Veritas NetBackup™ Appliance Security Guide

105 Pages·2017·1.52 MB·English

Veritas NetBackup™
Appliance Security Guide
Release 3.0
Veritas NetBackup Appliance Security Guide
Lastupdated:2019-12-16
Legal Notice
Copyright©2019VeritasTechnologiesLLC.Allrightsreserved.
Veritas,theVeritasLogo,andNetBackuparetrademarksorregisteredtrademarksofVeritas
TechnologiesLLCoritsaffiliatesintheU.S.andothercountries.Othernamesmaybe
trademarksoftheirrespectiveowners.
Thisproductmaycontainthird-partysoftwareforwhichVeritasisrequiredtoprovideattribution
tothethirdparty(“Third-partyPrograms”).SomeoftheThird-partyProgramsareavailable
underopensourceorfreesoftwarelicenses.TheLicenseAgreementaccompanyingthe
Softwaredoesnotalteranyrightsorobligationsyoumayhaveunderthoseopensourceor
freesoftwarelicenses.RefertotheThird-partyLegalNoticesdocumentaccompanyingthis
Veritasproductoravailableat:
https://www.veritas.com/about/legal/license-agreements
Theproductdescribedinthisdocumentisdistributedunderlicensesrestrictingitsuse,copying,
distribution,anddecompilation/reverseengineering.Nopartofthisdocumentmaybe
reproducedinanyformbyanymeanswithoutpriorwrittenauthorizationofVeritasTechnologies
LLCanditslicensors,ifany.
THEDOCUMENTATIONISPROVIDED"ASIS"ANDALLEXPRESSORIMPLIED
CONDITIONS,REPRESENTATIONSANDWARRANTIES,INCLUDINGANYIMPLIED
WARRANTYOFMERCHANTABILITY,FITNESSFORAPARTICULARPURPOSEOR
NON-INFRINGEMENT,AREDISCLAIMED,EXCEPTTOTHEEXTENTTHATSUCH
DISCLAIMERSAREHELDTOBELEGALLYINVALID.VERITASTECHNOLOGIESLLC
SHALLNOTBELIABLEFORINCIDENTALORCONSEQUENTIALDAMAGESIN
CONNECTIONWITHTHEFURNISHING,PERFORMANCE,ORUSEOFTHIS
DOCUMENTATION.THEINFORMATIONCONTAINEDINTHISDOCUMENTATIONIS
SUBJECTTOCHANGEWITHOUTNOTICE.
TheLicensedSoftwareandDocumentationaredeemedtobecommercialcomputersoftware
asdefinedinFAR12.212andsubjecttorestrictedrightsasdefinedinFARSection52.227-19
"CommercialComputerSoftware-RestrictedRights"andDFARS227.7202,etseq.
"CommercialComputerSoftwareandCommercialComputerSoftwareDocumentation,"as
applicable,andanysuccessorregulations,whetherdeliveredbyVeritasasonpremisesor
hostedservices.Anyuse,modification,reproductionrelease,performance,displayordisclosure
oftheLicensedSoftwareandDocumentationbytheU.S.Governmentshallbesolelyin
accordancewiththetermsofthisAgreement.
