Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  3. NetBackup™ Security and Encryption Guide
  5. Section I. Identity and access management
  7. NetBackup Access Control Security (NBAC)
  9. About using NetBackup Access Control (NBAC)
NetBackup™ Security and Encryption Guide

About using NetBackup Access Control (NBAC)

NetBackup Access Control (NBAC) is the legacy access control method for NetBackup and is no longer being updated. It is recommended that you use role-based access control (RBAC) with the web UI.

The NetBackup Access Control (NBAC) is the role-based access control that is used for primary servers, media servers, and clients. NBAC can be used in situations where you want to:

  • Use a set of permissions for different levels of administrators for an application. A backup application can have operators (perhaps load and unload tapes). It can have local administrators (manage the application within one facility). It can also have overall administrators who may have responsibility for multiple sites and determine backup policy. Note that this feature is very useful in preventing user errors. If junior level administrators are restricted from certain operations, they are prevented from making inadvertent mistakes.

  • Separate administrators so that root permission to the system is not required to administer the system. You can then separate the administrators for the systems themselves from the ones who administer the applications.

The following table lists the NBAC considerations.

Table: NBAC considerations

Consideration or issue

Description or resolution

Prerequisites before you configure NBAC

This prerequisites list can help you before you start to configure NBAC. These items ensure an easier installation. The following list contains the information for this installation:

  • User name or password for primary server (root or administrator permission).

  • Name of primary server

  • Name of all media servers that are connected to the primary server

  • Name of all clients to be backed up

  • Host name or IP address

    Note:

    Host names should be resolvable to a valid IP address.

  • Use the ping or traceroute command as one of the tools to ensure that you can see the hosts. Using these commands ensures that you have not configured a firewall or other obstruction to block access.

Determine if the primary server, media server, or client is to be upgraded

Determine if the primary server, media server, or client is to be upgraded as follows:

  • Some features are provided by upgrading primary servers, some by media servers, and some from upgrading clients.

  • NetBackup works with a higher revision primary server and lower revision clients and media servers.

  • Feature content determines what is deployed.

  • Deployment can be step wise if required.

Information about roles

Determine the roles in the configuration as follows:

  • Who administers the hosts (root permission on primary server equals head administrator).

  • Determine roles to start and then add on the roles as required.

NBAC license requirements

No license is required to turn on the access controls.

NBAC and KMS permissions

Typically when using NBAC and when the Setupmaster command is run, the NetBackup related group permissions (for example, NBU_Admin and KMS_Admin) are created. The default root and administrator users are also added to those groups. In some cases the root and administrator users are not added to the KMS group when NetBackup is upgraded. The solution is to grant the root and the administrator users NBU_Admin and KMS_Admin permissions manually.

Windows Server Failover Clustering (WSFC) error messages while unhooking shared security services from PBX

In WSFC environments running the bpnbaz -UnhookSharedSecSvcsWithPBX <virtualhostname> command can trigger error messages. However the shared Authentication and Authorization services are successfully unhooked from PBX and the errors can be ignored.

Possible cluster node errors

In a clustered environment when the command bpnbaz -setupmaster is run in the context of local Administrator the AUTHENTICATION_DOMAIN entries may not contain the other cluster node entries. In such case these entries must be manually added from Host Properties into the bp.conf file.

Catalog recovery fails when NBAC is set to REQUIRED mode

If NBAC is running in REQUIRED mode and a catalog recovery was performed, NBAC needs to be reset back from PROHIBTED mode to REQUIRED mode.

Policy validation fails in NBAC mode (USE_VXSS = REQUIRED)

Back up, restore, and verification of policy for snapshot can fail in NBAC enabled mode if one of the following has been done.

  • Authenticated Principle is removed from the NBAC group: NBU_Users group

  • Back up and restore permissions of NBU_User group have been removed

The bpnbaz -setupmaster command fails with an error "Unable to contact Authorization Service"

If a user other than an Administrator tries to modify NetBackup security, the bpnbaz - setupmaster fails.

Only a user 'Administrator' who is a part of the Administrator's group has permissions to modify the NetBackup security and enable NBAC.

Failure of authentication broker configuration during installation.

Invalid domain name configuration of the system causes failure during configuration of authentication broker.

To correct this problem, use the bpnbaz -configureauth command to configure the authentication broker.

For information about the bpnbaz command, see the NetBackup Commands Reference Guide:

NetBackup GUI errors may occur if NBAC is enabled on a system that previously had Enhanced Auditing enabled.

When switching the NetBackup server from Enhanced Auditing to NBAC, make sure that all directories that are named after users are deleted in the following directory:

Windows: install_path\NetBackup\logs\user_ops

UNIX, Linux: /usr/openv/netbackup/logs/user_ops

The following topic contains more details:

See Troubleshooting NBAC issues.

Feedback

Was this page helpful?
Previous

NetBackup Access Control Security (NBAC)

Next

NetBackup access management administration

Feedback

Was this page helpful?