Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Security and Encryption Guide
  3. Running NetBackup services with non-privileged user (service user) account
  4. Configuring a service user account
NetBackup™ Security and Encryption Guide

Configuring a service user account

The service user must be created in advance and must have nbwebgrp as the secondary group.

Configuring a service user account on UNIX

During installation or upgrade of the master server on UNIX, you can see a new prompt to specify a new user - preferably a non-root user - that can be used as a service user. Most daemons on the master server now run with the new service user.

To create the local user account on UNIX, run the following command:

useradd -c 'NetBackup Services account' -d /usr/openv/ service_user_name

To add the service user to the nbwebgrp secondary group, run the following command:

usermod -a -G nbwebgrp service_user_name

Review the following:

  • In a clustered environment, ensure that local accounts are defined consistently on all cluster nodes. If you use a clustered environment on Linux or UNIX platforms, the NetBackup service user can be a local user. The NetBackup service user must have the same name and UID on all nodes of the cluster.

  • It is recommended to use domain users (for example: NIS) in a clustered environment. LDAP accounts are supported and can be used on UNIX.

  • The NetBackup service account must use a POSIX compliant shell.

Configuring a service user account on Windows

On Windows, fresh installation uses the Local Service built-in account. There is no change in the upgrade process.

Feedback

Was this page helpful?
Previous

Important considerations for using a service user account

Next

Changing a service user account after installation or upgrade

Feedback

Was this page helpful?