Hi all, we have the following environment:
host1:
Win2008R2
Not a domain member
Nbu Master 7.5.0.3
Veritas\java\auth.conf (Contains one line: "nbu_user1 ADMIN=ALL JBP=ALL")
NOT using NBAC (VxSS)
nbu_user1 is a member of host1's local Administrators group.
(In other words, nbu_user1 is a local administrator of host1)
host2:
WindowsXP SP3
Not a domain member
Running the desktop as xp_admin, who is a local administrator of host2.
Nbu Java Admin Console 7.5.0.3
Not using the "Windows Remote Admin Console" because only the Java one works with auth.conf.
With the above config, everything works fine.
On host2 as xp_admin, on the Java admin console login screen, input:
Host name: host1
User name: nbu_user1
password: xxxxxxxx
The Java Admin Console would successfully find nbu_user1's Netbackup-rights from auth.conf and grant them accordingly.
The whole Netbackup admin interface would appear; everything would be accessible (Because I granted "ADMIN=ALL JBP=ALL")
Problem:
Having gotten the above working successfully, we would now like to remove nbu_user1 from the local Administrators group on host1.
Essentially, we would like to give nbu_user1 full Netbackup access rights (application level rights), while at the same time, restrict its rights as a user on host1 (OS level rights).
On host1, we tried moving nbu_user1 away from the Administrators group and into the Backup Operators group;
we also tried moving it to the Users group.
What we discovered is that for as long as nbu_user1 is not a member of the Administrators group on host1, problems will be encountered on host2 while running the Java admin console that tries to login to host1 as nbu_user1.
It won't out right refuse the Java admin console from login; the full Netbackup GUI interface would still load up.
But then nearly everything you do, like checking policies, devices or trying to do a tape inventory, error messages would pop up that would say something along the lines of "You must be a Superuser to run this command", and the interface would stop working, until you shutdown the Java admin console.
The point is, of course I know nbu_user1 is not a "Superuser" on host1; it was deliberately removed from the Administrator's group.
When we put nbu_user1 back as a member of the Administrator's group on host1, everything works fine again on the Java console on host2.
Is there a way to set it up so that nbu_user1 doesn't have to be a member of the Administrator's group on host1, and still have full Netbackup access rights when running from a Java admin console on host2, without all the errors?
(Before you answer, remember that auth.conf already grants full Netbackup (application level) access rights to nbu_user1. So it is not that.
And no, we are not using NBAC/VxSS and probably won't.)
Thanks all,
RLeon
