Linux Centralized Data Collector: SSH

Configure NetBackup sudo access for NetBackup data collection

Collection of NetBackup data using the SSH Collection method to a NetBackup Primary Server requires root privileges to run NetBackup commands.

If your security requirements require sudo access to provide temporary, elevated privileges, use the following instructions. NetBackup IT Analytics requires the use of passwordless sudo.

Create a Linux user to grant sudo access.
Modify the sudo Configuration. Depending on the version of Linux, either run the visudo command, or create a drop-in sudoers file in the correct directory to restrict the commands that this user can execute.

To modify the sudoers file

Configure visudo to modify the sudoers file. visudo will use the editor specified in the $EDITOR variable, or vi, by default. Specify a preferred editor. For example, to use nano as your editor, execute the following:
```
export EDITOR=nano
```
Once the preferred editor is configured, execute the following commands. Use visudo if available.
```
visudo -f /etc/sudoers.d/<username>
```

Add the following lines to the sudoers file, substituting the name of the user you created for <username>:

Defaults:<username> !requiretty
<username> ALL=(ALL) NOPASSWD: \
/usr/openv/netbackup/bin/admincmd/* ,\
/usr/openv/volmgr/bin/* ,\
/usr/openv/netbackup/bin/*

Or to further restrict access to NetBackup administrative commands, use the following:

Defaults:<username> !requiretty
<username> ALL=(ALL) NOPASSWD: \
/usr/openv/netbackup/bin/admincmd/bpgetconfig ,\
/usr/openv/netbackup/bin/admincmd/bpcoverage ,\
/usr/openv/netbackup/bin/admincmd/bpdbjobs ,\
/usr/openv/netbackup/bin/admincmd/bpimagelist ,\
/usr/openv/netbackup/bin/admincmd/bperror ,\
/usr/openv/netbackup/bin/admincmd/bppllist ,\
/usr/openv/netbackup/bin/admincmd/bpretlevel ,\
/usr/openv/netbackup/bin/admincmd/bpplclients ,\
/usr/openv/netbackup/bin/admincmd/bpmedialist ,\
/usr/openv/netbackup/bin/admincmd/bpstulist ,\
/usr/openv/netbackup/bin/admincmd/nbdevquery ,\
/usr/openv/netbackup/bin/admincmd/nbauditreport ,\
/usr/openv/netbackup/bin/admincmd/nbstl ,\
/usr/openv/netbackup/bin/admincmd/nbstlutil ,\
/usr/openv/netbackup/bin/admincmd/bpstsinfo ,\
/usr/openv/netbackup/bin/admincmd/bpminlicense ,\
/usr/openv/volmgr/bin/vmquery ,\
/usr/openv/volmgr/bin/vmpool ,\
/usr/openv/volmgr/bin/vmglob ,\
/usr/openv/volmgr/bin/vmcheckxxx ,\
/usr/openv/volmgr/bin/vmoprcmd ,\
/usr/openv/volmgr/bin/tpconfig ,\
/usr/openv/netbackup/bin/bplist ,\
/usr/openv/netbackup/bin/nbsqladm ,\ 
/usr/openv/netbackup/bin/nboraadm

Save the sudoers file.

Configure NetBackup Appliances for Data Collection

Create a new NetBackup administrator CLI user account, for example "aptare". Refer to Creating NetBackup administrator user accounts in the Veritas NetBackup™ Appliance Administrator's Guide.
Create a location for temporary files (e.g. /log/aptare/tmp).
```
maintenance-!> sudo bash
root-!> mkdir -p /log/aptare/tmp
```
Assign read and write permissions to the folder for the CLI user account and nbusers group.
Refer to Overriding the NetBackup appliance intrusion prevention system policy in the Veritas NetBackup™ Appliance Security Guide.
```
maintenance-!> sudo bash
root-!> chown -R aptare:nbusers /log/aptare
```
Create a .profile file in the /home/nbusers directory.
It is recommended to use a .profile that only sets TMPDIR for the CLI user created for collection.
For example:
```
if [ "${USER}" = "aptare" ] ; then

    TMPDIR=/log/aptare/tmp

    export TMPDIR

fi
```
OR
Use the advanced parameter NBU_SSH_TMPDIR. For available methods of configuring the TMPDIR environment variable.

Configure NetBackup Flex Appliances for Data Collection

To configure NetBackup Flex Appliances for data collection, you must first create a new user account on the Flex primary server and grant sudo access to the user account in /etc/sudoers.d and /mnt/nbdata/vxos/etc/sudoers.d, as described in the procedure below. You must also obtain the REST API key from the NetBackup UI.

Open a SSH session to the NetBackup instance as an admin or root user to create an appadmin user.

Create a local user account:

sudo useradd <username> 
sudo passwd <username>

Grant sudo access to the local user account created above in /etc/sudoers.d:

Create sudoers file in /etc/sudoers.d, substituting the name of the user you created for <username>.
```
sudo visudo -f /etc/sudoers.d/<username>
```

Add these permissions in the interactive editor.