VeritasTechnologiesLLC
2625AugustineDrive
SantaClara,CA95054
http://www.veritas.com
Technical Support
TechnicalSupportmaintainssupportcentersglobally.Allsupportserviceswillbedelivered
inaccordancewithyoursupportagreementandthethen-currententerprisetechnicalsupport
policies.ForinformationaboutoursupportofferingsandhowtocontactTechnicalSupport,
visitourwebsite:
https://www.veritas.com/support
YoucanmanageyourVeritasaccountinformationatthefollowingURL:
https://my.veritas.com
Ifyouhavequestionsregardinganexistingsupportagreement,pleaseemailthesupport
agreementadministrationteamforyourregionasfollows:
Worldwide(exceptJapan) [email protected]
Japan [email protected]
Documentation
Makesurethatyouhavethecurrentversionofthedocumentation.Eachdocumentdisplays
thedateofthelastupdateonpage2.ThelatestdocumentationisavailableontheVeritas
website:
https://www.veritas.com/content/support/en_US/dpp.Appliances.html
Documentation feedback
Yourfeedbackisimportanttous.Suggestimprovementsorreporterrorsoromissionstothe
documentation.Includethedocumenttitle,documentversion,chaptertitle,andsectiontitle
ofthetextonwhichyouarereporting.Sendfeedbackto:
[email protected]
YoucanalsoseedocumentationinformationoraskaquestionontheVeritascommunitysite:
http://www.veritas.com/community/
Veritas Services and Operations Readiness Tools (SORT)
VeritasServicesandOperationsReadinessTools(SORT)isawebsitethatprovidesinformation
andtoolstoautomateandsimplifycertaintime-consumingadministrativetasks.Depending
ontheproduct,SORThelpsyouprepareforinstallationsandupgrades,identifyrisksinyour
datacenters,andimproveoperationalefficiency.ToseewhatservicesandtoolsSORTprovides
foryourproduct,seethedatasheet:
https://sort.veritas.com/data/support/SORT_Data_Sheet.pdf
Contents
Chapter 1 About the NetBackup Appliance Security Guide
............................................................................................. 7
AbouttheNetBackupApplianceSecurityGuide................................... 7
Chapter 2 User authentication
........................................................... 15
AboutuserauthenticationontheNetBackupappliance........................ 15
UsertypesthatcanauthenticateontheNetBackupappliance
..................................................................................... 16
Aboutconfiguringuserauthentication............................................... 19
Generic user authentication guidelines ....................................... 23
AboutauthenticatingLDAPusers.................................................... 23
AboutauthenticatingActiveDirectoryusers....................................... 24
AboutauthenticatingKerberos-NISusers.......................................... 25
Abouttheapplianceloginbanner..................................................... 27
Aboutusernameandpasswordspecifications................................... 28
Chapter 3 User authorization
............................................................. 32
AboutuserauthorizationontheNetBackupAppliance......................... 32
AboutauthorizingNetBackupapplianceusers.................................... 33
NetBackupApplianceuserroleprivileges.................................... 35
AbouttheAdministratoruserrole..................................................... 36
AbouttheNetBackupCLIuserrole................................................... 37
Chapter 4 Intrusion prevention and intrusion detection
systems
.......................................................................... 40
AboutSymantecDataCenterSecurityontheNetBackupAppliance
........................................................................................... 41
AbouttheNetBackupApplianceintrusionpreventionsystem................. 43
AbouttheNetBackupApplianceintrusiondetectionsystem................... 44
ReviewingSDCSeventsontheNetBackupappliance..........................45
RunningSDCSinunmanagedmodeontheNetBackupappliance
........................................................................................... 47
RunningSDCSinmanagedmodeontheNetBackupappliance............. 47
Contents 5
Chapter 5 Log files
................................................................................ 49
AboutNetBackupAppliancelogfiles................................................ 49
AbouttheCollectLogfileswizard.................................................... 51
ViewinglogfilesusingtheSupportcommand..................................... 52
WheretofindNetBackupAppliancelogfilesusingtheBrowse
command ............................................................................. 53
GatheringdevicelogsonaNetBackupappliance................................ 54
LogForwardingfeatureoverview..................................................... 55
Chapter 6 Operating system security
.............................................. 58
AboutNetBackupapplianceoperatingsystemsecurity......................... 58
MajorcomponentsoftheNetBackupApplianceOS............................. 59
VulnerabilityscanningoftheNetBackupAppliance.............................. 60
Chapter 7 Data security
....................................................................... 61
Aboutdatasecurity....................................................................... 61
Aboutdataintegrity....................................................................... 62
