Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  3. IT Analytics Help
  5. Section VII. Data Collector Installation and Configuration for Cohesity NetBackup
  7. Centralized Data Collector for NetBackup - Prerequisites, Installation, and Configuration
  9. Step-5: SSH/WMI
  11. Linux Centralized Data Collector: SSH

Linux Centralized Data Collector: SSH

Configure NetBackup sudo access for NetBackup data collection

Collection of NetBackup data using the SSH Collection method to a NetBackup Primary Server requires root privileges to run NetBackup commands.

If your security requirements require sudo access to provide temporary, elevated privileges, use the following instructions. IT Analytics requires the use of passwordless sudo.

  • Create a Linux user to grant sudo access.

  • Modify the sudo Configuration. Depending on the version of Linux, either run the visudo command, or create a drop-in sudoers file in the correct directory to restrict the commands that this user can execute.

To modify the sudoers file

  1. Configure visudo to modify the sudoers file. visudo will use the editor specified in the $EDITOR variable, or vi, by default. Specify a preferred editor. For example, to use nano as your editor, execute the following: 
    export EDITOR=nano
  2. Once the preferred editor is configured, execute the following commands. Use visudo if available.
    visudo -f /etc/sudoers.d/<username>
  3. Add the following lines to the sudoers file, substituting the name of the user you created for <username>:
    Defaults:<username> !requiretty
<username> ALL=(ALL) NOPASSWD: \
/usr/openv/netbackup/bin/admincmd/* ,\
/usr/openv/volmgr/bin/* ,\
/usr/openv/netbackup/bin/*

    Or to further restrict access to NetBackup administrative commands, use the following:

    Defaults:<username> !requiretty
<username> ALL=(ALL) NOPASSWD: \
/usr/openv/netbackup/bin/admincmd/bpgetconfig ,\
/usr/openv/netbackup/bin/admincmd/bpcoverage ,\
/usr/openv/netbackup/bin/admincmd/bpdbjobs ,\
/usr/openv/netbackup/bin/admincmd/bpimagelist ,\
/usr/openv/netbackup/bin/admincmd/bperror ,\
/usr/openv/netbackup/bin/admincmd/bppllist ,\
/usr/openv/netbackup/bin/admincmd/bpretlevel ,\
/usr/openv/netbackup/bin/admincmd/bpplclients ,\
/usr/openv/netbackup/bin/admincmd/bpmedialist ,\
/usr/openv/netbackup/bin/admincmd/bpstulist ,\
/usr/openv/netbackup/bin/admincmd/nbdevquery ,\
/usr/openv/netbackup/bin/admincmd/nbauditreport ,\
/usr/openv/netbackup/bin/admincmd/nbstl ,\
/usr/openv/netbackup/bin/admincmd/nbstlutil ,\
/usr/openv/netbackup/bin/admincmd/bpstsinfo ,\
/usr/openv/netbackup/bin/admincmd/bpminlicense ,\
/usr/openv/volmgr/bin/vmquery ,\
/usr/openv/volmgr/bin/vmpool ,\
/usr/openv/volmgr/bin/vmglob ,\
/usr/openv/volmgr/bin/vmcheckxxx ,\
/usr/openv/volmgr/bin/vmoprcmd ,\
/usr/openv/volmgr/bin/tpconfig ,\
/usr/openv/netbackup/bin/bplist ,\
/usr/openv/netbackup/bin/nbsqladm ,\ 
/usr/openv/netbackup/bin/nboraadm
  4. Save the sudoers file.
Configure NetBackup Appliances for Data Collection

  1. Create a new NetBackup administrator CLI user account, for example "aptare". Refer to Creating NetBackup administrator user accounts in the Veritas NetBackup™ Appliance Administrator's Guide.

  2. Create a location for temporary files (e.g. /log/aptare/tmp). 

    maintenance-!> sudo bash
root-!> mkdir -p /log/aptare/tmp

  3. Assign read and write permissions to the folder for the CLI user account and nbusers group.

    Refer to Overriding the NetBackup appliance intrusion prevention system policy in the Veritas NetBackup™ Appliance Security Guide.

    maintenance-!> sudo bash
root-!> chown -R aptare:nbusers /log/aptare

  4. Create a .profile file in the /home/nbusers directory.

    It is recommended to use a .profile that only sets TMPDIR for the CLI user created for collection.

    For example: 

    if [ "${USER}" = "aptare" ] ; then

    TMPDIR=/log/aptare/tmp

    export TMPDIR

fi

    OR

    Use the advanced parameter NBU_SSH_TMPDIR. For available methods of configuring the TMPDIR environment variable.

Configure NetBackup Flex Appliances for Data Collection

To configure NetBackup Flex Appliances for data collection, you must first create a new user account on the Flex primary server and grant sudo access to the user account in /etc/sudoers.d and /mnt/nbdata/vxos/etc/sudoers.d, as described in the procedure below. You must also obtain the REST API key from the NetBackup UI.

  1. Open a SSH session to the NetBackup instance as an admin or root user to create an appadmin user.
  2. Create a local user account:
    sudo useradd <username> 
sudo passwd <username>
  3. Grant sudo access to the local user account created above in /etc/sudoers.d:

    • Create sudoers file in /etc/sudoers.d, substituting the name of the user you created for <username>.

      sudo visudo -f /etc/sudoers.d/<username>

    • Add these permissions in the interactive editor.

