Skip to content

Commit 89b76a2

Browse files
shreyas-agnihotrishreyas-agnihotri
authored
Merge pull request #6 from tlkrinke/master
Add perl example for how to create an Enhanced Auditing admin
2 parents b4d1efe + 7d5bf13 commit 89b76a2

File tree

3 files changed

+235
-0
lines changed

3 files changed

+235
-0
lines changed

‎README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,9 @@ Pre-requisites:
2323
Use the following commands to run the python samples.
2424
- `python -W ignore get_nb_images.py -nbmaster <masterServer> -username <username> -password <password>`
2525
- `python -W ignore get_nb_jobs.py -nbmaster <masterServer> -username <username> -password <password>`
26+
27+
#### Executing the snippets in Perl
28+
Pre-requisites:
29+
- NetBackup 8.1.1 or higher
30+
- See script README for perl requirements and usage
31+

‎snippets/perl/README_makeEAadmin.txt‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
Create API user for NetBackup 8.1.1 using Enhanced Auditing
2+
3+
Compatibility
4+
———————————————————————————————————————————————————
5+
NetBackup 8.1.1 Linux/Unix master server
6+
NetBackup REST API version 1.0
7+
(content type is application/vnd.netbackup+json;version=1.0)
8+
9+
10+
Who is this for?
11+
---------------------------------------------------
12+
NetBackup Administrators
13+
IT Operations Teams
14+
15+
16+
What is This?
17+
---------------------------------------------------
18+
This script is provided as a demonstration of how to create a non-root admin account to be used for the
19+
purpose of invoking the NetBackup REST APIs.
20+
21+
This deomonstration is written as a perl script and uses the perl module “UserAgent” to invoke https
22+
requests to the NetBackup REST APIs.
23+
24+
25+
Setup:
26+
---------------------------------------------------
27+
Perl 5.20.2 or later
28+
29+
PERl modules required
30+
++ LWP::UserAgent
31+
++ JSON
32+
++ HTTP
33+
34+
This utility is written in perl, and is meant to be run directly on the NetBackup master server. The caller of this utility must have sufficient priveleges to execute a NetBackup command line on the Master. Although
35+
it has been developed and tested on RedHat Linux, it should be compatible with any non-windows NetBackup
36+
master server.
37+
38+
This utility can be easily modified to work with NetBackup master servers running on Windows platforms
39+
as well, simply change the path to the necessary command lines and pay attention to the domain types of
40+
the user account you are authenticating which will likely be the windows local host or an Active Directory
41+
account.
42+
43+
44+
Overview:
45+
---------------------------------------------------
46+
This script provides an example of how to login to the NetBackup Rest APIs and get a "token" to be used in
47+
subsequent REST API calls. In this demonstration, the utility creates a new "fictional user" in NetBackup
48+
using the mechanisms described by the "Enhanced Auditing" mechanism in NetBackup. At the time of this writing,
49+
NetBackup 8.1.1 will accept root, local/administrator and any Enhanced Auditing user as a fully-priveleged
50+
REST API user.
51+
52+
Once an administrator is created, the script demonstrates how to "login" to the REST API services and get
53+
a token with 24 hour validity (this is NOT configurable), and then use this token to call other REST APIs.
54+
55+
56+
Outline:
57+
---------------------------------------------------
58+
Setup: First a fictional user is added to "vx domain" using standard NetBackup command lines (bpnbat) for
59+
the purposes of testing. Next, this new fictional user is added to the list of non-root administrators
60+
in the Enhanced Auditing configuration, making this account pseudo root priveleged for the purposes of
61+
NetBackup administration.
62+
63+
APIs: The new administrator user is logged into the REST APIs and recieves a session token. This token is
64+
captured and included in each subsequent API call as the contents of the standard http "Authorization"
65+
header. The Front End Data report is run as an example of this. Finally the user is logged out of
66+
NetBackup REST which ends the session associated with that toekn.
67+
68+
Cleanup: Remove our fictional user from the Enhanced Auditing users list and remove the user account
69+
from the vx domain.
70+
71+

