Veritas NetBackup 8.0 安全与加密指南

需积分: 5 144 浏览量更新于2024-06-22 收藏 6.91MB PDF 举报

"Veritas NetBackup 8.0 Security and Encryption Guide" 是一份针对 UNIX、Windows 和 Linux 操作系统的指南，专注于 Veritas NetBackup 的安全和加密功能。这份文档由 Veritas Technologies LLC 在 2016 年发布，版权所有。作为 Veritas 的重要产品系列，NetBackup 提供了高级的数据保护解决方案，强调了在处理敏感信息时的安全性和合规性。该指南的核心内容围绕以下几个关键知识点展开： 1. 概述与许可: - 文档阐述了 Veritas NetBackup 8.0 的法律声明，强调所有权利归 Veritas Technologies LLC 所有，并且可能包含第三方软件。用户必须遵守相应的版权和许可协议，包括开源或免费软件许可证，如需引用第三方程序，需要按照文档中提供的指引或访问 Veritas 的官方许可协议链接（https://www.veritas.com/about/legal/license-agreements）。 2. 数据安全与加密: - 此部分详细介绍了 NetBackup 在加密方面的策略和技术，包括可能使用的加密算法，以及如何确保数据在备份、传输和存储过程中的安全。它可能涵盖了备份数据的端到端加密，以及如何实现密钥管理，以符合企业级安全标准。 3. 系统兼容性: - 针对 UNIX、Windows 和 Linux 平台，指南会分别讨论如何在这些操作系统上配置和实施安全和加密功能，以适应不同环境的需求。 4. 限制与义务: - 用户在使用此产品时，可能会面临使用、复制、分发和解构/逆向工程等方面的限制。这意味着在阅读和操作过程中，必须遵循产品附带的许可证协议，以确保合规性。 5. 开源软件组件: - 如果产品中包含开源或免费软件，指南会明确指出，并可能提供相关许可证信息，以便用户了解他们在此类软件上的权利和义务。 6. 法律和合规: - 由于涉及敏感信息处理，文档强调了产品在满足各种法规和行业标准（如 GDPR、HIPAA 等）方面的支持，帮助用户理解和遵守适用的法规要求。 "Veritas NetBackup 8.0 Security and Encryption Guide" 是一个全面的资源，旨在帮助 IT 专业人士有效地保护数据安全，确保他们在使用 NetBackup 服务时，能够遵循最佳实践和法律规范，以应对日益增长的数据安全挑战。

Figure 1-2

Enterprise-level security scope

Security Overview

Enterprise Level

Internal Users

Security

Administrator

Data Center

16Increasing NetBackup security

Enterprise-level security

■ NBAC uses authentication identities from a trusted source to reliably identify

involved parties. Access decisions can then be made for manipulation of

NetBackup based on those identities. Note that NetBackup Security Services

are now embedded.

■ The NetBackup Product Authentication and Authorization consist of the root

broker, authentication broker, authorization engine, and the graphical user

interface.

■ Oracle, Oracle Archiver, DB2, Informix, Sybase, SQL Server, SAP and EV

Migrator are not supported with NBAC.

■ NBAC is not supported on Appliances.

■ The NetBackup catalog backup is supported with NBAC.

The following table describes the NetBackup components that are used in security.

Table 1-5

NetBackup components used in security

DescriptionComponent

The NetBackup master server is the root broker in a data center installation. There

is no provision to use another root broker. The recommendation is to allow trust

between root brokers.

The root broker authenticates the authentication broker. The root broker does not

authenticate clients.

Root broker

Authenticates the master server, media server, graphical user interface, and clients

by establishing credentials with each one of them. The authentication broker also

authenticates a user when operating a command prompt. There can be more than

one authentication broker in a data center installation. The authentication broker

can be combined with the root broker.

Authentication broker

Communicates with the master server and the media server to determine the

permissions of an authenticated user. These permissions determine the functionality

available to a given server. The authorization engine also stores user groups and

permissions. Only one authorization engine is required in a data center installation.

The authorization engine also communicates over the WAN to authorize other

media servers in a multi-datacenter environment.

Authorization engine

Specifies a Remote Administration Console that receives credentials from the

authentication brokers. The graphical user interface then may use the credentials

to gain access to functionality on the clients, media, and master servers.

graphical user interface

Specifies the MSEO (media server Encryption Option) that is a software appliance

that encrypts data written to tape by the media server (data at rest encryption).

The MSEO is an alternative to the client side encryption that can reduce the CPU

processing load on the client.

