NetBackup Access Control (NBAC)
The NetBackup Access Control (NBAC) functionality incorporates the NetBackup Product Authentication and Authorization into NetBackup, increasing security for the primary servers, media servers, and clients.
See About NetBackup security and encryption.
Important points about NBAC include:
Authentication and Authorization are used together
NBAC uses authentication identities from a trusted source to reliably identify involved parties. Access decisions can then be made for manipulation of NetBackup based on those identities. Note that NetBackup Security Services are now embedded.
The NetBackup Product Authentication and Authorization consist of the root broker, authentication broker, authorization engine, and the graphical user interface.
Oracle, Oracle Archiver, DB2, Informix, Sybase, SQL Server, SAP and EV Migrator are not supported with NBAC.
NBAC is not supported on Appliances.
The NetBackup catalog backup is supported with NBAC.
The following table describes the NetBackup components that are used in security.
Table: NetBackup components used in security
Component | Description |
|---|---|
Root broker | The NetBackup primary server is the root broker in a datacenter installation. There is no provision to use another root broker. The recommendation is to allow trust between root brokers. The root broker authenticates the authentication broker. The root broker does not authenticate clients. |
Authentication broker |
Authenticates the primary server, media server, graphical user interface, and clients by establishing credentials with each one of them. The authentication broker also authenticates a user when operating a command prompt. There can be more than one authentication broker in a datacenter installation. The authentication broker can be combined with the root broker. |
Authorization engine |
Communicates with the primary server and the media server to determine the permissions of an authenticated user. These permissions determine the functionality available to a given server. The authorization engine also stores user groups and permissions. Only one authorization engine is required in a datacenter installation. The authorization engine also communicates over the WAN to authorize other media servers in a multi-datacenter environment. |
graphical user interface |
Specifies a Remote Administration Console that receives credentials from the authentication brokers. The graphical user interface then may use the credentials to gain access to functionality on the clients, media, and primary servers. |
Master server |
Communicates with the root broker and authentication broker, graphical user interface, authorization engine, media server, and clients. |
NetBackup administrator |
Specifies a user who has been granted administrator permissions to access and manage the NetBackup functionality from within the data center. |
Media server | Communicates with the primary server, root broker and authentication broker, authorization engine, and clients 1 through 6. The media server writes unencrypted data to tape for client 5 and encrypted data to tape for client 6. |
Clients |
Specifies that clients 1 through 4 are standard NetBackup types. Client 5 is a web server type located in the DMZ. Client 6 is a client side encrypted type also located in the DMZ. All client types are managed by the primary server and have their data backed up to tape through the media server. Clients 5 and 6 communicate to NetBackup using NetBackup only ports through the internal firewall. Client 5 also receives connections from the Internet using HTTP only ports through the external firewall. |
Tapes | Specifies that the tape security in NetBackup can be increased by adding the following:
Unencrypted and encrypted data tapes are produced in the datacenter. The unencrypted tape data is written for clients 1 through 5 and stored on-site at the datacenter. The encrypted tapes are written for client 6 and are transported off-site to a vault for disaster recovery protection. |
Encryption |
Specifies that NetBackup encryption can increase security by providing the following:
For more information about encryption: |
Data over the wire security |
Includes the communication between primary servers, media servers, clients, and communication using ports through firewalls and over WANs. For more information about ports, see the NetBackup Network Ports Reference Guide: The data over the wire part of NetBackup can help increase security in the following ways:
Note: Communication between NetBackup 8.1 and later hosts is secure. |
Firewall security |
Specifies that the NetBackup firewall support can help increase security. Important points about firewall security include the following:
|
Demilitarized zone (DMZ) | Specifies that the demilitarized zone (DMZ) increases security as follows:
The DMZ provides a "safe" area of operation for the web server client 5 and encrypted client 6 between the internal firewall and external firewall. The web server client 5 in the DMZ can communicate to NetBackup through the internal firewall using designated NetBackup ports. The web server client 5 can also communicate through the external firewall to the Internet using only HTTP ports. Figure: Example firewalls and DMZ shows an example internal and external firewall with DMZ. |
The following figure shows an example of the internal and the external firewall with DMZ.