About multifactor authentication
Starting with NetBackup Appliance release 5.3, multifactor authentication is supported.
Multifactor authentication requires users to verify their appliance login identity by means of a system-generated code that is required in addition to the standard login password. When multifactor authentication is enabled, each time you log in to the appliance you enter your username and password as usual. Next, you are prompted through a remote device, such as a smartphone, to enter a second factor to verify your identity. When you open the app on your smartphone, it shows a unique 6-digit code that you must enter to complete the login.
Note:
You cannot use multifactor authentication if Smart Card configuration is enabled.
An administrator must configure their user account for multifactor authentication before other users can con configure their user accounts. Configuration for the feature is done from the following NetBackup Appliance Shell Menu view:
Main > Settings > Security > Authentication > MFA
For complete details and descriptions of the command options for this feature, see the NetBackup Appliance Commands Reference Guide.
After the first administrator has configured their user account for multifactor authentication, all of the following appliance users can configure their user accounts:
Active Directory (AD)
LDAP
Local users
NetBackup CLI users
No-role users
Note:
NetBackupCLI and no-role users must log in to the appliance and run the multifactor-authentication command, then run the available submenu commands. For complete details, see the Settings > Security > Authentication > MFA description in the NetBackup Appliance Commands Reference Guide.
This section describes how an administrator configures their user account for multifactor authentication to allow all other users to configure their user accounts later.
Requirements for administrator configuration:
Minimum of two administrator accounts - The appliance must have at least two administrator accounts before they can configure multifactor authentication for their user accounts. If only one administrator user account exists when another user tries to configure the feature, an error message appears to inform them to add another administrator user account.
Minimum of one NTP server - At least one NTP server must be configured and added before the first administrator can configure multifactor authentication for their user account. A message appears if an NTP server is needed.
Note:
The NTP server is typically configured when you perform the initial configuration on the appliance. If you did not configure an NTP server at that time, you must log in to the appliance shell menu and configure at least one NTP server with the Main > Network > NTPServer command. For details, see the NetBackup Appliance Commands Reference Guide.
After the above configurations are completed, all other appliance users can configure their user accounts.
The following procedure describes the first-time configuration for an administrator to configure their user account for multifactor authentication.
For first-time administrator user account configuration for multifactor authentication
- Log in to the shell menu as an administrator with the following command:
Main > Settings > Security > Authentication > MFA Configure
- Follow the prompts to configure multifactor authentication for your user account.
- After completing the previous steps, have another administrator log in to the appliance with the following command to configure their user account to use multifactor configuration:
Main > Settings > Security > Authentication > MFA Configure
- To enforce multifactor authentication for all users of the appliance, run the following command:
Main > Settings > Security > Authentication > MFA Enforce
Note:
You can run this command only after you have completed steps 1, 2, and 3.
After the two required administrators have completed their user account configurations, all other appliance users can configure their user accounts.
Requirements for user configuration:
If multifactor authentication is configured but not enforced for all users (global enforcement), a user can configure or unconfigure multifactor authentication for their account at any time.
If multifactor authentication is configured and is also enforced for all users, a user can unconfigure multifactor authentication for their account only within a defined grace period. The grace period default is 90 days. After the grace period has expired, the user is forced to configure multifactor authentication during login, but they cannot unconfigure it.
To configure multifactor authentication for a user account
- Log in to the appliance shell menu and run the following command to configure your user account for multifactor authentication:
Main > Settings > Security > Authentication > MFA Configure
For NetBackupCLI users and no-role users, log in to the appliance and run the multifactor-authentication command, then run the Configure submenu command.
- Follow the prompts to configure multifactor authentication for your user account.