NetBackup™ Appliance Security Guide

116 Pages·2017·1.69 MB·English

Veritas NetBackup™
Appliance Security Guide
Release 3.1
Veritas NetBackup™ Appliance Security Guide
Documentversion:3.1
Legal Notice
Copyright©2017VeritasTechnologiesLLC.Allrightsreserved.
Veritas,theVeritasLogo,NetBackup,StorageFoundation,andCopilotaretrademarksor
registeredtrademarksofVeritasTechnologiesLLCoritsaffiliatesintheU.S.andother
countries.Othernamesmaybetrademarksoftheirrespectiveowners.
ThisproductmaycontainthirdpartysoftwareforwhichVeritasisrequiredtoprovideattribution
tothethirdparty(“ThirdPartyPrograms”).SomeoftheThirdPartyProgramsareavailable
underopensourceorfreesoftwarelicenses.TheLicenseAgreementaccompanyingthe
Softwaredoesnotalteranyrightsorobligationsyoumayhaveunderthoseopensourceor
freesoftwarelicenses.Refertothethirdpartylegalnoticesdocumentaccompanyingthis
Veritasproductoravailableat:
https://www.veritas.com/about/legal/license-agreements
Theproductdescribedinthisdocumentisdistributedunderlicensesrestrictingitsuse,copying,
distribution,anddecompilation/reverseengineering.Nopartofthisdocumentmaybe
reproducedinanyformbyanymeanswithoutpriorwrittenauthorizationofVeritasTechnologies
LLCanditslicensors,ifany.
THEDOCUMENTATIONISPROVIDED"ASIS"ANDALLEXPRESSORIMPLIED
CONDITIONS,REPRESENTATIONSANDWARRANTIES,INCLUDINGANYIMPLIED
WARRANTYOFMERCHANTABILITY,FITNESSFORAPARTICULARPURPOSEOR
NON-INFRINGEMENT,AREDISCLAIMED,EXCEPTTOTHEEXTENTTHATSUCH
DISCLAIMERSAREHELDTOBELEGALLYINVALID.VERITASTECHNOLOGIESLLC
SHALLNOTBELIABLEFORINCIDENTALORCONSEQUENTIALDAMAGESIN
CONNECTIONWITHTHEFURNISHING,PERFORMANCE,ORUSEOFTHIS
DOCUMENTATION.THEINFORMATIONCONTAINEDINTHISDOCUMENTATIONIS
SUBJECTTOCHANGEWITHOUTNOTICE.
TheLicensedSoftwareandDocumentationaredeemedtobecommercialcomputersoftware
asdefinedinFAR12.212andsubjecttorestrictedrightsasdefinedinFARSection52.227-19
"CommercialComputerSoftware-RestrictedRights"andDFARS227.7202,etseq.
"CommercialComputerSoftwareandCommercialComputerSoftwareDocumentation,"as
applicable,andanysuccessorregulations,whetherdeliveredbyVeritasasonpremisesor
hostedservices.Anyuse,modification,reproductionrelease,performance,displayordisclosure
oftheLicensedSoftwareandDocumentationbytheU.S.Governmentshallbesolelyin
accordancewiththetermsofthisAgreement.
VeritasTechnologiesLLC
500EMiddlefieldRoad
MountainView,CA94043
http://www.veritas.com
.
