VM.conf for trusted host access?

[Brian_Hesseling]

I am trying to configure the the VM.conf file on my Netbackup 6.0 mp2 servers to be secure. Am I right in that the only SERVER= entries I should put in it are master, media servers and workstation that I manage from? Would this keep any unauthorized requests from hosts (such as DMZ servers) from working? Thanks.

[Dennis_Strom]

yes. SERVER = only for servers that you are managing from. I do not manage from my media servers so for those I have MEDIA SERVER = . Also this belongs in /opt/openv/netbackup/bp.conf
/opt/openv/volmgr/vm.conf contains DEVICE_HOST = this is for units that control robots.

[Brian_Hesseling]

I was working off of this document:
http://support.veritas.com/docs/285082

Which says to put the entries in the vm.conf file. Is this incorrect? I am trying to mitigate this security problem until I can upgrade to MP 4.

[Dennis_Strom]

looks like you are correct. I think that I would only put the master server in there first. Then see if every still works fine. I do not think you will need remote administration machines in there although I could be correct.

Another fairly simple solution is ipfilter. I have this install on my Master Server that is in the DMZ and as of yet have not failed a security audit (or been hacked that I know of). I actually run ipfilter on all my Master and Media Servers.

[Dennis_Strom]

Ok I have re-read the technote. in vm.conf you only want DEVICE_HOST = SERVERNAME for the servers that control a robot. Nothing else. If you leave this file blank then any server can control the robots by have DEVICE_HOST = you only allow that server to control a robot.

in bp.conf the only way you can have control over the server in question is to have SERVER = SERVERNAME in bp.conf

So yes only DEVICE_HOST = in vm.conf
and
only SERVER = in bp.conf

[Ankur_Kumar_3]

only the master server entry would suffice i believe

ciao
Ankur Kumar