Restoring disaster recovery package on UNIX
After a disaster, you need to restore disaster recovery package corresponding to the catalog backup that you want to restore. Disaster recovery package gets the primary server host identity back. You need to restore the host identity before you perform catalog recovery.
In a clustered primary server setup:
The disaster recovery package contains the identity files and configuration only for the virtual name.
After the DR installation, the virtual name's certificate is restored.
Cluster node-specific certificates and configuration options are not backed up and therefore are not recovered. You need to redeploy or reconfigure NetBackup or external certificates after the DR installation.
If external CA-signed certificates are used in your NetBackup domain, ensure the following:
In case of file-based external certificates, ensure that the certificate file path is configured, accessible, and is the same as the one that was backed up.
If you used Windows certificate store as a certificate store before the disaster and the certificate files were not backed up during catalog backup, you need to manually configure the external certificate for the host after the disaster. Refer to the following article:
You have configured the required certificate revocation lists (CRL) before you begin the disaster recovery installation, if applicable.
For more information on the CRLs, refer to the NetBackup Security and Encryption Guide.
If an external certificate was configured on the primary server before the disaster and DR installation fails, you can set the environment variable called DR_PKG_MARKER_FILE to enable you to correct the external certificate configuration towards the end of the DR installation.
To restore the disaster recovery package during NetBackup installation
- Start the NetBackup software installation.
Refer to the Installing server software on UNIX systems section from the NetBackup Installation Guide.
- When the following message appears, press Enter to continue:
Is this host a master server? [y/n] (y)
- When the following message appears, select Y.
Are you currently performing a disaster recovery of a master server? [y/n] (y)
- When the following message appears, provide the name and the path of the disaster recovery package that you want to restore.
Enter the name of your disaster recovery package along with the path, or type q to exit the install script:
If external certificates are used in your domain, a warning message is displayed. When the installer waits during subsequent steps, configure the external certificate configuration options as per step 6.
- When the following message appears, provide the passphrase that is associated with the disaster recovery package that you want to restore.
Caution:
Ensure that you specify the appropriate passphrase.
If you specify a wrong passphrase or the passphrase is lost, you need to deploy security certificates on all hosts after installation. The disaster recovery package cannot be restored during installation. To restore the disaster recovery package after installation, refer to the following article:
Enter your disaster recovery passphrase, or enter q to exit installation:
The following message appears:
Validating disaster recovery passphrase...
If the passphrase is validated, continue with the installation.
- If external CA-signed certificates are used in your NetBackup domain, do the following:
Review the value of the ECA_CRL_CHECK configuration option.
For more information on catalog backup and external certificate configuration options, refer to the NetBackup Administrator's Guide, Volume I.
If the ECA_CRL_CHECK configuration option is set to DISABLE, you do not need to do the CRL configurations.
If the ECA_CRL_CHECK configuration option is enabled, you are prompted to configure the CRL.
The UNIX installer does not wait for any action but proceeds to the next step in the installer. When the installer waits after the following step, you can configure the CRLs and continue with the DR installation.
Configure the CRLs and continue with the DR installation.
Depending on the value that is specified for the ECA_CRL_PATH option, make the required CRLs available.
If ECA_CRL_PATH is not specified, NetBackup uses the CRLs from CRL distribution point (CDP) of the peer host's certificate. Ensure that the URLs that are available in the CDP are accessible.
If ECA_CRL_PATH is specified, NetBackup uses the CRLs that are available in the directory specified for this option. Copy the valid CRLs in the directory that you specify for ECA_CRL_PATH.
In case the DR_PKG_MARKER_FILE environment variable was set before the DR installation, the installer displays a message, which conveys that the touch file exists. Once the external certificate configuration is done, delete the touch file that you have set for the DR_PKG_MARKER_FILE environment variable.
NetBackup services are started.
- If the key management service (KMS) was configured on the primary server before the disaster, run the following command to start the KMS service:
/usr/openv/netbackup/bin/nbkmscmd -discoverNBKMS
- Refer to the Installing server software on UNIX systems section from the NetBackup Installation Guide.
To restore the disaster recovery package after NetBackup installation
- Run the nbhostidentity -import -infile file_path command after NetBackup installation.
Refer to the NetBackup Commands Reference Guide.
- Clean up the allowed list cache and restart the NetBackup services on all hosts in the domain.
- Refresh the certificate revocation list (CRL) using the following command:
nbcertcmd -getcrl
- If the key management service (KMS) was configured on the primary server before the disaster, run the following command to start the KMS service:
/usr/openv/netbackup/bin/nbkmscmd -discoverNBKMS
- Carry out the given step to remove the NetBackup certificate files in the following scenario:
NetBackup was configured to use only external CA-signed certificates before the disaster and it was configured to use NetBackup certificates or both NetBackup and external certificates before you manually imported the disaster recovery package.
Remove the NetBackup certificate files using the following command:
configureWebServerCerts -removeNBCert