Aboutdataclassification................................................................ 63
Aboutdataencryption ...................................................................63
KMS support ........................................................................ 64
Chapter 8 Web security
....................................................................... 66
AboutSSLusage......................................................................... 66
Implementingthird-partySSLcertificates........................................... 67
Chapter 9 Network security
................................................................ 70
AboutIPsecChannelConfiguration.................................................. 70
AboutNetBackupApplianceports.................................................... 72
Chapter 10 Call Home security
............................................................ 75
About AutoSupport ...................................................................... 75
Datasecuritystandards........................................................... 76
AboutCallHome.......................................................................... 76
ConfiguringCallHomefromtheNetBackupApplianceShellMenu
..................................................................................... 78
EnablinganddisablingCallHomefromtheapplianceshellmenu
..................................................................................... 79
ConfiguringaCallHomeproxyserverfromtheNetBackup
ApplianceShellMenu........................................................79
Contents 6
UnderstandingtheCallHomeworkflow....................................... 80
About SNMP ............................................................................... 81
AbouttheManagementInformationBase(MIB)............................ 81
Chapter 11 Remote Management Module (RMM) security
........................................................................................... 83
IntroductiontoIPMIconfiguration..................................................... 83
RecommendedIPMIsettings.......................................................... 83
RMMports.................................................................................. 85
EnablingSSHontheRemoteManagementModule............................ 86
ReplacingthedefaultIPMISSLcertificate......................................... 86
Chapter 12 STIG and FIPS conformance
......................................... 92
Appendix A Security release content
.................................................. 93
NetBackupAppliancesecurityreleasecontent................................... 93
Index
.................................................................................................................... 96
1
Chapter
About the NetBackup
Appliance Security Guide
Thischapterincludesthefollowingtopics:
■ AbouttheNetBackupApplianceSecurityGuide
About the NetBackup Appliance Security Guide
NetBackupappliancesaredevelopedfromtheirinceptionwithsecurityasaprimary
need.Eachelementoftheappliance,includingitsLinuxoperatingsystemandthe
coreNetBackupapplication,istestedforvulnerabilitiesusingbothindustrystandards
andadvancedsecurityproducts.Thesemeasuresensurethatexposureto
unauthorizedaccessandresultingdatalossortheftisminimized.
EachnewversionofNetBackupappliancesoftwareandhardwareisverifiedfor
vulnerabilitiesbeforerelease.Dependingontheseverityofissuesfound,Veritas
releasesapatchorprovidesafixinascheduledmajorrelease.Toreducetherisk
ofunknownthreats,Veritasregularlyupdatesthethird-partypackagesandmodules
intheproductaspartofregularmaintenancereleasecycles.
ThegoalofthisguideistodescribethesecurityfeaturesimplementedinNetBackup
Appliance3.0andincludesthefollowingchaptersandsub-sections:
NetBackup appliance user authentication
ThischaptertalksabouttheauthenticationfeaturesoftheNetBackupappliance
andincludesthefollowingsections:
AbouttheNetBackupApplianceSecurityGuide 8
AbouttheNetBackupApplianceSecurityGuide
Table1-1 Sectionsfeaturingauthentication
Sectionname Description Link
Aboutuser Thissectiondescribesthetypesofusers, See“Aboutuser
authenticationon useraccounts,andprocessesallowedto authenticationonthe
theNetBackup accesstheappliance. NetBackupappliance”
appliance onpage15.
Aboutconfiguring Thissectiondescribestheconfiguration See“Aboutconfiguring
userauthentication optionsforthevarioustypesofusersthat userauthentication”
canauthenticateontheappliance. onpage19.
Aboutauthenticating Thissectiondescribestheprerequisites See“About
LDAPusers andprocesstoconfiguretheapplianceto authenticatingLDAP
registerandauthenticateLDAPusers. users”onpage23.
Aboutauthenticating Thissectiondescribestheprerequisites See“About
ActiveDirectory andprocesstoconfiguretheapplianceto authenticatingActive
users registerandauthenticateActiveDirectory Directoryusers”
(AD)users. onpage24.
Aboutauthenticating Thissectiondescribestheprerequisites See“About
Kerberos-NISusers andprocesstoconfiguretheapplianceto authenticating
registerandauthenticateKerberos-NIS Kerberos-NISusers”
users. onpage25.
Abouttheappliance Thissectiondescribestheloginbanner See“Abouttheappliance
loginbanner featurewhereyoucansetatextbannerto loginbanner”
appearwhenausertriestoauthenticate onpage27.
ontheappliance.
Aboutusername Thissectiondescribestheusernameand See“Aboutusername
andpassword passwordcredentials. andpassword
specifications specifications”
onpage28.
