[ Applies to ] StorageGuard / Cohesity (Veritas) NetBackup / Data Protection (Backup)
This article lists the recommended baseline checks for Cohesity (Veritas) NetBackup. Core6 updates the list periodically as new StorageGuard checks become available.
In this article
Overview
NetBackup, now part of Cohesity, is an enterprise backup and recovery suite. It protects physical, virtual and cloud workloads through a primary server, media servers, NetBackup Appliances and Flex Appliances.
Why hardening Cohesity (Veritas) NetBackup matters
Backup infrastructure is a prime ransomware target: attackers who control NetBackup can delete or encrypt recovery points. Hardening authentication, certificates, immutability, multi-person authorization and management access ensures backups remain available when you need them.
Recommended baseline checks
The baseline below contains 271 checks, listed alphabetically.
| ID | Configuration check | Component |
|---|---|---|
| SG-F2265T217V01 | 3-2-1 backup rule compliance | NetBackup |
| SG-M6719T217V01 | 3-2-1 rule | NetBackup |
| SG-C0207T217V01 | Absolute session timeout - CLI | NetBackup |
| SG-M8408T217V01 | Account lockout duration | NetBackup |
| SG-C0393T217V01 | Account lockout threshold | NetBackup |
| SG-M8542T217V01 | Active backup policy | NetBackup |
| SG-F1726T217V01 | Active catalog backup policy | NetBackup |
| SG-F7981T217V01 | AD/LDAP SSL | NetBackup |
| SG-C0214T217V01 | Admin authority level | NetBackup |
| SG-M2241T217V01 | Air-gapped backup | NetBackup |
| SG-M4905T217V01 | Anomaly detection configuration | NetBackup |
| SG-F2408T217V01 | Anomaly detection status | NetBackup |
| SG-M1027T217V01 | Appliance local user password expiration configuration | NetBackup |
| SG-M1531T217V01 | Appliance to Appliance IPsec config | NetBackup |
| SG-M5477T217V01 | Approved admin users / groups | NetBackup |
| SG-M8864T217V01 | Approved Admin/AMSadmin/NetBackupCLI users/groups | NetBackup |
| SG-C0238T217V01 | Approved CAC PIV domain name | NetBackup |
| SG-M1014T217V01 | Approved Certificate Authority (CA) server | NetBackup |
| SG-C0449T234V01 | Approved DNS servers | Flex Appliance |
| SG-C0449T217V01 | Approved DNS servers | NetBackup |
| SG-C0449T234V02 | Approved DNS servers (instance) | Flex Appliance |
| SG-F2227T217V01 | Approved HTTPS allowlist | NetBackup |
| SG-C0437T217V01 | Approved identity provider servers | NetBackup |
| SG-M6549T217V01 | Approved Java console users | NetBackup |
| SG-C0044T217V01 | Approved KMS server | NetBackup |
| SG-C0435T217V01 | Approved LDAP servers | NetBackup |
| SG-C0013T234V01 | Approved NTP servers | Flex Appliance |
| SG-C0013T217V01 | Approved NTP servers | NetBackup |
| SG-C0013T261V01 | Approved NTP servers | NetBackup Appliance |
| SG-M9872T217V01 | Approved OCSP URI | NetBackup |
| SG-C0312T217V01 | Approved smart card application URI | NetBackup |
| SG-C0400T217V01 | Approved SMTP recipients | NetBackup |
| SG-C0406T217V01 | Approved SMTP server | NetBackup |
| SG-C0314T234V01 | Approved SMTP user | Flex Appliance |
| SG-F4797T217V01 | Approved SSH allowlist | NetBackup |
| SG-C0015T234V01 | Approved Syslog servers | Flex Appliance |
| SG-C0015T261V01 | Approved Syslog servers | NetBackup Appliance |
| SG-C0317T217V01 | Approved trusted master servers | NetBackup |
| SG-C0333T217V01 | Approved user roles | NetBackup |
| SG-C0316T217V01 | Approved WebSocket server | NetBackup |
| SG-M8551T217V01 | Authentication server redundancy(if used) | NetBackup |
| SG-C0165T217V01 | Authorization policy status | NetBackup |
| SG-F1286T217V01 | Automatic host alias mapping | NetBackup |
| SG-C0063T217V01 | Backup image encryption | NetBackup |