To allows unrestricted access to all the permissions:

Defaults:<username> !requiretty
<username> ALL=(ALL) NOPASSWD: \
/usr/openv/netbackup/bin/admincmd/* ,\
/usr/openv/volmgr/bin/* ,\
/usr/openv/netbackup/bin/*

Or to further restrict access to NetBackup administrative commands, use the following:

Defaults:<username> !requiretty 
<username> ALL=(ALL) NOPASSWD: /usr/openv/netbackup/bin/admincmd/bpgetconfig ,\ 
/usr/openv/netbackup/bin/admincmd/bpcoverage ,\ 
/usr/openv/netbackup/bin/admincmd/bpdbjobs ,\ 
/usr/openv/netbackup/bin/admincmd/bpimagelist ,\ 
/usr/openv/netbackup/bin/admincmd/bperror ,\
/usr/openv/netbackup/bin/admincmd/bpminlicense ,\ 
/usr/openv/netbackup/bin/admincmd/bppllist ,\ 
/usr/openv/netbackup/bin/admincmd/bpretlevel ,\ 
/usr/openv/netbackup/bin/admincmd/bpplclients ,\ 
/usr/openv/netbackup/bin/admincmd/bpmedialist ,\ 
/usr/openv/netbackup/bin/admincmd/bpstulist ,\ 
/usr/openv/netbackup/bin/admincmd/nbdevquery ,\ 
/usr/openv/netbackup/bin/admincmd/nbauditreport ,\ 
/usr/openv/netbackup/bin/admincmd/nbstl ,\ 
/usr/openv/netbackup/bin/admincmd/nbstlutil ,\ 
/usr/openv/netbackup/bin/admincmd/bpstsinfo ,\ 
/usr/openv/volmgr/bin/vmquery ,\ 
/usr/openv/volmgr/bin/vmpool ,\ 
/usr/openv/volmgr/bin/vmglob ,\ 
/usr/openv/volmgr/bin/vmcheckxxx ,\ 
/usr/openv/volmgr/bin/vmoprcmd ,\ 
/usr/openv/volmgr/bin/tpconfig ,\ 
/usr/openv/netbackup/bin/bplist ,\ 
/usr/openv/netbackup/bin/nbsqladm ,\ 
/usr/openv/netbackup/bin/nboraadm

Save and exit the interactive editor.

Grant sudo access to the local user account created above in /mnt/nbdata/vxos/etc/sudoers.d:

Create sudoers file in /mnt/nbdata/vxos/etc/sudoers.d.

sudo visudo -f  /mnt/nbdata/vxos/etc/sudoers.d/<username>

Add these permissions in the interactive editor.

To allows unrestricted access to all the permissions:

Defaults:<username> !requiretty
<username> ALL=(ALL) NOPASSWD: \
/usr/openv/netbackup/bin/admincmd/* ,\
/usr/openv/volmgr/bin/* ,\
/usr/openv/netbackup/bin/*

Or to further restrict access to NetBackup administrative commands, use the following:

Defaults:<username> !requiretty 
<username> ALL=(ALL) NOPASSWD: /usr/openv/netbackup/bin/admincmd/bpgetconfig ,\ 
/usr/openv/netbackup/bin/admincmd/bpcoverage ,\ 
/usr/openv/netbackup/bin/admincmd/bpdbjobs ,\ 
/usr/openv/netbackup/bin/admincmd/bpimagelist ,\ 
/usr/openv/netbackup/bin/admincmd/bperror ,\ 
/usr/openv/netbackup/bin/admincmd/bpminlicense ,\
/usr/openv/netbackup/bin/admincmd/bppllist ,\ 
/usr/openv/netbackup/bin/admincmd/bpretlevel ,\ 
/usr/openv/netbackup/bin/admincmd/bpplclients ,\ 
/usr/openv/netbackup/bin/admincmd/bpmedialist ,\ 
/usr/openv/netbackup/bin/admincmd/bpstulist ,\ 
/usr/openv/netbackup/bin/admincmd/nbdevquery ,\ 
/usr/openv/netbackup/bin/admincmd/nbauditreport ,\ 
/usr/openv/netbackup/bin/admincmd/nbstl ,\ 
/usr/openv/netbackup/bin/admincmd/nbstlutil ,\ 
/usr/openv/netbackup/bin/admincmd/bpstsinfo ,\ 
/usr/openv/volmgr/bin/vmquery ,\ 
/usr/openv/volmgr/bin/vmpool ,\ 
/usr/openv/volmgr/bin/vmglob ,\ 
/usr/openv/volmgr/bin/vmcheckxxx ,\ 
/usr/openv/volmgr/bin/vmoprcmd ,\ 
/usr/openv/volmgr/bin/tpconfig ,\ 
/usr/openv/netbackup/bin/bplist ,\ 
/usr/openv/netbackup/bin/nbsqladm ,\ 
/usr/openv/netbackup/bin/nboraadm

Save and exit the interactive editor.

Obtain the REST API key from the NetBackup UI and copy it in the API key field. The API key field appears on Add Backup Server or Edit Backup Server popup that is displayed when you click Add or Edit on the Veritas NetBackup Data Collector Policy window.

Linux Centralized Data Collector: SSH

Feedback

Feedback