Enable the FIPS mode on a NetBackup host
This section provides steps to enable the FIPS mode on a master server, a media server, or a client in a NetBackup domain. You should do the following configurations on each host to enable FIPS.
To enable the FIPS mode on a NetBackup host
- Enable the NB_FIPS_MODE flag in the NetBackup configuration file.
- Restart the NetBackup services.
To verify if a certain daemon or a command runs in the FIPS mode, check the respective logs. The log lines are available only for the daemons and commands that use cryptography.
Example 1: To verify if the nbcertcmd command runs in the FIPS mode
- Run the following command:
nbcertcmd -ping
Location of the command:
Windows: install_path\NetBackup\bin\nbcertcmd
UNIX: /usr/openv/netbackup/bin/nbcertcmd
- Check the nbcertcmd logs.
Location of the log directory:
Windows: install_path\NetBackup\logs\nbcert
UNIX: /usr/openv/netbackup/logs/nbcert
The following log lines should be present:
<2> nbcertcmd: ./nbcertcmd -ping ProcessContext: ProcessName:[nbcertcmd], FipsMode:[ENABLED], Username:[root], IsServiceAdmin:[0], UserID:[0], GroupID:[0]
Example 2: To verify if the NetBackup Web Management Console runs in the FIPS mode
- By default, the the FIPS mode is disabled when the NetBackup Web Management Console (nbwmc) service runs. The FIPS mode is enabled for the nbwmc service after you enable it for the NetBackup host.
Check the catalina log file on the NetBackup master server host to verify if the nbwmc service runs in the FIPS mode.
Location of the log file:
Windows: install_path\NetBackup\wmc\webserver\logs\catalina-date.log
UNIX: /usr/openv/wmc/webserver/logs/catalina-date.log
The following log lines should be present:
The nbwmc service is running in FIPS approved mode