Technical Support
TechnicalSupportmaintainssupportcentersglobally.Allsupportserviceswillbedelivered
inaccordancewithyoursupportagreementandthethen-currententerprisetechnicalsupport
policies.ForinformationaboutoursupportofferingsandhowtocontactTechnicalSupport,
visitourwebsite:
https://www.veritas.com/support
YoucanmanageyourVeritasaccountinformationatthefollowingURL:
https://my.veritas.com
Ifyouhavequestionsregardinganexistingsupportagreement,pleaseemailthesupport
agreementadministrationteamforyourregionasfollows:
Worldwide(exceptJapan) [email protected]
Japan [email protected]
Documentation
Makesurethatyouhavethecurrentversionofthedocumentation.Eachdocumentdisplays
thedateofthelastupdateonpage2.ThelatestdocumentationisavailableontheVeritas
website:
https://sort.veritas.com/documents
Documentation feedback
Yourfeedbackisimportanttous.Suggestimprovementsorreporterrorsoromissionstothe
documentation.Includethedocumenttitle,documentversion,chaptertitle,andsectiontitle
ofthetextonwhichyouarereporting.Sendfeedbackto:
[email protected]
YoucanalsoseedocumentationinformationoraskaquestionontheVeritascommunitysite:
http://www.veritas.com/community/
Veritas Services and Operations Readiness Tools (SORT)
VeritasServicesandOperationsReadinessTools(SORT)isawebsitethatprovidesinformation
andtoolstoautomateandsimplifycertaintime-consumingadministrativetasks.Depending
ontheproduct,SORThelpsyouprepareforinstallationsandupgrades,identifyrisksinyour
datacenters,andimproveoperationalefficiency.ToseewhatservicesandtoolsSORTprovides
foryourproduct,seethedatasheet:
https://sort.veritas.com/data/support/SORT_Data_Sheet.pdf
Contents
Chapter 1 About the NetBackup appliance Security Guide
............................................................................................. 7
AbouttheNetBackupapplianceSecurityGuide.................................... 7
Chapter 2 User authentication
........................................................... 15
AboutuserauthenticationontheNetBackupappliance........................ 15
UsertypesthatcanauthenticateontheNetBackupappliance
..................................................................................... 17
Aboutconfiguringuserauthentication............................................... 20
Generic user authentication guidelines ....................................... 23
AboutauthenticatingLDAPusers.................................................... 23
AboutauthenticatingActiveDirectoryusers....................................... 24
AboutauthenticatingKerberos-NISusers.......................................... 25
Abouttheapplianceloginbanner..................................................... 27
Aboutusernameandpasswordspecifications................................... 28
AboutSTIGcompliantpasswordpolicyrules................................ 32
Chapter 3 User authorization
............................................................. 34
AboutuserauthorizationontheNetBackupappliance.......................... 34
AboutauthorizingNetBackupapplianceusers.................................... 36
NetBackupapplianceuserroleprivileges.................................... 38
AbouttheAdministratoruserrole..................................................... 39
AbouttheNetBackupCLIuserrole................................................... 40
Chapter 4 Intrusion prevention and intrusion detection
systems
.......................................................................... 43
AboutSymantecDataCenterSecurityontheNetBackupappliance
........................................................................................... 44
AbouttheNetBackupapplianceintrusionpreventionsystem................. 46
AbouttheNetBackupapplianceintrusiondetectionsystem................... 47
ReviewingSDCSeventsontheNetBackupappliance..........................48
RunningSDCSinunmanagedmodeontheNetBackupappliance
........................................................................................... 51
Contents 5
RunningSDCSinmanagedmodeontheNetBackupappliance............. 51
OverridingtheNetBackupapplianceintrusionpreventionsystempolicy
........................................................................................... 52
Re-enablingtheNetBackupapplianceintrusionpreventionsystem
policy................................................................................... 55
Chapter 5 Log files
................................................................................ 58
AboutNetBackupappliancelogfiles.................................................58
ViewinglogfilesusingtheSupportcommand..................................... 60
WheretofindNetBackupappliancelogfilesusingtheBrowse
command ............................................................................. 61
GatheringdevicelogswiththeDataCollectcommand.......................... 62
LogForwardingfeatureoverview..................................................... 64
Chapter 6 Operating system security
.............................................. 67
AboutNetBackupapplianceoperatingsystemsecurity......................... 67
MajorcomponentsoftheNetBackupapplianceOS............................. 69
DisabledserviceaccountsontheNetBackupappliance....................... 69
VulnerabilityscanningoftheNetBackupappliance.............................. 70
Chapter 7 Data security
....................................................................... 71
