Avamar: Slik administrerer du innstillinger for øktsikkerhet fra CLI

Forhåndskontroller:

• Stopp alle sikkerhetskopieringer, replikering, og kontroller at ingen vedlikehold kjører (sjekkpunkt/hfscheck/søppelhenting).
• Kontroller at det finnes et gyldig sjekkpunkt på Avamar.

Oversikt:

Følgende skript installeres på alle Avamar-rutenett og brukes til å administrere sikkerhetsinnstillingene for økten:

enable_secure_config.sh

Slik viser du gjeldende sikkerhetsinnstillinger for økt:

enable_secure_config.sh --showconfig

Eksempelutdata som viser Sikkerhet for deaktivert økt:

Current Session Security Settings
----------------------------------
"encrypt_server_authenticate"                           ="false"
"secure_agent_feature_on"                               ="false"
"session_ticket_feature_on"                             ="false"
"secure_agents_mode"                                    ="unsecure_only"
"secure_st_mode"                                        ="unsecure_only"
"secure_dd_feature_on"                                  ="false"
"verifypeer"                                            ="no"

Client and Server Communication set to Default (Workflow Re-Run) mode with No Authentication.
Client Agent and Management Server Communication set to unsecure_only mode.
Secure Data Domain Feature is Disabled. 

Eksempel på utdata som viser sikkerhet for én økt med blandet økt:

Current Session Security Settings
----------------------------------
"encrypt_server_authenticate"                           ="true"
"secure_agent_feature_on"                               ="true"
"session_ticket_feature_on"                             ="true"
"secure_agents_mode"                                    ="mixed"
"secure_st_mode"                                        ="mixed"
"secure_dd_feature_on"                                  ="true"
"verifypeer"                                            ="no"

Client and Server Communication set to Mixed mode with One-Way/Single Authentication.
Client Agent and Management Server Communication set to mixed mode.
Secure Data Domain Feature is Enabled.

Eksempel på utdata som viser sikkerhet for én enkelt økt som er godkjent:

Current Session Security Settings
----------------------------------
"encrypt_server_authenticate"                           ="true"
"secure_agent_feature_on"                               ="true"
"session_ticket_feature_on"                             ="true"
"secure_agents_mode"                                    ="secure_only"
"secure_st_mode"                                        ="secure_only"
"secure_dd_feature_on"                                  ="true"
"verifypeer"                                            ="no"

Client and Server Communication set to Authenticated mode with One-Way/Single Authentication.
Client Agent and Management Server Communication set to secure_only mode.
Secure Data Domain Feature is Enabled.

Eksempel på utdata som viser sikkerhet for godkjent og to økter:

Current Session Security Settings
----------------------------------
"encrypt_server_authenticate"                           ="true"
"secure_agent_feature_on"                               ="true"
"session_ticket_feature_on"                             ="true"
"secure_agents_mode"                                    ="secure_only"
"secure_st_mode"                                        ="secure_only"
"secure_dd_feature_on"                                  ="true"
"verifypeer"                                            ="yes"

Client and Server Communication set to Authenticated mode with Two-Way/Dual Authentication.
Client Agent and Management Server Communication set to secure_only mode.
Secure Data Domain Feature is Enabled. 

Slik endrer du sikkerhetsinnstillingene for økten:

Hvis du vil angi at sikkerhetsinnstillingene for økt skal være deaktivert, kjører du følgende kommando:

enable_secure_config.sh --enable-all --undo

Eksempel på utdata:

#########################  #########################
#########################  #########################
Disabling Avamar Security Features
Editing /usr/local/avamar/var/mc/server_data/prefs/mcserver.xml
Restart MCS for security features changes to take effect.
INFO: Administrator Server ping successful.
Setting Mutual server/client authentication
Editing /usr/local/avamar/var/mc/server_data/prefs/mcserver.xml

Done 

Hvis du vil angi sikkerhetsinnstillingene for økt til Mixed-Single, kjører du følgende to kommandoer:

enable_secure_config.sh --enable-all

Eksempel på utdata:

#########################  #########################
#########################  #########################
Enabling Avamar Security Features

Editing /usr/local/avamar/var/mc/server_data/prefs/mcserver.xml
Restart MCS for security features changes to take effect.
INFO: Administrator Server ping successful.
Setting Mutual server/client authentication
Editing /usr/local/avamar/var/mc/server_data/prefs/mcserver.xml

Done

avmaint config --ava verifypeer=no

Eksempel på utdata:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<gsanconfig verifypeer="yes"/>

Hvis du vil angi sikkerhetsinnstillingene for økt til Godkjent singel, kjører du følgende to kommandoer:

enable_secure_config.sh --enable-secure-all

Eksempel på utdata:

#########################  #########################
#########################  #########################
Enabling Avamar Security Features

Editing /usr/local/avamar/var/mc/server_data/prefs/mcserver.xml
Restart MCS for security features changes to take effect.
INFO: Administrator Server ping successful.
Setting Mutual server/client authentication
Editing /usr/local/avamar/var/mc/server_data/prefs/mcserver.xml

Done

avmaint config --ava verifypeer=no

Eksempel på utdata:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<gsanconfig verifypeer="yes"/>

Hvis du vil angi sikkerhetsinnstillingene for økten til Authenticated-Dual, kjører du følgende kommando:

enable_secure_config.sh --enable-secure-all

Eksempel på utdata:

#########################  #########################
#########################  #########################
Enabling Avamar Security Features

Editing /usr/local/avamar/var/mc/server_data/prefs/mcserver.xml
Restart MCS for security features changes to take effect.
INFO: Administrator Server ping successful.
Setting Mutual server/client authentication
Editing /usr/local/avamar/var/mc/server_data/prefs/mcserver.xml

Done