on the security setting on the master server, a token may also need to be specified.
Use the -cluster option to deploy a cluster certificate.