Configuring the multi-factor authentication on NetBackup primary and media server instance
On Flex appliance, you can log in to the NetBackup instance through SSH. You can configure multi-factor authentication (MFA) on NetBackup primary and media server instance.
You can perform the following tasks to configure multi-factor authentication:
Enroll the multi-factor authentication.
After you enroll multi-factor authentication, user is required to provide six-digit token additionally to username and password to be able to log in. The authentication application generates the token on the mobile phone every 30 seconds.
Enforce the multi-factor authentication.
By default, multi-factor authentication is optional for the users. However, appadmin user can enforce it for all SSH login users in the application instance.
Reset the multi-factor authentication.
If the user's mobile phone is lost or factory-reset, the user is no longer able to log in with a token. The appadmin user can help the user to reset and re-enroll the multi-factor authentication.
If appadmin user is locked, he cannot reset multi-factor authentication for himself. To avoid this situation, we recommend that two or multiple users scan the same QR code of appadmin user with their mobile phones. If one user loses access to the MFA token, another can help him to enroll MFA again.
To configure the multi-factor authentication for SSH login
- Run the following command to enroll the multi-factor authentication:
/usr/openv/netbackup/bin/goodies/nbmfacfg -enroll
The command generates secret key randomly and displays it as the QR code.
- Scan the QR code using an authentication application on your mobile phone. For example, Google Authenticator or Microsoft Authenticator.
- If you want to manage multiple applications using the same secret key, you can get the secret key string from one MFA-enrolled application. Use the same key to configure multi-factor authentication on another instance.
To show the secret key and QR code, run the following command:
/usr/openv/netbackup/bin/goodies/nbmfacfg -show
To enroll MFA using a specific secret key, run the following command:
/usr/openv/netbackup/bin/goodies/nbmfacfg -enroll -secret <secret key>
Note:
The token validation is based on the server time. Ensure that the clock of the Flex Appliance and the mobile phone are correct.
- Run the following command to enforce multi-factor authentication for all SSH login users in the application instance. You must be appadmin user to perform this task.
/usr/openv/netbackup/bin/goodies/nbmfacfg -setenforce <1/0> [-grace-period <days>]
For example,
/usr/openv/netbackup/bin/goodies/nbmfacfg -setenforce 1 -grace-period 90
-setenforce: Sets the multi-factor authentication enforcement.
The value "1" enforces the multi-factor authentication. The value "0" disables the multi-factor authentication enforcement.
-grace-period: The grace period in days for SSH login without multi-factor authentication. After specified grace period is over, SSH login is denied if the user still does not enroll multi-factor authentication.
- To reset the multi-factor authentication for the user, run the following command. You must be appadmin user to perform this task.
/usr/openv/netbackup/bin/goodies/nbmfacfg -reset -user <user name>