Oracle RMAN NetBackup 8.1.2 - new feature!

[Genericus]

Since an Oracle backup runs a script as root, NetBackup is now securing these scripts.

 When we upgrade to 8.1.2, all oracle backup scripts must be run from a defined area.  If the script/directory is not authorized, the backup will fail with error (5449) The script is not approved for execution.

 What does this mean to us?

We should determine a standard script path and protect those scripts so only DBA can update them

As we update clients, we need to add a line in each bp.conf listing the script directory path, like “DB_SCRIPT_PATH = /oracle/rman/” Based on script path in policies.

https://www.veritas.com/support/en_US/article.100039639.html

Best Practices for script authorized location management

• The script should not be world writable.
• The client Privileged User should allow DBA's write permission on a script that is in an authorized location so they have the ability to update the script when needed.
• Remove any script or path that is listed as an authorized location in the bp.conf if the script is no longer needed.
• An entry of DB_SCRIPT_PATH=none will not allow any script to execute on a client.  This is useful if an administrator wants to completely lock down a server from executing scripts.

[Marianne · Accepted solution]

Correct. 

This was introduced in NBU 8.1:

https://www.veritas.com/content/support/en_US/doc/16226115-126559565-0/v125208570-126559565

[DanielGomes]

On Windows S.O. I found another way to solve this problem. It may help in some cases:

I identifyed the parameter DB_SCRIPT_PATH:

mymasterserver:/usr/openv/netbackup # bpgetconfig -M myclient DB_SCRIPT_PATH

DB_SCRIPT_PATH

I created a file txt and added the 2 lines below:

mymasterserver:/usr/openv/netbackup # vi myclient.txt

DB_SCRIPT_PATH = F:\oracle

DB_SCRIPT_PATH = F:\oracle\product\10.2.0\admin\SP2D\scripts\backup\scrRootRmanTapeArchive.bat

Then I run the following command:

bpsetconfig -h myclient myclient.txt

The results:

nbu1-master-ne:/usr/openv/netbackup # bpgetconfig -M s6060db18 DB_SCRIPT_PATH

DB_SCRIPT_PATH = F:\oracle

DB_SCRIPT_PATH = F:\oracle\product\10.2.0\admin\SP2D\scripts\backup\scrRootRmanTapeArchive.bat

Finally, I reprocessed the job and it ended perfectly