NetBackup Appliance user authorization
Thischapterdescribesthefeaturesthatareimplementedforauthorizingusers
accessingtheNetBackupApplianceandincludesthefollowingsections:
AbouttheNetBackupApplianceSecurityGuide 9
AbouttheNetBackupApplianceSecurityGuide
Table1-2 Sectionsonauthorization
Sectionname Description Link
Aboutuser Thissectiondescribesthekey See“Aboutuser
authorizationonthe characteristicsoftheauthorizationprocess authorizationonthe
NetBackup oftheNetBackupAppliance. NetBackupAppliance”
appliance onpage32.
Aboutauthorizing Thissectiondescribestheadministrative See“Aboutauthorizing
NetBackup optionsforauthorizingapplianceuserswith NetBackupappliance
applianceusers variousaccesspermissions. users”onpage33.
Aboutthe ThissectiondescribestheAdministrator See“Aboutthe
Administratoruser userrole. Administratoruserrole”
role onpage36.
Aboutthe ThissectiondescribestheNetBackupCLI See“Aboutthe
NetBackupCLIuser userrole. NetBackupCLIuserrole”
role onpage37.
NetBackup Appliance intrusion prevention and intrusion
detection systems
ThischapterdescribestheSymantecDataCenterSecurity:ServerAdvanced
(SDCS)implementationfortheNetBackupApplianceusingthefollowingsections:
Table1-3 SectionsonIPSandIDSpolicies
Sectionname Description Link
AboutSymantec ThissectionintroducestheSDCSfeature See“AboutSymantec
DataCenter implementedwiththeappliances. DataCenterSecurityon
Securityonthe theNetBackup
NetBackup Appliance”onpage41.
appliance
Aboutthe ThissectiondescribestheIPSpolicythat See“Aboutthe
NetBackup isusedtoprotecttheappliances. NetBackupAppliance
applianceintrusion intrusionprevention
preventionsystem system”onpage43.
Aboutthe ThissectiondescribestheIDSpolicythat See“Aboutthe
NetBackup isusedtomonitortheappliances. NetBackupAppliance
applianceintrusion intrusiondetection
detectionsystem system”onpage44.
AbouttheNetBackupApplianceSecurityGuide 10
AbouttheNetBackupApplianceSecurityGuide
Table1-3 SectionsonIPSandIDSpolicies(continued)
Sectionname Description Link
ReviewingSDCS ThissectiondescribestheSDCSevents See“ReviewingSDCS
eventsonthe basedontheirlevelofsecurity. eventsontheNetBackup
NetBackup appliance”onpage45.
appliance
RunningSDCSin Thissectionbrieflydescribesthedefault See“RunningSDCSin
unmanagedmode securitymanagementontheappliance. unmanagedmodeonthe
ontheNetBackup NetBackupappliance”
appliance onpage47.
RunningSDCSin Thissectiondescribeshowyoucan See“RunningSDCSin
managedmodeon manageappliancesecurityaspartofa managedmodeonthe
theNetBackup centralizedSDCSenvironment. NetBackupappliance”
appliance onpage47.
Overridingthe Thissectiondescribestheprocedureto
NetBackup overridetheIPSpolicythatisappliedtothe
applianceintrusion appliances.
preventionsystem
policy
Re-enablingthe Thissectiondescribestheprocedureto
NetBackup re-enabletheIPSpolicythatisappliedto
applianceintrusion theappliances.
preventionsystem
policy
NetBackup Appliance log files
ThischapterliststheNetBackupAppliancelogfilesandtheoptionstoviewthelog
files,usingthefollowingsections:
Table1-4 Workinglogsections
Sectionname Description Link
Aboutworkingwith Thischapterprovidesanoverviewonall See“AboutNetBackup
logfiles thedifferenttypesoflogsthatyoucanview Appliancelogfiles”
fortheNetBackupAppliance. onpage49.
Aboutusingthe Thischapterdescribestheusageofthe See“AbouttheCollect
CollectLogfiles CollectLogfileswizardpresentonthe Logfileswizard”
wizard NetBackupApplianceWebConsole. onpage51.