Configuring the multi-factor authentication on NetBackup WORM storage server instance
On Flex appliance, you can log in to the NetBackup WORM storage server instance through SSH. You can configure multi-factor authentication (MFA) on NetBackup WORM storage server instance.
You can perform the following tasks to configure multi-factor authentication:
Enroll the multi-factor authentication.
After you enroll multi-factor authentication, user is required to provide six-digit token additionally to username and password to be able to log in. The authentication application generates the token on the mobile phone every 30 seconds.
Enforce the multi-factor authentication.
By default, multi-factor authentication is optional for the users. However, msdpadm user can enforce it for all SSH login users in the application instance.
Reset the multi-factor authentication.
If the user's mobile phone is lost or factory-reset, the user is no longer able to log in with a token. The msdpadm user can help the user to reset and re-enroll the multi-factor authentication.
If msdpadm user is locked, he cannot reset multi-factor authentication for himself. To avoid this situation, we recommend that two or multiple users scan the same QR code of msdpadm user with their mobile phones. If one user loses access to the MFA token, another can help him to enroll MFA again.
To configure the multi-factor authentication for SSH login
- Open deduplication shell.
- Run the following command to enroll the multi-factor authentication for SSH login:
setting MFA enroll
The command generates secret key randomly and displays it as the QR code.
- Scan the QR code using an authentication application on your mobile phone. For example, Google Authenticator or Microsoft Authenticator.
- If you want to manage multiple applications using the same secret key, you can get the secret key string from one MFA-enrolled application. Use the same key to configure multi-factor authentication on another instance.
To show the secret key and QR code, run the following command:
setting MFA show
To enroll MFA using a specific secret key, run the following command:
setting MFA enroll secret=<secret>
Note:
The token validation is based on the server time. Ensure that the clock of the Flex Appliance and the mobile phone are correct.
- Run the following command to enforce multi-factor authentication for all SSH login users in the application instance. You must be msdpadm user to perform this task.
setting MFA setenforce enforce=1 [grace_period=<days>
For example,
setting MFA setenforce enforce=1 grace_period=90
setenforce: Sets the multi-factor authentication enforcement.
The value "1" enforces the multi-factor authentication. The value "0" disables the multi-factor authentication enforcement.
grace_period: The grace period in days for SSH login without multi-factor authentication. After specified grace period is over, SSH login is denied if the user still does not enroll multi-factor authentication.
- To reset the multi-factor authentication for the user, run the following command. You must be msdpadm user to perform this task.
setting MFA reset user=<user name>