Unsolved
This post is more than 5 years old
116 Posts
0
1764
nsrwatch enhancements in NW8.2SP3
Hi,
I'd like to ask you what's your opinion about nsrwatch enhancements made in nw8.2sp3 -> I've read it somewhere that the goal was to implement many NMC functions, like 'labelling media' .etc..
Unfortunately as I know many networker modules needs 'dangerous' networker privileges and this way many technical users on various systems have pretty strong nsr privileges. I really don't want to give a 'monitoring' tool to all my users where day can easily destroy all of our backups with a few 'clicks'.
Maybe I totally misunderstood NetWorker security concepts and I gave too much privileges to technical accounts on the machines - or the developers didn't cared about the security again.. but this time it will cause a lots of problems to me (I'll rebuild *nix install packages to remove nsrwatch from them if it's really the way how it works..)
What do you think about that?
Regards,
Istvan
ble1
2 Intern
2 Intern
•
14.3K Posts
0
April 23rd, 2016 12:00
I like it. As for permissions, nothing changed there. Anyone could have run in the past nsrwatch from client and monitor server (or at least its own sessions). Same applies now. Whether you can start the groups depends on higher set of permissions (same as for NMC). Same goes for device management.
ble1
2 Intern
2 Intern
•
14.3K Posts
0
April 23rd, 2016 15:00
For NMM you might need admin user only if using snapshot management so that powersnap module may take care of ssid deletion for snaps. If using pure RMAN then that is not the case and having oracle user in DB admin/operator group is enough. I can think of other ways user can destroy their backups as well in older versions too (like by using nsrmm from client if permission sets allows them) and normally I have never ever seen that happening so I do not loose my sleep over nsrwatch neither (especially since on Windows system if I had to grant admin access I would grant it to SYSTEM user and it case of misuse there is always a way to correlate the logs). I do not see any harm in extending nsrwatch functionality that would give users more power than they have now (think of nsrmm for example which you will also find on clients).
oldhercules
116 Posts
0
April 23rd, 2016 15:00
I know exactly that if something is permitted in a system then simply removing a program (/limiting access to it) which can perform some operations is not a fix for the security hole.
Monitoring is not an issue. We can limit access to NMC - and in NMC users log in with their own user, so they have much less permissions than the 'oracle' user (nmda) or NMM technical user has.
NMM admin guide says eg.: "The NMM client must be manually granted NetWorker administrator privileges to perform
media database operations during snapshot deletion."
So now we give the tool for the users which can be used to destroy all of their backups (re-label DD volumes). And I bet this action won't create a detailed log on the server... I think this is a nightmare