Enable FIPS mode on a NetBackup host after installation
This section provides steps to enable FIPS mode on a primary server, a media server, or a client in a NetBackup domain. You should do the following configurations on each host to enable FIPS.
If the host is a primary server, enable FIPS mode for the NetBackup Authentication Broker (AT) by updating the VRTSatlocal.conf configuration file on the primary server.
See Enable FIPS mode for the NetBackup Authentication Broker service.
To enable FIPS mode on a NetBackup host
- Enable the NB_FIPS_MODE flag in the NetBackup configuration file.
- Restart the NetBackup services.
To verify if a certain daemon or a command runs in FIPS mode, check the respective logs. The log lines are available only for the daemons and commands that use cryptography.
Example 1: To verify if the nbcertcmd command runs in FIPS mode
- Run the following command:
nbcertcmd -ping
Location of the command:
Windows: install_path\NetBackup\bin\nbcertcmd
UNIX: /usr/openv/netbackup/bin/nbcertcmd
- Check the nbcertcmd logs.
Location of the log directory:
Windows: install_path\NetBackup\logs\nbcert
UNIX: /usr/openv/netbackup/logs/nbcert
The following log lines should be present:
<2> nbcertcmd: ./nbcertcmd -ping ProcessContext: ProcessName:[nbcertcmd], FipsMode:[ENABLED], Username:[root], IsServiceAdmin:[0], UserID:[0], GroupID:[0]
Example 2: To verify if the NetBackup Web Management Console runs in FIPS mode
- By default, FIPS mode is disabled when the NetBackup Web Management Console (nbwmc) service runs. FIPS mode is enabled for the nbwmc service after you enable it for the NetBackup host.
Check the catalina log file on the NetBackup primary server host to verify if the nbwmc service runs in FIPS mode.
Location of the log file:
Windows: install_path\NetBackup\wmc\webserver\logs\catalina-date.log
UNIX: /usr/openv/wmc/webserver/logs/catalina-date.log
The following log lines should be present:
The nbwmc service is running in FIPS approved mode