# 创建角色
# bprdadmin -AddRole -role BackupAdmin -description “Backup Administrator”

# 将用户添加到角色
# bprdadmin -AddUserToRole -role BackupAdmin -user admin

# 查看角色
# bprdadmin -ListRoles

# 示例输出
Role Name: BackupAdmin
Description: Backup Administrator
Users: admin

# 查看用户权限
# bprdadmin -ListUsers

# 示例输出
User Name: admin
Type: ADMIN
Roles: BackupAdmin

# 添加以下配置
USE_VXSS = YES
SECURITY_LEVEL = HIGH
AUTHENTICATION_DOMAIN = NBU

# 重启NBU服务
# systemctl restart netbackup

# 验证安全配置
# bpgetconfig | grep -i security

# 示例输出
SECURITY_LEVEL = HIGH
USE_VXSS = YES
AUTHENTICATION_DOMAIN = NBU

# 查看加密配置
# bpclient -client client01 -L | grep -i encryption

# 示例输出
Encryption: yes
Encryption Type: AES-256

# 启用策略加密
# bpplinfo Full_Backup -modify -encrypt 1

# 查看策略加密配置
# bpplinfo Full_Backup -L | grep -i encrypt

# 示例输出
Client Encrypt: yes

# 查看加密密钥状态
# nbkeysync -list

# 示例输出
Key Server: master-server
Key Type: master
Status: ACTIVE
Last Sync: 04/01/2026 10:00:00

# 配置审计日志位置
# bpsetconfig -h master-server -s “AUDIT_FILE_PATH = /usr/openv/netbackup/logs/audit”

# 查看审计日志配置
# bpgetconfig | grep -i audit

# 示例输出
AUDIT_FILE_ENABLED = YES
AUDIT_FILE_PATH = /usr/openv/netbackup/logs/audit

# 查看审计日志内容
# tail -f /usr/openv/netbackup/logs/audit/audit.log

# 示例输出
2026-04-01 10:00:00 -0400 AUDIT: User admin (admin) performed action CREATE on object POLICY (Test_Policy) from host 192.168.1.10
2026-04-01 10:05:00 -0400 AUDIT: User admin (admin) performed action MODIFY on object SCHEDULE (Full) from host 192.168.1.10
2026-04-01 10:10:00 -0400 AUDIT: User admin (admin) performed action RUN on object JOB (1234) from host 192.168.1.10

# 添加以下配置
CLIENT_LIST = 192.168.1.0/24
SERVER = master-server
MEDIA_SERVER = media01

# 配置网络加密
# bpsetconfig -h master-server -s “SECURE_COMMUNICATIONS = REQUIRED”

# 查看网络安全配置
# bpgetconfig | grep -i secure

# 示例输出
SECURE_COMMUNICATIONS = REQUIRED

# 配置防火墙规则
# firewall-cmd –permanent –add-port=1556/tcp
# firewall-cmd –permanent –add-port=13782/tcp
# firewall-cmd –reload

# 查看防火墙规则
# firewall-cmd –list-ports

# 示例输出
1556/tcp 13782/tcp

#!/bin/bash
# NBU备份防病毒扫描脚本

LOG_FILE=”/var/log/nbu_antivirus.log”
SCAN_DIR=”/backup”

# 扫描备份目录
echo “[$(date +’%Y-%m-%d %H:%M:%S’)] 开始扫描备份目录” >> $LOG_FILE

# 使用ClamAV扫描
clamscan -r $SCAN_DIR >> $LOG_FILE

# 检查扫描结果
if grep -q “Infected files: 0” $LOG_FILE; then
echo “[$(date +’%Y-%m-%d %H:%M:%S’)] 扫描完成，未发现病毒” >> $LOG_FILE
else
echo “[$(date +’%Y-%m-%d %H:%M:%S’)] 扫描完成，发现病毒！” >> $LOG_FILE
# 发送告警
bpemail -s “NBU Backup Virus Alert” -m “Virus detected in backup directory” -t admin@fgedu.net.cn
fi

# 设置执行权限
# chmod +x /usr/local/bin/nbu_antivirus_scan.sh

# 添加到计划任务
# crontab -e

# 每天扫描一次
0 1 * * * /usr/local/bin/nbu_antivirus_scan.sh > /dev/null 2>&1

# 备份NBU数据库
# nbdb_backup -online -destination /backup

# 加密备份文件
# openssl enc -aes-256-cbc -salt -in /backup/nbu_config_$(date +’%Y%m%d’).tar.gz -out /backup/nbu_config_$(date +’%Y%m%d’).tar.gz.enc -k “P@ssw0rd”

# 验证加密文件
# ls -la /backup/

# 示例输出
total 102400
-rw-r–r– 1 root root 51200000 Apr 1 11:00 nbu_config_20260401.tar.gz
-rw-r–r– 1 root root 51200000 Apr 1 11:05 nbu_config_20260401.tar.gz.enc
-rw-r–r– 1 root root 10240000 Apr 1 11:10 nbdb_backup_20260401.tar

# 将加密备份文件复制到异地存储
# scp /backup/nbu_config_$(date +’%Y%m%d’).tar.gz.enc root@dr-server:/backup/

#!/bin/bash
# NBU合规性报告脚本

REPORT_DIR=”/var/reports/nbu”
REPORT_FILE=”$REPORT_DIR/compliance_report_$(date +’%Y%m%d’).html”

# 创建报告目录
mkdir -p $REPORT_DIR

# 生成HTML报告
cat > $REPORT_FILE << EOF

NBU Compliance Report – $(date +’%Y-%m-%d’)