Aboutdatasecurity....................................................................... 71
Aboutdataintegrity....................................................................... 72
Aboutdataclassification................................................................ 73
Aboutdataencryption ...................................................................73
KMS support ........................................................................ 74
Chapter 8 Web security
....................................................................... 76
AboutSSLcertification.................................................................. 76
Chapter 9 Network security
................................................................ 78
AboutIPsecChannelConfiguration.................................................. 78
AboutNetBackupapplianceports.................................................... 80
Chapter 10 Call Home security
............................................................ 83
About AutoSupport ...................................................................... 83
AboutCallHome.......................................................................... 84
ConfiguringCallHomefromtheNetBackupApplianceShellMenu
..................................................................................... 86
Contents 6
EnablinganddisablingCallHomefromtheNetBackupAppliance
ShellMenu......................................................................86
ConfiguringaCallHomeproxyserverfromtheNetBackup
ApplianceShellMenu........................................................87
UnderstandingtheCallHomeworkflow....................................... 88
About SNMP ............................................................................... 89
AbouttheManagementInformationBase(MIB)............................ 89
Chapter 11 IPMI security
....................................................................... 90
IntroductiontoIPMIconfiguration..................................................... 90
RecommendedIPMIsettings.......................................................... 90
ReplacingthedefaultIPMISSLcertificate......................................... 92
Chapter 12 STIG compliance
............................................................... 97
OSSTIGhardeningforNetBackupappliances................................... 97
UnenforcedSTIGhardeningrules.................................................. 103
Appendix A Security release content
................................................ 107
NetBackupAppliancesecurityreleasecontent.................................. 107
Index
.................................................................................................................. 115
1
Chapter
About the NetBackup
appliance Security Guide
Thischapterincludesthefollowingtopics:
■ AbouttheNetBackupapplianceSecurityGuide
About the NetBackup appliance Security Guide
NetBackupappliancesaredevelopedfromtheirinceptionwithsecurityasaprimary
need.Eachelementoftheappliance,includingitsLinuxoperatingsystemandthe
coreNetBackupapplication,istestedforvulnerabilitiesusingbothindustrystandards
andadvancedsecurityproducts.Thesemeasuresensurethatexposureto
unauthorizedaccessandresultingdatalossortheftisminimized.
EachnewversionofNetBackupappliancesoftwareandhardwareisverifiedfor
vulnerabilitiesbeforerelease.Dependingontheseverityofissuesfound,Veritas
releasesapatchorprovidesafixinascheduledmajorrelease.Toreducetherisk
ofunknownthreats,Veritasregularlyupdatesthethird-partypackagesandmodules
intheproductaspartofregularmaintenancereleasecycles.
ThegoalofthisguideistodescribethesecurityfeaturesimplementedinNetBackup
appliance3.1andincludesthefollowingchaptersandsub-sections:
NetBackup appliance user authentication
ThischaptertalksabouttheauthenticationfeaturesoftheNetBackupappliance
andincludesthefollowingsections:
AbouttheNetBackupapplianceSecurityGuide 8
AbouttheNetBackupapplianceSecurityGuide
Table1-1 Sectionsfeaturingauthentication
Sectionname Description Link
Aboutuser Thissectiondescribesthetypesofusers, See“Aboutuser
authenticationon useraccounts,andprocessesallowedto authenticationonthe
theNetBackup accesstheappliance. NetBackupappliance”
appliance onpage15.
Aboutconfiguring Thissectiondescribestheconfiguration See“Aboutconfiguring
userauthentication optionsforthevarioustypesofusersthat userauthentication”
canauthenticateontheappliance. onpage20.
Aboutauthenticating Thissectiondescribestheprerequisites See“About
LDAPusers andprocesstoconfiguretheapplianceto authenticatingLDAP
registerandauthenticateLDAPusers. users”onpage23.
Aboutauthenticating Thissectiondescribestheprerequisites See“About
ActiveDirectory andprocesstoconfiguretheapplianceto authenticatingActive
users registerandauthenticateActiveDirectory Directoryusers”
(AD)users. onpage24.
Aboutauthenticating Thissectiondescribestheprerequisites See“About
Kerberos-NISusers andprocesstoconfiguretheapplianceto authenticating
registerandauthenticateKerberos-NIS Kerberos-NISusers”
users. onpage25.
Abouttheappliance Thissectiondescribestheloginbanner See“Abouttheappliance
loginbanner featurewhereyoucansetatextbannerto loginbanner”
appearwhenausertriestoauthenticate onpage27.
ontheappliance.
Aboutusername Thissectiondescribestheusernameand See“Aboutusername
andpassword passwordcredentials. andpassword
specifications specifications”
onpage28.
