Veritas NetBackup™ Appliance Security Guide

Last Published:
Product(s): Appliances (3.1.2)
  1. About the NetBackup appliance Security Guide
    1.  
      About the NetBackup appliance Security Guide
  2. User authentication
    1. About user authentication on the NetBackup appliance
      1.  
        User types that can authenticate on the NetBackup appliance
    2. About configuring user authentication
      1.  
        Generic user authentication guidelines
    3.  
      About authenticating LDAP users
    4.  
      About authenticating Active Directory users
    5.  
      About authenticating Kerberos-NIS users
    6.  
      About the appliance login banner
    7. About user name and password specifications
      1.  
        About STIG-compliant password policy rules
  3. User authorization
    1.  
      About user authorization on the NetBackup appliance
    2. About authorizing NetBackup appliance users
      1.  
        NetBackup appliance user role privileges
    3.  
      About the Administrator user role
    4.  
      About the NetBackupCLI user role
  4. Intrusion prevention and intrusion detection systems
    1.  
      About Symantec Data Center Security on the NetBackup appliance
    2.  
      About the NetBackup appliance intrusion prevention system
    3.  
      About the NetBackup appliance intrusion detection system
    4.  
      Reviewing SDCS events on the NetBackup appliance
    5.  
      Running SDCS in unmanaged mode on the NetBackup appliance
    6.  
      Running SDCS in managed mode on the NetBackup appliance
  5. Log files
    1.  
      About NetBackup appliance log files
    2.  
      Viewing log files using the Support command
    3.  
      Where to find NetBackup appliance log files using the Browse command
    4.  
      Gathering device logs on a NetBackup appliance
    5.  
      Log Forwarding feature overview
  6. Operating system security
    1.  
      About NetBackup appliance operating system security
    2.  
      Major components of the NetBackup appliance OS
    3.  
      Vulnerability scanning of the NetBackup appliance
  7. Data security
    1.  
      About data security
    2.  
      About data integrity
    3.  
      About data classification
    4. About data encryption
      1.  
        KMS support
  8. Web security
    1.  
      About SSL usage
    2.  
      Implementing third-party SSL certificates
  9. Network security
    1.  
      About IPsec Channel Configuration
    2.  
      About NetBackup appliance ports
    3.  
      About the NetBackup Appliance firewall
  10. Call Home security
    1. About AutoSupport
      1.  
        Data security standards
    2. About Call Home
      1.  
        Configuring Call Home from the NetBackup Appliance Shell Menu
      2.  
        Enabling and disabling Call Home from the appliance shell menu
      3.  
        Configuring a Call Home proxy server from the NetBackup Appliance Shell Menu
      4.  
        Understanding the Call Home workflow
    3. About SNMP
      1.  
        About the Management Information Base (MIB)
  11. Remote Management Module (RMM) I security
    1.  
      Introduction to IPMI configuration
    2.  
      Recommended IPMI settings
    3.  
      RMM ports
    4.  
      Enabling SSH on the Remote Management Module
    5.  
      Replacing the default IPMI SSL certificate
  12. STIG and FIPS conformance
    1.  
      OS STIG hardening for NetBackup appliances
    2.  
      Unenforced STIG hardening rules
    3.  
      FIPS 140-2 conformance for NetBackup appliances
  13. Appendix A. Security release content
    1.  
      NetBackup Appliance security release content

Implementing third-party SSL certificates

You can manually add and implement third-party certificates for the web service support. The appliance uses the Java KeyStore as the repository of security certificates. A Java KeyStore (JKS) is a repository of security certificates, like the authorization certificates or the public key certificates that are used for instance in SSL encryption. To implement the third-party certificates in the appliance you must log in as the root account.

Note:

Contact Veritas Technical Support if you need assistance with this procedure.

To implement third-party SSL certificates:

  1. Prepare the keystore file for web services.

    This task varies with the type of PKCS (Public-key Cryptography Standards) you use. No matter which PKCS type you choose, the certificate must contain the following extension:

    SubjectAlternativeName [

    DNSName: hostnames and IP addresses

    Where hostnames is the fully qualified domain name of the appliance and IP address corresponds to the fully qualified domain name of the appliance.

    The following describes the preparation required to use PKCS# 7 and PKCS# 12 standard formats:

    • PKCS#7 (X.509) format

      Use the following link:

      convert certificate

    • PKCS#12 format

      Do the following:

      • To convert a PEM formatted x509 Cert and Private Key to a PKCS# 12, type the following commands:

        openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name tomcat -CAfile ca.crt -caname root

        For more information on openssl usage, refer to https://www.openssl.org/.

