Selecting or changing the lockdown mode
The user can select the lockdown mode during initial configuration. After cluster configuration, user has the option to see/change the lockdown mode using both GUI and REST APIs. The lockdown modes can be switched only if the engines are healthy. The user can switch between the following modes without any restriction:
From normal to enterprise mode
From normal to compliance mode
From enterprise to compliance mode
The user can set minimum and maximum retention time for backup images for enterprise and compliance mode only. Creation of images with retention time less than the minimum retention time or greater than the maximum retention time is not allowed. This minimum and maximum retention time should be set by the appliance administrator as per the retention requirement of their use case.
Once the lockdown mode is set, only Appliance administrators can change the lockdown mode.
The lockdown mode is maintained during upgrade.
Only the Appliance administrator can remove the retention locks if the lockdown mode is enterprise.
Only the users with appliance administrator role can disable retention or remove the retention lock using the MSDP Restricted Shell.
The user cannot change the mode if any existing operation is in progress.
If the mode is set to compliance mode, the administrator cannot change the mode to enterprise or normal mode.
If lockdown mode is set to compliance or enterprise for any node, it is not available for factory reset.
During add and replace node operations, the new node is automatically placed in the existing lockdown mode of the cluster. The lockdown mode of the node that got replaced is set to normal and the node is available for factory reset.
Cluster maintenance shell is enabled with two-factor authentication (2FA).
If you use the NetBackup Flex Scale UI to change the retention period without changing the lockdown mode, you have to manually update the disk volume in NetBackup, either through the NetBackup CLI or the NetBackup Web UI. This is necessary to synchronize the information in the NetBackup database.
To access the root shell when lockdown mode is configured
- Log on to the node-level CLI on any node in the cluster.
- Run the show cluster-id command to get the cluster ID for the entire cluster or the show serial-number command to get the serial number for a specific node.
You can also get the node serial number from the NetBackup Flex Scale web UI by navigating to Infrastructure > Nodes > Node serial number. You can get the cluster ID from the NetBackup Flex Scale web UI by navigating to Infrastructure > Cluster Id.
- If you have permission to generate access key on the SHI portal, then go to the portal to generate access key with the cluster ID or serial number that you got in step 2. For more information, refer to the System Health Insights User Guide.
If you do not have the permission to generate the access key on the SHI portal, open a ticket with Veritas Support to generate an access key. Set an access passphrase which will be required later to elevate to root.
- Log on to the NetBackup Flex Scale shell on any node in the cluster.
- Run the support unlock command. You are prompted to enter the maintenance password. Enter the maintenance password and press Enter. You are prompted to enter an access key. Enter the access key that you got in step 3. You are prompted to enter an access passphrase. Enter the access passphrase that you set in step 3. Press Enter to unlock the root shell access to the current node (all other nodes remain locked).
- Run the support elevate command. Enter the maintenance password. You are prompted to enter an access passphrase. Enter the access passphrase set in step 3. Press Enter to get into the root shell.
- Repeat steps 3 to 6 to get into the root shell of all other nodes.
- Run the support lock command on a specific node to lock that node. If no manual lock is issued, the node is locked automatically after 12 hours. All the current users are removed from the root shell in a single node.
- Login to the management console IP and run the system lock enable to lock all the nodes in the cluster.
Note:
If an access key is generated with cluster ID, then the access key can be used to unlock all the nodes in the same cluster. If an access key is generated with serial number, then the access key can only be used to unlock the appliance which have the serial number.
The access key expires in 2 hours.