      To allows unrestricted access to all the permissions:

      Defaults:<username> !requiretty
<username> ALL=(ALL) NOPASSWD: \
/usr/openv/netbackup/bin/admincmd/* ,\
/usr/openv/volmgr/bin/* ,\
/usr/openv/netbackup/bin/*

      Or to further restrict access to NetBackup administrative commands, use the following:

      Defaults:<username> !requiretty 
<username> ALL=(ALL) NOPASSWD: /usr/openv/netbackup/bin/admincmd/bpgetconfig ,\ 
/usr/openv/netbackup/bin/admincmd/bpcoverage ,\ 
/usr/openv/netbackup/bin/admincmd/bpdbjobs ,\ 
/usr/openv/netbackup/bin/admincmd/bpimagelist ,\ 
/usr/openv/netbackup/bin/admincmd/bperror ,\
/usr/openv/netbackup/bin/admincmd/bpminlicense ,\ 
/usr/openv/netbackup/bin/admincmd/bppllist ,\ 
/usr/openv/netbackup/bin/admincmd/bpretlevel ,\ 
/usr/openv/netbackup/bin/admincmd/bpplclients ,\ 
/usr/openv/netbackup/bin/admincmd/bpmedialist ,\ 
/usr/openv/netbackup/bin/admincmd/bpstulist ,\ 
/usr/openv/netbackup/bin/admincmd/nbdevquery ,\ 
/usr/openv/netbackup/bin/admincmd/nbauditreport ,\ 
/usr/openv/netbackup/bin/admincmd/nbstl ,\ 
/usr/openv/netbackup/bin/admincmd/nbstlutil ,\ 
/usr/openv/netbackup/bin/admincmd/bpstsinfo ,\ 
/usr/openv/volmgr/bin/vmquery ,\ 
/usr/openv/volmgr/bin/vmpool ,\ 
/usr/openv/volmgr/bin/vmglob ,\ 
/usr/openv/volmgr/bin/vmcheckxxx ,\ 
/usr/openv/volmgr/bin/vmoprcmd ,\ 
/usr/openv/volmgr/bin/tpconfig ,\ 
/usr/openv/netbackup/bin/bplist ,\ 
/usr/openv/netbackup/bin/nbsqladm ,\ 
/usr/openv/netbackup/bin/nboraadm

    • Save and exit the interactive editor.

  4. Grant sudo access to the local user account created above in /mnt/nbdata/vxos/etc/sudoers.d:

    • Create sudoers file in /mnt/nbdata/vxos/etc/sudoers.d.

      sudo visudo -f  /mnt/nbdata/vxos/etc/sudoers.d/<username>

    • Add these permissions in the interactive editor.

      To allows unrestricted access to all the permissions:

      Defaults:<username> !requiretty
<username> ALL=(ALL) NOPASSWD: \
/usr/openv/netbackup/bin/admincmd/* ,\
/usr/openv/volmgr/bin/* ,\
/usr/openv/netbackup/bin/*

      Or to further restrict access to NetBackup administrative commands, use the following:

      Defaults:<username> !requiretty 
<username> ALL=(ALL) NOPASSWD: /usr/openv/netbackup/bin/admincmd/bpgetconfig ,\ 
/usr/openv/netbackup/bin/admincmd/bpcoverage ,\ 
/usr/openv/netbackup/bin/admincmd/bpdbjobs ,\ 
/usr/openv/netbackup/bin/admincmd/bpimagelist ,\ 
/usr/openv/netbackup/bin/admincmd/bperror ,\ 
/usr/openv/netbackup/bin/admincmd/bpminlicense ,\
/usr/openv/netbackup/bin/admincmd/bppllist ,\ 
/usr/openv/netbackup/bin/admincmd/bpretlevel ,\ 
/usr/openv/netbackup/bin/admincmd/bpplclients ,\ 
/usr/openv/netbackup/bin/admincmd/bpmedialist ,\ 
/usr/openv/netbackup/bin/admincmd/bpstulist ,\ 
/usr/openv/netbackup/bin/admincmd/nbdevquery ,\ 
/usr/openv/netbackup/bin/admincmd/nbauditreport ,\ 
/usr/openv/netbackup/bin/admincmd/nbstl ,\ 
/usr/openv/netbackup/bin/admincmd/nbstlutil ,\ 
/usr/openv/netbackup/bin/admincmd/bpstsinfo ,\ 
/usr/openv/volmgr/bin/vmquery ,\ 
/usr/openv/volmgr/bin/vmpool ,\ 
/usr/openv/volmgr/bin/vmglob ,\ 
/usr/openv/volmgr/bin/vmcheckxxx ,\ 
/usr/openv/volmgr/bin/vmoprcmd ,\ 
/usr/openv/volmgr/bin/tpconfig ,\ 
/usr/openv/netbackup/bin/bplist ,\ 
/usr/openv/netbackup/bin/nbsqladm ,\ 
/usr/openv/netbackup/bin/nboraadm

    • Save and exit the interactive editor.

  5. Obtain the REST API key from the NetBackup UI and copy it in the API key field. The API key field appears on Add Backup Server or Edit Backup Server popup that is displayed when you click Add or Edit on the Veritas NetBackup Data Collector Policy window.

Feedback

Was this page helpful?
Previous

Step-5: SSH/WMI

Next

Windows Data Collector: WMI Connectivity

Feedback

Was this page helpful?