      • At the bottom of the certificate file server.crt, make sure that you include the chain of intermediary certificate authority (CA) certificates, up to but not including the root CA certificate.

      • Make sure that you secure the PKCS #12 file with a password. When the password is not applied to the file, you may get a null reference exception when you try to import the file.

      • To convert the PKCS #12 file to a Java Keystore, type the following commands:

        keytool -importkeystore -deststorepass appliance -destkeypass appliance -destkeystore keystore -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass some- password -alias tomcat

        Note:

        Make sure to specify the same password for the -deststorepass and -destkeypass options. Otherwise, you may get an exception when the web server starts. For the password, only alphanumeric characters are supported. The default password is appliance. Also, make sure to specify tomcat for the -alias option. Otherwise, you may get an exception when the web server starts.

        For more information on keytool usage, refer to the following link:

        http://docs.oracle.com/javase/8/docs/technotes/tools/solaris/keytool.html

  2. Type the following command to shut down the database and relevant services:

    systemctl stop nginx

    /opt/IMAppliance/scripts/infraservices.sh database stop

    /opt/IMAppliance/scripts/infraservices.sh webserver stop

  3. Replace the existing keystore file with your new keystore file in the following directory:

    /opt/apache-tomcat/security/

  4. Set the permissions to the new keystore file:

    chmod 700 /opt/apache-tomcat/security

    chmod 600 /opt/apache-tomcat/security/keystore

    chown - R tomcat:tomcat /opt/apache-tomcat/security

  5. Type the following command to update the web server configuration if you choose to use your own non-default password in the previous steps:

    /opt/apache-tomcat/vrts/scripts/tomcat_instance.py update --keystore --password <your password>

  6. Update the Tomcat_Keystore and Tomcat_Keystore_Passwd settings in the /etc/rc.d/init.d/as-functions file.
  7. Get the server_cert file from /etc/vxos-ssl/cert.conf and import the certificates into it with the following command:

    /usr/bin/openssl pkcs12 -in server.p12 -out <server_cert> -passin pass: <keyPassword> -passout pass: <keyPassword>

  8. Get the client_cert file from /etc/vxos-ssl/cert.conf and replace the content of the file with the Root CA certificate.
  9. If the customized password is different than the pem_password in /etc/vxos-ssl/cert.conf, modify /etc/vxos-ssl/cert.conf to use the customized password.
  10. Type the following commands to restart nginx:

    /usr/sbin/update-nginx-conf.sh

    systemctl stop nginx

    systemctl start nginx

  11. Type the following commands to restart the web service:

    /opt/IMAppliance/scripts/infraservices.sh database start

    /opt/IMAppliance/scripts/infraservices.sh webserver start

  12. Type the following commands to restart the AutoSupport Service:

    service as-alertmanager stop

    service as-analyzer stop

    service as-transmission stop

    service as-alertmanager start

    service as-analyzer start

    service as-transmission start

  13. For each master server that is associated with a version 3.1.2 or greater NetBackup Appliance media server, run the following command on each master server for each 3rd party root CA SSL certificate that you need to deploy. The command must be run from the root level.
    • For a NetBackup UNIX-based or appliance master server:

      /usr/openv/java/jre/bin/keytool -importcert -storepass 'cat /usr/openv/var/global/jkskey' -keystore /usr/openv/var/global/wsl/credentials/truststoreMSDP -file <path to root CA certificate file> -alias <descriptive label for root CA certificate>

    • For a NetBackup Windows-based master server:

      • Get the keystore password from the jkskey file at the following path. You can use a text editor or a shell/command utility such as "type" to read the jkskey file.

        Note:

        Replace C: with the appropriate drive letter where NetBackup is installed.

        C:\Program Files\Veritas\NetBackup\var\global\jkskey

        Caution:

        The above path leads to a file that contains the NetBackup password for the Java keystore files that are used by the NetBackup Web Management Console. That file should be treated as confidential and sensitive, and it should never be edited. Otherwise, NetBackup will fail to work.

      • Enter the following command and replace keystore password with the password from the previous task:

        Note:

        Replace C: with the appropriate drive letter where NetBackup is installed.

        "C:\Program Files\Veritas\NetBackup\jre\bin\keytool" -importcert -keystore "C:\Program Files\Veritas\NetBackup\var\global\wsl\credentials\truststoreMSDP" -storepass <keystore password> -file "<path to root CA certificate file>" -alias <descriptive label for root CA certificate>