Multi-person authorization for deduplication shell commands
On NetBackup web UI, the security administrator can configure multi-person authorization for critical MSDP operations. For more information about multi-person authorization, see the Configuring multi-person authorization chapter of the NetBackup Security and Encryption Guide.
If multi-person authorization is configured for an operation, an approval is required from the approver to perform that operation. When the MSDP administrator runs an operation command using the deduplication shell, a multi-person authorization ticket is created for the review. Only after the ticket is approved by an approver, the MSDP administrator is allowed to perform the operation.
For example, MSDP WORM configuration change requires multi-person authorization. When the MSDP administrator runs the setting WORM set-max command to change the maximum duration of the WORM retention lock, a ticket is created for the review.
[msdp shell] > setting WORM set-max worm_max=1900000 Multi-person authorization is enforced. This operation requires authorization from the primary server: primary.example.com. Create a ticket for approval (y/n)? y Ticket comment: enlarge the WORM lock duration. Ticket 7 is created. Please wait for an approval and run the command again. Operation failed
If the ticket is reviewed and approved by an approver, the MSDP administrator is allowed to run the command and perform the WORM configuration change.
[msdp shell] > setting WORM set-max worm_max=1900000 Multi-person authorization is enforced. This operation requires authorization from the primary server: primary.example.com. Ticket 7 for this operation is approved. Operation completed successfully
If the ticket is still pending for approval, and the MSDP administrator runs the command again, the deduplication shell asks the administrator to wait for an approval.
[msdp shell] > setting WORM set-max worm_max=1900000 Multi-person authorization is enforced. This operation requires authorization from the primary server: primary.example.com. The ticket 7 for this operation is still under review. Please wait for an approval and run the command again. Operation failed