‎snippets/perl/makeEAadmin.pl‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
#!/usr/bin/env perl
2+
3+
use LWP::UserAgent;
4+
use LWP::Protocol::https;
5+
print "LWP::UserAgent: ".LWP::UserAgent->VERSION,"\n";
6+
print "LWP::Protocol::https: ".LWP::Protocol::https->VERSION,"\n";
7+
use JSON;
8+
9+
$ENV{PERL_LWP_SSL_VERIFY_HOSTNAME} = 0;
10+
11+
#
12+
# The token is the key to the NetBackup AuthN/AuthZ scheme. You must login and get a token
13+
# and use this token in your Authorization header for all subsequent requests. Token validity
14+
# is fixed at 24 hours
15+
#
16+
my $token;
17+
18+
#change this as per your host name
19+
$fqdn_hostname = "localhost";
20+
21+
#
22+
# This script will use the "Enhanced Auditing" feature in NetBackup to create a non-root admin
23+
# account in NetBackup. This admin account can then be used to invoke REST API requests.
24+
#
25+
26+
print "\n\n Adding the user\n\n";
27+
system q["/usr/openv/netbackup/bin/bpnbat" -addUser testuser Test1234 vx];
28+
29+
print "Enabling enhanced auditing...\n\n";
30+
system q[echo y|"/usr/openv/netbackup/bin/admincmd/bpnbaz" -SetupExAudit];
31+
32+
print "Granting VxSS user administrator privileges...\n\n";
33+
system q["/usr/openv/netbackup/bin/admincmd/bpnbaz" -AddUser vx:vx:testuser];
34+
35+
print "Add the new user to the EA user list...\n\n";
36+
my $auth_file = '/usr/openv/java/auth.conf';
37+
open(my $fh, '>>', $auth_file) or die "Could not open auth.conf";
38+
say $fh "testuser ADMIN=All JBP=ALL";
39+
close $fh;
40+
41+
print "Restarting services...";
42+
system q["/usr/openv/netbackup/bin/bp.kill_all"];
43+
system q["/usr/openv/netbackup/bin/bp.start_all"];
44+
45+
#
46+
# for the sake of this test, ignore ssl certificate
47+
#
48+
my $ua = LWP::UserAgent->new(
49+
timeout => 500,
50+
ssl_opts => { verify_hostname => 0, SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE },
51+
);
52+
53+
my $token_url = "https://$fqdn_hostname:1556/netbackup/login";
54+
55+
my $req = HTTP::Request->new(POST => $token_url);
56+
$req->header('content-type' => 'application/json');
57+
58+
my $post_data = '{ "domainType": "vx", "domainName": "vx", "userName": "testuser", "password": "Test1234" }';
59+
$req->content($post_data);
60+
61+
print "**************************************************************";
62+
print "\n\n Making Post Request to login to get token \n\n";
63+
my $resp = $ua->request($req);
64+
if ($resp->is_success) {
65+
my $message = decode_json($resp->content);
66+
$token = $message->{"token"};
67+
print "Received token: $token\n";
68+
}
69+
else {
70+
print "HTTP POST error code: ", $resp->code, "\n";
71+
print "HTTP POST error message: ", $resp->message, "\n";
72+
#die; let this fall through to cleanup code
73+
}
74+
75+
#
76+
# Here we use the Front End Data report as an example of how to use the token to invoke a
77+
# REST API request
78+
#
79+
my $url = "https://$fqdn_hostname:1556/netbackup/catalog/frontenddata";
80+
my $catalog_req = HTTP::Request->new(GET => $url);
81+
$catalog_req->header('Authorization' => $token);
82+
83+
my $response = $ua->request($catalog_req);
84+
85+
print "**************************************************************";
86+
print "\n\n Making Get Request to Catalog/FrontendData with token \n\n";
87+
if ($response->is_success) {
88+
print "/Catalog/frontenddata request was succesful \n\n";
89+
90+
$data = decode_json($response->content);
91+
my $pretty = JSON->new->pretty->encode($data);
92+
print "Received data \n$pretty\n\n\n";
93+
}
94+
else {
95+
print "HTTP GET error code: ", $response->code, "\n";
96+
print "HTTP GET error message: ", $response->message, "\n";
97+
#die; let this fall through to cleanup code
98+
}
99+
100+
#
101+
# Another example, list jobs...
102+
#
103+
my $url = "https://$fqdn_hostname:1556/netbackup/admin/jobs";
104+
my $jobs_req = HTTP::Request->new(GET => $url);
105+
$jobs_req->header('Authorization' => $token);
106+
107+
my $response = $ua->request($jobs_req);
108+
109+
print "**************************************************************";
110+
print "\n\n Making Get Request to list all jobs \n\n";
111+
if ($response->is_success) {
112+
print "List jobs request was succesful \n\n";
113+
114+
$data = decode_json($response->content);
115+
my $pretty = JSON->new->pretty->encode($data);
116+
print "Received data \n$pretty\n\n\n";
117+
}
118+
else {
119+
print "HTTP GET error code: ", $response->code, "\n";
120+
print "HTTP GET error message: ", $response->message, "\n";
121+
#die; let this fall through to cleanup code
122+
}
123+
124+
125+
126+
#
127+
# Logging out will cleanup the session and invalidate the token immediately.
128+
# If you do not log out, the session expires after 24 hours.
129+
#
130+
print "**************************************************************";
131+
print "\n\nLogout of the REST APIs and cleanup the session(optional)\n";
132+
133+
my $logout_url = "https://$fqdn_hostname:1556/netbackup/logout";
134+
my $logout_req = HTTP::Request->new(POST => $logout_url);
135+
$logout_req->header('content-type' => $content_type);
136+
$logout_req->header('Authorization' => $token);
137+
138+
my $resp = $ua->request($logout_req);
139+
if ($resp->is_success) {
140+
print "Successfully logged out\n\n";
141+
} else {
142+
print "Failed to logout of the current session\n";
143+
print "HTTP POST error code: ", $resp->code, "\n";
144+
print "HTTP POST error message: ", $resp->message, "\n";
145+
die;
146+
}
147+
148+
149+
print "Revoking the user's administrator privileges...\n\n";
150+
system q["/usr/openv/netbackup/bin/admincmd/bpnbaz" -DelUser vx:vx:testuser];
151+
152+
print "Disabling enhanced auditing...\n\n";
153+
system q[echo y|"/usr/openv/netbackup/bin/admincmd/bpnbaz" -DisableExAudit];
154+
155+
print "\n\n Deleting the user\n\n";
156+
system q["/usr/openv/netbackup/bin/bpnbat" -RemoveUser testuser vx];
157+
158+

0 commit comments

Comments
 (0)