Selecting or changing the lockdown mode
The user can select the lockdown mode during initial configuration. After cluster configuration, user has the option to see/change the lockdown mode using both GUI and REST APIs. The lockdown modes can be switched only if the engines are healthy. The user can switch between the following modes without any restriction:
From normal to enterprise mode
From normal to compliance mode
From enterprise to compliance mode
The user can set minimum and maximum retention time for backup images for enterprise and compliance mode only. Creation of images with retention time less than the minimum retention time or greater than the maximum retention time is not allowed. This minimum and maximum retention time should be set by the appliance administrator as per the retention requirement of their use case.
Once the lockdown mode is set, only Appliance administrators can change the lockdown mode.
The lockdown modes are maintained during upgrade.
Only the Appliance administrator can remove the retention locks if the lockdown mode is enterprise.
Only the users with appliance administrator role can disable retention or remove the retention lock using the MSDP Restricted Shell.
The user cannot change the mode if any existing operation is in progress.
If the mode is set to compliance mode, the administrator cannot change the mode to enterprise or normal mode.
If lockdown mode is set to compliance or enterprise for any node, it is not available for factory reset.
During add and replace node operations, the new node is automatically placed in the existing lockdown mode of the cluster. The lockdown mode of the node that got replaced is set to normal and the node is available for factory reset.
Cluster maintenance shell is enabled with two-factor authentication (2FA).
To access the root shell when lockdown mode is configured
- Log on to the node-level CLI on any node in the cluster.
- Run the support generate-otp to get the OTP (valid for 2 hours) for the entire cluster.
- Open a ticket with Veritas Support to generate a security key. Set a Support password which is later used to elevate to root.
- Log on to the NetBackup Flex Scale shell on any node in the cluster.
- Run the support unlock command. You are prompted to enter a security key. Enter the security key that you got in step 3. Press Enter to unlock the root shell access to the current node (all other nodes remain locked).
- Run the support elevate command. You are prompted to enter a Support password. Enter the Support password set in step 3. Press Enter. Type the maintenance password to get into the root shell.
- Repeat steps 4 to 6 to get into the root shell of all other nodes.
- Run the support lock command on a specific node to lock that node. If no manual lock is issued, the node is locked automatically after 12 hours. All the current users are removed from the root shell in a single node.