安全配置检查

EOF

# 检查访问控制
ACCESS_CONTROL=$(bpgetconfig | grep -i “SECURITY_LEVEL” | awk ‘{print $3}’)
if [ “$ACCESS_CONTROL” == “HIGH” ]; then
ACCESS_STATUS=”Compliant”
ACCESS_CLASS=”class=\”compliant\””
else
ACCESS_STATUS=”Non-Compliant”
ACCESS_CLASS=”class=\”non-compliant\””
fi

cat >> $REPORT_FILE << EOF

EOF

# 检查数据加密
ENCRYPTION=$(bpclient -client client01 -L | grep -i “Encryption” | awk ‘{print $2}’)
if [ “$ENCRYPTION” == “yes” ]; then
ENCRYPT_STATUS=”Compliant”
ENCRYPT_CLASS=”class=\”compliant\””
else
ENCRYPT_STATUS=”Non-Compliant”
ENCRYPT_CLASS=”class=\”non-compliant\””
fi

cat >> $REPORT_FILE << EOF

EOF

# 检查审计日志
AUDIT=$(bpgetconfig | grep -i “AUDIT_FILE_ENABLED” | awk ‘{print $3}’)
if [ “$AUDIT” == “YES” ]; then
AUDIT_STATUS=”Compliant”
AUDIT_CLASS=”class=\”compliant\””
else
AUDIT_STATUS=”Non-Compliant”
AUDIT_CLASS=”class=\”non-compliant\””
fi

cat >> $REPORT_FILE << EOF

EOF

cat >> $REPORT_FILE << EOF

EOF

# 发送合规性报告
bpemail -s “NBU Compliance Report – $(date +’%Y-%m-%d’)” -m “Please find the attached NBU compliance report.” -t admin@fgedu.net.cn -a $REPORT_FILE

echo “[$(date +’%Y-%m-%d %H:%M:%S’)] 合规性报告已生成并发送” >> /var/log/nbu_compliance.log

# 设置执行权限
# chmod +x /usr/local/bin/nbu_compliance_report.sh

# 添加到计划任务
# crontab -e

# 每月生成一次报告
0 0 1 * * /usr/local/bin/nbu_compliance_report.sh > /dev/null 2>&1

#!/bin/bash
# NBU安全审计脚本

LOG_FILE=”/var/log/nbu_security_audit.log”

# 开始审计
echo “[$(date +’%Y-%m-%d %H:%M:%S’)] 开始NBU安全审计” >> $LOG_FILE

# 检查安全配置
echo “[$(date +’%Y-%m-%d %H:%M:%S’)] 检查安全配置” >> $LOG_FILE
bpgetconfig | grep -i security >> $LOG_FILE

# 检查用户权限
echo “[$(date +’%Y-%m-%d %H:%M:%S’)] 检查用户权限” >> $LOG_FILE
bprdadmin -ListUsers >> $LOG_FILE

# 检查备份策略安全设置
echo “[$(date +’%Y-%m-%d %H:%M:%S’)] 检查备份策略安全设置” >> $LOG_FILE
bpplinfo -l | grep -i encrypt >> $LOG_FILE

# 检查存储单元安全设置
echo “[$(date +’%Y-%m-%d %H:%M:%S’)] 检查存储单元安全设置” >> $LOG_FILE
nbdevconfig -liststu -U >> $LOG_FILE

# 检查审计日志配置
echo “[$(date +’%Y-%m-%d %H:%M:%S’)] 检查审计日志配置” >> $LOG_FILE
bpgetconfig | grep -i audit >> $LOG_FILE

# 完成审计
echo “[$(date +’%Y-%m-%d %H:%M:%S’)] NBU安全审计完成” >> $LOG_FILE

# 发送审计报告
bpemail -s “NBU Security Audit Report – $(date +’%Y-%m-%d’)” -m “Please find the attached NBU security audit report.” -t admin@fgedu.net.cn -a $LOG_FILE

# 设置执行权限
# chmod +x /usr/local/bin/nbu_security_audit.sh

# 添加到计划任务
# crontab -e

# 每季度执行一次审计
0 0 1 1,4,7,10 * /usr/local/bin/nbu_security_audit.sh > /dev/null 2>&1

# 1. 定期更新NBU版本
# 检查可用的安全补丁
# 访问Veritas官方网站查看最新安全补丁

# 2. 实施最小权限原则
# 只授予用户必要的权限
# bprdadmin -AddRole -role BackupOperator -description “Backup Operator”
# bprdadmin -AddUserToRole -role BackupOperator -user operator

# 3. 定期更改密码
# bpnbat -ChangePassword -login admin -oldpassword “OldP@ssw0rd” -newpassword “NewP@ssw0rd”

# 4. 启用多因素认证
# 配置RADIUS认证
# bpsetconfig -h master-server -s “RADIUS_SERVER = radius-server”
# bpsetconfig -h master-server -s “RADIUS_SECRET = secret”

# 5. 定期备份安全配置
# tar -cvzf /backup/nbu_security_config_$(date +’%Y%m%d’).tar.gz /usr/openv/netbackup/bp.conf /usr/openv/netbackup/db/security

# 6. 实施网络分段
# 配置备份网络VLAN
# 192.168.2.0/24 专门用于备份流量

# 7. 定期安全培训
# 对NBU管理员进行安全培训，提高安全意识

# 8. 制定安全应急计划
# 创建安全事件响应流程
# 定期演练安全事件响应