| SG-F7529T217V01 | Backup immutability (WORM) | NetBackup |
| SG-C0018T217V01 | Backup software version consistency | NetBackup |
| SG-M9743T217V01 | Call Home enabled | NetBackup |
| SG-M2293T217V01 | Call Home proxy server | NetBackup |
| SG-M4947T217V01 | Call home proxy tunneling configuration | NetBackup |
| SG-M6436T217V01 | Catalog backup | NetBackup |
| SG-F4361T217V01 | Catalog backup to air-gapped storage | NetBackup |
| SG-C0029T234V01 | Centralized log server | Flex Appliance |
| SG-C0443T217V01 | Certificate authority level | NetBackup |
| SG-C0055T217V01 | Certificate autodeploy level | NetBackup |
| SG-C0235T217V01 | Certificate key size | NetBackup |
| SG-M8083T217V01 | Certificate revocation | NetBackup |
| SG-M6729T217V01 | CIFS share authentication | NetBackup |
| SG-M1407T217V01 | Cipher suite strength | NetBackup |
| SG-M4182T217V01 | CLI access configuration | NetBackup |
| SG-C0006T217V01 | CLI access to OS admins | NetBackup |
| SG-M6581T217V01 | CLI session timeout | NetBackup |
| SG-C0076T217V01 | Client backup encryption (policy) | NetBackup |
| SG-M8089T217V01 | Communication with insecure hosts | NetBackup |
| SG-M9952T217V01 | Data in transit encryption | NetBackup |
| SG-C0080T217V01 | Data in-transit encryption - DTE mode | NetBackup |
| SG-C0097T234V01 | Data retention mode | Flex Appliance |
| SG-M9600T217V01 | Deduplication encryption | NetBackup |
| SG-M6841T217V01 | Deduplication pool catalog backup policy | NetBackup |
| SG-F6571T217V01 | Default maintenance user password | NetBackup |
| SG-F6940T217V01 | Default nbasecadmin password | NetBackup |
| SG-M8173T217V01 | Default passwords | NetBackup |
| SG-F8978T217V01 | Default passwords (appliance admin, maintenance and IPMI users) | NetBackup |
| SG-M4817T217V01 | Display Login Banner | NetBackup |
| SG-C0243T234V01 | DNS server configuration | Flex Appliance |
| SG-C0243T217V01 | DNS server configuration | NetBackup |
| SG-C0243T234V02 | DNS server configuration (instance) | Flex Appliance |
| SG-C0060T234V01 | DNS server redundancy | Flex Appliance |
| SG-C0060T217V01 | DNS server redundancy | NetBackup |
| SG-C0060T261V01 | DNS server redundancy | NetBackup Appliance |
| SG-F2571T217V01 | DNS server redundancy (Flex Appliance instance) | NetBackup |
| SG-C0060T234V02 | DNS server redundancy (instance) | Flex Appliance |
| SG-M9825T217V01 | DNS service status | NetBackup |
| SG-M1206T217V01 | Email Proxy server auth (NTLM) | NetBackup |
| SG-C0602T217V01 | End of extended support | NetBackup |
| SG-C0601T217V01 | End of security updates | NetBackup |
| SG-C0600T217V01 | End of support | NetBackup |
| SG-C0083T217V01 | Enforce secure host connection - allowed | NetBackup |
| SG-C0083T217V02 | Enforce secure host connection - enabled | NetBackup |
| SG-C0162T217V01 | Expired SSL certificate | NetBackup |
| SG-C0162T261V01 | Expired SSL certificate | NetBackup Appliance |
| SG-C0046T217V01 | FIPS enabled KMS | NetBackup |
| SG-C0177T217V01 | FIPS mode status | NetBackup |
| SG-C0177T261V01 | FIPS mode status | NetBackup Appliance |
| SG-M8123T217V01 | FIPS status | NetBackup |
| SG-C0602T217V02 | Future end of extended support | NetBackup |
| SG-C0601T217V02 | Future end of security updates | NetBackup |
| SG-C0600T217V02 | Future end of support | NetBackup |
| SG-F9900T217V01 | HTTPS allowlist restricted | NetBackup |
| SG-M4809T217V01 | Identity Provider redundancy (if used) | NetBackup |
| SG-M7493T217V01 | Idle session timeout | NetBackup |
| SG-C0165T234V01 | Instance deletion MPA | Flex Appliance |
| SG-M7506T217V01 | Intrusion detection system (IDS) status | NetBackup |
| SG-M5041T217V01 | Intrusion prevention system (IPS) status | NetBackup |
