NBAC - 7.1 Windows Master Server

[SYMAJ]

I have an environment with 1 W2K8R2 Master server and 4 Windows Media Servers.  I have just enabled NBAC, which I note has changed in the way it is setup from 7.0 to 7.1.

With 7.1 I simply ran the bpnbaz -setupmaster command (no parameters), and this completed.  I then restarted the NBU services on the Master Server.  Next, I ran the bpnbaz -setupmedia -all, which completed.

I created a number of AD Windows Groups and added these as users to the NBAC groups.  The user I was logged onto when I ran the bpnbaz commands was added to each of the groups in NBAC automatically.

All appears to be working OK excepting that everyone has access to the Security commands in the GUI !!  Where I have added the Windows group to for example the operators group, they can do everything they should be able to do as an operator - cannot do the things they shouldn't be able to do - but can also access the security functions from the GUI and add/remove users and groups to NBAC.  This obviously defeates the purpose........

This is the result when the users RDP to the master server and logon as themselves.  If they use the Remote Admin Console then they get an error relating to an expired certificate if they try and access the Access Control tab of the GUI. 

Compared to when I setup NBAC in V7 (where I has to setup Authenication and Authorization), there appears very little to do here.  Although I have the fear I have missed something !!

The Master has AUTOMATIC set as the authentication, the media server the same.  I have not run the bpnbaz -clientsetup yet - do I need to ?

I have not 'linked' a windows domain or anything as of yet - and am finding the instructions in the Security and Encryption Guide not very clear.

Have I missed something here ?

I am currently running 7.1.0.2

Any help appreciated.

AJ.

[R__Ravi_Kumar · Accepted solution]

This is a bug in NetBackup. The problem is that the local administrator group is added by default in the global security admin group of authorization database.

There is a workaround to remove it from that group and I can give you commands to do it, but the caveat is that if you restart authorization service nbazd it automatically adds it again.

To fix this you need to contact symantec support.

Here are the commands

C:\Program Files\Veritas\NetBackup\sec\az\bin>vssaz login --domain localhost

C:\Program Files\Veritas\NetBackup\sec\az\bin>vssaz listazgrpmembers --azgrpname "Security Administrators"
 

C:\Program Files\Veritas\NetBackup\sec\az\bin>vssaz removeazgrpmember --azgrpname "Security Administrators" --prplinfo ATG,nt:<Hostname>,<hostname>\Administrators

Here replace <hostname> with yours.

Login after this and you should see the difference. It will work till the time you restart nbazd.

Ravi

[SYMAJ]

As per Ravi above, there is a fix available from Symantec for this  The fix is in the form of an EEB - quick to install and fixes the problem fully.

However - one note of caution - we applied the 7.1.0.4 update recently and following this could not login to NBU to do anything !!  We could perform the bpnbat -login no problem, but within the Admin Console could had no access to most functions (even though we were logged in as an Admin account.

We simply re-applied the EEB (after we had upgraded to 7.1.0.4) and all was well again.

Watch out for this.

AJ.