NetBackup Appliance user authorization
Thischapterdescribesthefeaturesthatareimplementedforauthorizingusers
accessingtheNetBackupapplianceandincludesthefollowingsections:
AbouttheNetBackupapplianceSecurityGuide 9
AbouttheNetBackupapplianceSecurityGuide
Table1-2 Sectionsonauthorization
Sectionname Description Link
Aboutuser Thissectiondescribesthekey See“Aboutuser
authorizationonthe characteristicsoftheauthorizationprocess authorizationonthe
NetBackup oftheNetBackupappliance. NetBackupappliance”
appliance onpage34.
Aboutauthorizing Thissectiondescribestheadministrative See“Aboutauthorizing
NetBackup optionsforauthorizingapplianceuserswith NetBackupappliance
applianceusers variousaccesspermissions. users”onpage36.
Aboutthe ThissectiondescribestheAdministrator See“Aboutthe
Administratoruser userrole. Administratoruserrole”
role onpage39.
Aboutthe ThissectiondescribestheNetBackupCLI See“Aboutthe
NetBackupCLIuser userrole. NetBackupCLIuserrole”
role onpage40.
NetBackup Appliance intrusion prevention and intrusion
detection systems
ThischapterdescribestheSymantecDataCenterSecurity:ServerAdvanced
(SDCS)implementationfortheNetBackupapplianceusingthefollowingsections:
Table1-3 SectionsonIPSandIDSpolicies
Sectionname Description Link
AboutSymantec ThissectionintroducestheSDCSfeature See“AboutSymantec
DataCenter implementedwiththeappliances. DataCenterSecurityon
Securityonthe theNetBackup
NetBackup appliance”onpage44.
appliance
Aboutthe ThissectiondescribestheIPSpolicythat See“Aboutthe
NetBackup isusedtoprotecttheappliances. NetBackupappliance
applianceintrusion intrusionprevention
preventionsystem system”onpage46.
Aboutthe ThissectiondescribestheIDSpolicythat See“Aboutthe
NetBackup isusedtomonitortheappliances. NetBackupappliance
applianceintrusion intrusiondetection
detectionsystem system”onpage47.
AbouttheNetBackupapplianceSecurityGuide 10
AbouttheNetBackupapplianceSecurityGuide
Table1-3 SectionsonIPSandIDSpolicies(continued)
Sectionname Description Link
ReviewingSDCS ThissectiondescribestheSDCSevents See“ReviewingSDCS
eventsonthe basedontheirlevelofsecurity. eventsontheNetBackup
NetBackup appliance”onpage48.
appliance
RunningSDCSin Thissectionbrieflydescribesthedefault See“RunningSDCSin
unmanagedmode securitymanagementontheappliance. unmanagedmodeonthe
ontheNetBackup NetBackupappliance”
appliance onpage51.
RunningSDCSin Thissectiondescribeshowyoucan See“RunningSDCSin
managedmodeon manageappliancesecurityaspartofa managedmodeonthe
theNetBackup centralizedSDCSenvironment. NetBackupappliance”
appliance onpage51.
Overridingthe Thissectiondescribestheprocedureto See“Overridingthe
NetBackup overridetheIPSpolicythatisappliedtothe NetBackupappliance
applianceintrusion appliances. intrusionprevention
preventionsystem systempolicy”
policy onpage52.
Re-enablingthe Thissectiondescribestheprocedureto See“Re-enablingthe
NetBackup re-enabletheIPSpolicythatisappliedto NetBackupappliance
applianceintrusion theappliances. intrusionprevention
preventionsystem systempolicy”
policy onpage55.
NetBackup Appliance log files
ThischapterliststheNetBackupappliancelogfilesandtheoptionstoviewthelog
files,usingthefollowingsections:
Table1-4 Workinglogsections
Sectionname Description Link
Aboutworkingwith Thischapterprovidesanoverviewonall See“AboutNetBackup
logfiles thedifferenttypesoflogsthatyoucanview appliancelogfiles”
fortheNetBackupappliance. onpage58.
Viewinglogfiles Thischapterdescribestheprocedureto See“Viewinglogfiles
usingtheSupport viewlogfilesusingthesupportcommand. usingtheSupport
command command”onpage60.