| SG-F1637T217V01 | IPMI accounts with empty user names or passwords | NetBackup |
| SG-F1976T217V01 | IPMI ACL | NetBackup |
| SG-F6886T217V01 | IPMI anonymous user privileges | NetBackup |
| SG-F4551T217V01 | IPMI anonymous users disabled | NetBackup |
| SG-F8914T217V01 | IPMI Failed login attempts | NetBackup |
| SG-F7840T217V01 | IPMI HTTPS | NetBackup |
| SG-F2384T217V01 | IPMI static IP (not DHCP) | NetBackup |
| SG-F1792T217V01 | IPMI user lockout time | NetBackup |
| SG-F9284T217V01 | IPMI Web Session Timeout | NetBackup |
| SG-M9015T217V01 | KMS redundancy | NetBackup |
| SG-C0052T217V01 | KMS server redundancy | NetBackup |
| SG-M3034T217V01 | Last backup | NetBackup |
| SG-C0039T217V01 | LDAP server configuration | NetBackup |
| SG-C0025T217V01 | LDAP server redundancy | NetBackup |
| SG-F7797T217V01 | LDAP StartTLS | NetBackup |
| SG-C0041T234V01 | Local identity provider status | Flex Appliance |
| SG-C0050T217V01 | Local KMS server used | NetBackup |
| SG-M4567T217V01 | Lockdown mode | NetBackup |
| SG-M1752T217V01 | Lockdown retention settings | NetBackup |
| SG-C0169T217V01 | Lockout enforcement for admin | NetBackup |
| SG-M6353T217V01 | Log forwarding enabled | NetBackup |
| SG-M9235T217V01 | Log forwarding over TCP | NetBackup |
| SG-F3455T217V01 | Log forwarding security | NetBackup |
| SG-M4855T217V01 | Log forwarding TLS | NetBackup |
| SG-F5658T217V01 | Login banner (NetBackup hosts) | NetBackup |
| SG-C0427T234V01 | Login banner message | Flex Appliance |
| SG-C0427T261V01 | Login banner message | NetBackup Appliance |
| SG-C0426T234V01 | Login banner status | Flex Appliance |
| SG-C0426T261V01 | Login banner status | NetBackup Appliance |
| SG-M5952T217V01 | Malware scan configuration | NetBackup |
| SG-M3747T217V01 | Master security level | NetBackup |
| SG-C0468T217V01 | Maximum concurrent sessions | NetBackup |
| SG-C0269T234V01 | Maximum number of repeated password characters | Flex Appliance |
| SG-C0234T234V01 | Maximum password age | Flex Appliance |
| SG-C0392T217V01 | Minimum account lockout duration - NetBackup | NetBackup |
| SG-C0471T217V01 | Minimum passphrase digits | NetBackup |
| SG-C0263T217V01 | Minimum passphrase length | NetBackup |
| SG-C0263T261V01 | Minimum passphrase length | NetBackup Appliance |
| SG-C0472T217V01 | Minimum passphrase lowercase characters | NetBackup |
| SG-C0473T217V01 | Minimum passphrase special characters | NetBackup |
| SG-C0474T217V01 | Minimum passphrase uppercase characters | NetBackup |
| SG-C0262T234V01 | Minimum password age | Flex Appliance |
| SG-C0270T234V01 | Minimum password digits | Flex Appliance |
| SG-C0264T234V01 | Minimum password length | Flex Appliance |
| SG-C0271T234V01 | Minimum password lowercase characters | Flex Appliance |
| SG-C0272T234V01 | Minimum password special characters | Flex Appliance |
| SG-C0282T234V01 | Minimum password string change | Flex Appliance |
| SG-C0273T234V01 | Minimum password uppercase characters | Flex Appliance |
| SG-C0239T234V01 | Multi-factor authentication | Flex Appliance |
| SG-C0239T217V01 | Multi-factor authentication | NetBackup |
| SG-F4265T217V01 | Multi-factor authentication coverage (nodes) | NetBackup |
| SG-M2592T217V01 | NBAC status | NetBackup |
| SG-C0337T217V01 | NetBackup access control (NBAC) status | NetBackup |
| SG-F1020T217V01 | NetBackup OpsCenter Audit Trail retention days | NetBackup |
| SG-F2706T217V01 | NetBackup OpsCenter default credentials | NetBackup |
| SG-F7839T217V01 | NetBackup OpsCenter master comm - security level | NetBackup |
| SG-F1747T217V01 | NetBackup OpsCenter permissions on key directories | NetBackup |
