- Notes, cautions, and warnings
- Preface
- Introduction
- Security Quick Reference
- Product and Subsystem Security
- Authentication
- Login security settings
- User and credential management
- Updating the SSL security certificate
- Authentication to external systems
- Authorization
- RBAC privileges
- Network security
- Data security settings
- Cryptography
- Electromagnetic Radiation Isolation
- Auditing access
- Syslog logging
- Alerting
- Serviceability
- Log management
- Manual Cyber Recovery vault security
- Miscellaneous Configuration and Management
Dell PowerProtect Cyber Recovery 19.14 Security Configuration Guide
Enabling or disabling mandatory access control
Before you install the Cyber Recovery software and the Docker components, ensure that mandatory access control settings are configured appropriately for your environment.
About this task
For a Cyber Recovery software installation, we recommend using SELinux as the Linux Security Module for added operating system security. Because SELinux provides granular access control, be careful when configuring security contexts for Cyber Recovery files and directories. Use of SELinux does not apply to a Cyber Recovery virtual appliance deployment.
By default, the AppArmor application is installed in a Cyber Recovery virtual appliance deployment as mandatory access control mechanism. The Cyber Recovery software applies a customized AppArmor policy to the Cyber Recovery Docker container services to provide compatibility and added security benefits.
Steps
- Log in to the Cyber Recovery host in the Cyber Recovery vault.
- For a Cyber Recovery software installation only, enable SELinux.
- Install the Docker components.
- Install the Cyber Recovery software (see the Dell PowerProtect Cyber Recovery Installation Guide).
-
In an SELinux environment, if the
Cyber Recovery software does not start after a reboot due to unlabeled context type and custom policies, do the following:
-
Change the SELinux context:
chcon -u system_u -t bin_t /opt/dellemc/cr/bin/cradmin chcon -u system_u -t bin_t /opt/dellemc/cr/bin/crcli chcon -u system_u -t bin_t /opt/dellemc/cr/bin/crsetup.sh
-
Reboot the system.
The following is an example of the SELinux context:
root@hostname $ ls -Z /opt/dellemc/cr/bin/ -rwxr-----. root root system_u:object_r:bin_t:s0 cradmin -rwxr-----. root root system_u:object_r:bin_t:s0 crcli -rwxr-----. root root system_u:object_r:bin_t:s0 crsetup.sh
-
Change the SELinux context:
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\