Forum Discussion

Raju_la's avatar
Raju_la
Level 5
12 years ago

Netbackup Administration Console - Restricted Access

hi,

 we installed NB Admin console on one of windows 2007 server, we want to make the NB admin console login restricted to backup admins only. rightnow who ever have access to that server are able to open NB console is there any way we can restircted the NB admin console ?  due to that server is used by

multiple windows admins we can't restirct the server access all we need is restritct the NB console acess ?  any help is appreciated.

 

7.5
Backup and Recovery
NetBackup
  • Marianne's avatar
    Marianne
    12 years ago

    Seeing that you master is Solaris, please consider using Java Admin Console, not the Windows Admin Console.

    Java Console presents you with login prompt. This requires Unix login account on the Solaris server.
    You can create user accounts on Solaris for backup admins and decide on access rights for each of them.

    You can then customise auth.conf on the master server (in /usr/openv/java).

    The NBAC section of the Security and Encryption Guide says that you CAN manage a Unix server with AD credentials, but I have not been able to find the HOW TO in this manual....

17 Replies

Sort By
  • AmolB's avatar
    AmolB
    Moderator
    12 years ago

    windows 2007 server ? when did MS launch 2007 server.

    Anyways refer to the below article for restricting access to NB java console

    Refer to http://www.symantec.com/docs/HOWTO34640

  • Raju_la's avatar
    Raju_la
    Level 5
    12 years ago

    as per NB for Windows Guide.. i created a folder name: java at nb console installation direcotry

    E:\Program Files\Veritas\NetBackup\bin\java

    and created auth.conf and used my name itself to test

    domain\xxxx ADMIN=ALL JBP=ALL

    then close the nb admin console and open it , it didn't prompt me to enter any details that make sense bec i use my user credentials then i log off and login with other user name and open this console i am able to do it no prompt and able to allow me to do everything.

    do i need to restart services ?? or did i miss anything here ?

     

     

  • Will_Restore's avatar
    Will_Restore
    Level 6
    12 years ago

    remove the line starting with asterisk (*) as this allows any other user to connect (typically with restricted privileges following)

  • mansoor_sheik's avatar
    mansoor_sheik
    Level 6
    12 years ago

    Hi Raju,

    Auth.conf file is used to provide customized authentication for the NB console.Whenever you start the NB application, it will prompt to provide credentials and followed by authetication.

    From your comment, " login with other user name and open this console i am able to do it no prompt and able to allow me to do everything" ?

    Can you post the auth.conf file output.?

    It is not required to restart the service for the auth.conf file change to take effect.

    If you want to deny permissions for the user, you can go with the below entry.

    mydomain\username ADMIN= JBP=

     

  • Raju_la's avatar
    Raju_la
    Level 5
    12 years ago

    hi wr/mansoor,

    my auth.conf file didn't have that * line.

    path of file:  E:\Program Files\Veritas\NetBackup\bin\java

    ( As i mentioned earlier , i created java folder its not there before )

    auth.conf file entries are below ( just one line - my company domain & username which i used to login to this server ).

     xxxxx\raju ADMIN=ALL JBP=ALL

    ""Whenever you start the NB application, it will prompt to provide credentials and followed by authetication.""

    Its not prompted me to enter any details more over i login as another backup admin user and able to open Nb admin console

     

     

     

     

  • Will_Restore's avatar
    Will_Restore
    Level 6
    12 years ago

    wait a sec... the directory was not there before?  typically it's on C: drive

     

    how are you starting the Administration Console?  from what path?

     

     

  • Raju_la's avatar
    Raju_la
    Level 5
    12 years ago

    we installed NB admin console in E: drive , we open console through this shortcut ( here i attach the image , by properties we can see theat its installed on E: drive).

     

     

  • mansoor_sheik's avatar
    mansoor_sheik
    Level 6
    12 years ago

    Hi Raju,

    If both the account ( your and other backup admin account) is in adminstrator group, i think it wont prompt for cerendtials. In order to verify the java.auth file, can u try the below option,

    File--->change server ----> select the same master server name  and check the log on different user and provide the cerendtials.

    Just a guess.