| SG-F9992T217V01 | NetBackup OpsCenter session timeout | NetBackup |
| SG-F3299T217V01 | NetBackup OpsCenter SSL cipher strength | NetBackup |
| SG-F1743T217V01 | NetBackup OpsCenter SSL protocol | NetBackup |
| SG-F9491T217V01 | NetBackup OpsCenter SSL status | NetBackup |
| SG-F7985T217V01 | NetBackup OpsCenter TLS level | NetBackup |
| SG-F9969T217V01 | NetBackup OpsCenter transport privacy | NetBackup |
| SG-M4906T217V01 | Netbackup service owner | NetBackup |
| SG-F4098T217V01 | Network Access Control status: HTTPS | NetBackup |
| SG-F8178T217V01 | Network Access Control status: SSH | NetBackup |
| SG-C0230T217V01 | Non-default local admin | NetBackup |
| SG-C0231T217V01 | Non-default local users | NetBackup |
| SG-M2983T217V01 | Not member of a Windows domain | NetBackup |
| SG-C0171T234V01 | NTP server configuration | Flex Appliance |
| SG-C0171T217V01 | NTP server configuration | NetBackup |
| SG-C0432T234V01 | NTP server redundancy | Flex Appliance |
| SG-C0432T217V01 | NTP server redundancy | NetBackup |
| SG-M7595T217V01 | NTP service status | NetBackup |
| SG-M1853T217V01 | Number of copies | NetBackup |
| SG-M2110T217V01 | Off-site copy | NetBackup |
| SG-M2531T217V01 | OPC Audit Trail retention days | NetBackup |
| SG-M8157T217V01 | OPC central authentication | NetBackup |
| SG-M2520T217V01 | OPC central authentication redundancy | NetBackup |
| SG-M4071T217V01 | OPC permission on key directories | NetBackup |
| SG-M5044T217V01 | OPC SNMP authentication | NetBackup |
| SG-M4136T217V01 | OPC SNMP community string | NetBackup |
| SG-M3691T217V01 | OPC SNMP encryption | NetBackup |
| SG-M2993T217V01 | OPC SNMP version | NetBackup |
| SG-M9183T217V01 | OPC SSL Cipher strength | NetBackup |
| SG-M2757T217V01 | OPC SSL Protocol | NetBackup |
| SG-M9501T217V01 | OPC SSL status | NetBackup |
| SG-M7247T217V01 | OPC transport privacy | NetBackup |
| SG-M8011T217V01 | Oracle backup and recovery: share anonymous UID/GID | NetBackup |
| SG-M5453T217V01 | Oracle backup and recovery: share client root squash | NetBackup |
| SG-M8009T217V01 | Oracle backup and recovery: share client secure option | NetBackup |
| SG-M9700T217V01 | OS admin scope | NetBackup |
| SG-M4348T217V01 | Password char repeat | NetBackup |
| SG-C0284T234V01 | Password history | Flex Appliance |
| SG-M2045T217V01 | Password reuse | NetBackup |
| SG-M7617T217V01 | Policy attributes | NetBackup |
| SG-M4374T217V01 | Product Improvement Program status | NetBackup |
| SG-C0138T234V01 | Remote support status | Flex Appliance |
| SG-M8246T217V01 | Replication configuration | NetBackup |
| SG-C0721T217V01 | Required CAC PIV domain name | NetBackup |
| SG-C0446T217V01 | Required certificate authority (CA) servers | NetBackup |
| SG-C0450T234V01 | Required DNS servers | Flex Appliance |
| SG-C0450T217V01 | Required DNS servers | NetBackup |
| SG-C0450T234V02 | Required DNS servers (instance) | Flex Appliance |
| SG-C0164T234V02 | Required domain name (instance) | Flex Appliance |
| SG-C0441T217V01 | Required identity provider servers | NetBackup |
| SG-C0051T217V01 | Required KMS server | NetBackup |
| SG-C0439T217V01 | Required LDAP servers | NetBackup |
| SG-C0014T234V01 | Required NTP servers | Flex Appliance |
| SG-C0014T217V01 | Required NTP servers | NetBackup |
| SG-M6812T217V01 | Required Roles | NetBackup |
| SG-C0246T234V02 | Required search domains (instance) | Flex Appliance |
| SG-C0407T217V01 | Required SMTP servers | NetBackup |
| SG-C0322T217V01 | Required trust relationships | NetBackup |
| SG-C0321T217V01 | Required WebSocket servers | NetBackup |
| SG-M2424T217V01 | Retention configuration | NetBackup |
| SG-M7149T217V01 | RMM KVM Encryption | NetBackup |
