What has changed for catalog recovery
In NetBackup 8.1 or later, the master server requires you to recover its host identity when you restore NetBackup after a disaster. The host identity includes certificate information, security settings, and other information.
With the earlier host identity in place, the master server can communicate with media server and clients in the new NetBackup instance. A disaster recovery package is created during each catalog backup that retains the master server host identity. As the disaster recovery package contains sensitive data such as security certificates and security settings, it is encrypted with a passphrase.
The following diagram shows the workflow for the catalog recovery.
Set a passphrase for the disaster recovery package and then configure a catalog backup policy. Catalog backups use the passphrase that is configured at the time of policy execution.
Note:
Starting with NetBackup 9.0, you can also set the passphrase constraints using the nbseccmd -setpassphraseconstraints command option.
For more information on the commands, see the NetBackup Commands Reference Guide.
If you do not set the passphrase constraints using the command, the default constraints are applicable: Minimum of 8 and a maximum of 1024 characters.
To set a passphrase, use the Security Management > Global Security Settings > Disaster Recovery tab in the NetBackup Administration Console.
If you change the passphrase at any time, the passphrase of the disaster recovery packages that were created earlier is not changed. It only changes the passphrase of the disaster recovery packages that are created subsequently.
To recover older catalogs, you must use the corresponding passphrase.
Caution:
You must set the passphrase before you configure the catalog backup policy. If the passphrase is not set, catalog backups fail. If the catalog backup policy is upgraded from a version earlier than 8.1, catalog backups continue to fail until the passphrase is set.
A disaster recovery package is created during each catalog backup.
To verify the passphrase after the catalog backup is successful, run the following command:
nbhostidentity -testpassphrase -infile dr_package_location
Disaster recovery packages are stored along with the disaster recovery files and emailed to the recipient that you have specified during policy configuration.
Disaster strikes.
After a disaster, install NetBackup on the master server in a disaster recovery mode. This process prompts you to specify the disaster recovery package path and passphrase.
If the appropriate passphrase is specified, the master server host identity is recovered. You must provide the passphrase that corresponds to the disaster recovery package that you want to recover.
If you lost the passphrase, you must deploy security certificates on all NetBackup hosts manually.
For more details, refer to the following article:
You should perform the catalog recovery immediately after you have recovered the host identity to avoid any information loss specific to certificate-related activities that may have taken place after the host identity restore. Use the appropriate disaster recovery (DR) file and recover the required catalog.
The passphrase is not recovered during the host identity (or disaster recovery package) restore or during catalog recovery. You must set it again in the new NetBackup instance.
Note:
If you need to restore the host identity after the normal NetBackup installation (when the disaster recovery mode is not selected), you can use the nbhostidentity command.
To restore the host identity of NetBackup Appliance, you must use the nbhostidentity command after the normal installation.