MSEO

18Increasing NetBackup security

NetBackup Access Control (NBAC)

Table 1-5

NetBackup components used in security (continued)

DescriptionComponent

Communicates with the root broker and authentication broker, graphical user

interface, authorization engine, media server, and clients.

Master server

Specifies a user who has been granted administrator permissions to access and

manage the NetBackup functionality from within the data center.

NetBackup administrator

Communicates with the master server, root broker and authentication broker,

authorization engine, MSEO, and clients 1 through 6. The media server writes

unencrypted data to tape for client 5 and encrypted data to tape for client 6.

Media server

Specifies that clients 1 through 4 are standard NetBackup types. Client 5 is a web

server type located in the DMZ. Client 6 is a client side encrypted type also located

in the DMZ. All client types are managed by the master server and have their data

backed up to tape through the media server. Clients 5 and 6 communicate to

NetBackup using NetBackup only ports through the internal firewall. Client 5 also

receives connections from the Internet using HTTP only ports through the external

firewall.

Clients

Specifies that the tape security in NetBackup can be increased by adding the

following:

■ Client side encryption

■ MSEO (media server Encryption Option)

■ Encryption of data at rest

Unencrypted and encrypted data tapes are produced in the data center. The

unencrypted tape data is written for clients 1 through 5 and stored on-site at the

data center. The encrypted tapes are written for client 6 and are transported off-site

to a vault for disaster recovery protection.

Tapes

Specifies that NetBackup encryption can increase security by providing the

following:

■ Greater data confidentiality

■ The loss of physical tape is not as critical if all the data is effectively encrypted

■ The best risk mitigation strategy

For more information about encryption:

See “Encryption security questions to consider” on page 294.

Encryption

19Increasing NetBackup security

NetBackup Access Control (NBAC)

Table 1-5

NetBackup components used in security (continued)

DescriptionComponent

Includes the communication between master servers, media servers, clients, and

communication using ports through firewalls and over WANs.

For more information about ports:

See “About NetBackup TCP/IP ports” on page 93.

The data over the wire part of NetBackup can help increase security in the following

ways:

■ NetBackup Access Control (NBAC)

■ Classic NetBackup daemons employ authentication when NBAC is enabled

■ CORBA daemons use the fully encrypted channels that support confidentiality,

and provide data integrity

■ Firewalls

■ Disabling the unused ports in NetBackup and in other products:

See “Enabling or disabling random port assignments” on page 107.

■ PBX and VNETD dedicated ports provide increased NetBackup security

■ Central set of ports to monitor and open through firewalls

Data over the wire security

Specifies that the NetBackup firewall support can help increase security.

Important points about firewall security include the following:

■ Veritas recommends the use of firewall and intrusion detection protection for

NetBackup

■ Firewall protection relates to general network security from a NetBackup

standpoint. It focuses on reducing the possible "door locks" for a thief to try

and pick. It might make sense to review the possibility of blocking NFS, telnet,

FTP, email, etc., ports. They are not strictly needed for NetBackup use and

can provide an "open door" for unwanted access.

■ Secure the master server as much as possible

■ Firewalls can include internal firewalls and external firewalls, as follows:

■ Internal firewall - allows NetBackup to access web server client 5 and

encrypted client 6 in the DMZ. Only selected NetBackup ports and possibly

other application ports are enabled for data communication through the

internal firewall and into and out of the DMZ. The HTTP ports are open in

the External Firewall and are not allowed to pass through the internal firewall.

■ External firewall - allows external users to access the web server client 5

located in the DMZ from the Internet over HTTP ports. NetBackup ports are

open for web server client 5 to communicate through the internal firewall to

NetBackup. The NetBackup ports are not allowed to pass through the

external firewall to the Internet. Only the HTTP ports of web server client 5

can pass through the external firewall to the Internet.

Firewall security

20Increasing NetBackup security

NetBackup Access Control (NBAC)

剩余382页未读，继续阅读

weixin_40191861_zj

粉丝: 83
资源: 1万+

Veritas NetBackup 8.0 安全与加密指南

NetBackup81_SecEncryp_Guide.pdf

NetBackup812_SecEncryp_Guide.pdf

NetBackup811_SecEncryp_Guide.pdf

NetBackup101_SecEncryp_Guide.pdf

NetBackup771_SecEncryp_Guide.pdf

NetBackup1011_SecEncryp_Guide.pdf

NetBackup83_SecEncryp_Guide.pdf

NetBackup102_SecEncryp_Guide.pdf

NetBackup77_SecEncryp_Guide.pdf

NetBackup10_SecEncryp_Guide.pdf

最新资源