| SG-M5745T217V01 | RMM KVM Encryption strength | NetBackup |
| SG-M9635T217V01 | RMM Media Encryption status | NetBackup |
| SG-M7200T217V01 | RMM SSH status | NetBackup |
| SG-M1359T217V01 | SDSC audit log retention | NetBackup |
| SG-M2686T217V01 | Secure host connection | NetBackup |
| SG-M5574T217V01 | Secure host connection enforcement | NetBackup |
| SG-C0447T217V01 | Self-signed certificate | NetBackup |
| SG-C0442T217V01 | Single Sign-On (SSO) status | NetBackup |
| SG-C0241T217V01 | Smart card authentication | NetBackup |
| SG-C0364T234V01 | SMTP security | Flex Appliance |
| SG-C0395T234V01 | SMTP server configuration | Flex Appliance |
| SG-C0395T217V01 | SMTP server configuration | NetBackup |
| SG-C0395T261V01 | SMTP server configuration | NetBackup Appliance |
| SG-M1112T217V01 | SMTP SSL | NetBackup |
| SG-M1164T217V01 | Snapshot backup configuration | NetBackup |
| SG-F4471T217V01 | SNMP auth | NetBackup |
| SG-F8402T217V01 | SNMP auth strength | NetBackup |
| SG-M6244T217V01 | SNMP authentication strength | NetBackup |
| SG-F7977T217V01 | SNMP community (NetBackup OpsCenter) | NetBackup |
| SG-C0058T234V01 | SNMP community default string | Flex Appliance |
| SG-C0058T261V01 | SNMP community default string | NetBackup Appliance |
| SG-M7858T217V01 | SNMP encryption enabled | NetBackup |
| SG-M1907T217V01 | SNMP encryption strength | NetBackup |
| SG-C0155T234V01 | SNMP service disabled | Flex Appliance |
| SG-M7059T217V01 | SNMP version | NetBackup |
| SG-F4134T217V01 | SSH allowlist restricted | NetBackup |
| SG-M8215T217V01 | SSL mode | NetBackup |
| SG-M8614T217V01 | SSO status | NetBackup |
| SG-M4772T217V01 | STIG enabled | NetBackup |
| SG-C0180T234V01 | STIG mode | Flex Appliance |
| SG-M1633T217V01 | Storage / backup management separation | NetBackup |
| SG-M5342T217V01 | Storage Sanity Check | NetBackup |
| SG-C0019T234V02 | Target ddboost plugin version (media servers) | Flex Appliance |
| SG-M3663T217V01 | Target media | NetBackup |
| SG-C0019T234V03 | Target media version | Flex Appliance |
| SG-M5308T217V01 | Target NetBackup version | NetBackup |
| SG-C0019T234V01 | Target OS version | Flex Appliance |
| SG-C0019T217V01 | Target OS version | NetBackup |
| SG-C0005T234V01 | TLS audit logging | Flex Appliance |
| SG-M2660T217V01 | TLS level | NetBackup |
| SG-C0448T217V01 | Trusted certificate-authority (CA) | NetBackup |
| SG-C0116T217V01 | Unapproved admin users | NetBackup |
| SG-F8902T217V01 | Unapproved host name mappings | NetBackup |
| SG-C0115T217V01 | Unapproved Java console users | NetBackup |
| SG-F9088T217V01 | Unapproved Local users | NetBackup |
| SG-M2443T217V01 | Unique credentials | NetBackup |
| SG-M9744T217V01 | Universal share configuration | NetBackup |
| SG-M6570T217V01 | Use of LDAP / AD / Kerberos | NetBackup |
| SG-M6605T217V01 | Use of local users (No AD) | NetBackup |
| SG-C0213T217V01 | Use of secure LDAP | NetBackup |
| SG-M5212T217V01 | WORM configuration | NetBackup |
Related components
A complete baseline also covers the components that manage, connect to or protect Cohesity (Veritas) NetBackup. Review the configuration of:
- NetBackup clients and agents
- NetBackup OpsCenter
- NetBackup plug-ins and the VMware agent
- Target storage (disk, cloud and tape)
Run checks with StorageGuard
Want automated validation? StorageGuard continuously scans Cohesity (Veritas) NetBackup against a baseline and reports misconfigurations, with remediation guidance. Contact us to see it in your environment, or learn more about StorageGuard.
[ Still need help? ]
Our support team is here to help. Submit a request.
Comments
0 comments
Please sign in to leave a comment.