> Software > Manage > Infrastructure > MediaAgents > Ransomware Protection for Disk Libraries on a Linux MediaAgent

Configuring Ransomware Protection for a Linux MediaAgent

You can configure ransomware protection on a Linux MediaAgent to protect disk libraries from unauthorized modifications.

Ransomware protection uses SELinux policies to restrict unauthorized access to protected storage. Enabling protection requires a restart of the MediaAgent when you configure it for the first time.

Note

Ransomware protection doesn't protect the deduplication database (DDB), metadata drives, or Index Cache.

Requirements

Review the following requirements before enabling ransomware protection:

  • Review the System requirements for ransomware protection and Considerations for ransomware protection.

  • If the Commvault software is installed on a mount point, the mount point must not use the nosuid option. Using nosuid can prevent Commvault services from starting correctly, or from starting at all, when SELinux is in Enforcing mode.

  • If disk libraries or mount paths are already mounted on the MediaAgent, back up the /etc/fstab file by running the following command:

    cp /etc/fstab /etc/fstab.backupfile

  • Identify the instance ID of the MediaAgent by running the following command:

    commvault status

    Record the instance ID, such as Instance001, for use in the ransomware protection commands.

  • Place the MediaAgent in maintenance mode because the configuration requires a reboot and unmounting and mounting disk libraries. For instructions, see Put a MediaAgent into maintenance mode.

  • If the MediaAgent is also a client computer, verify that no backup or restore operations are running.

  • If the MediaAgent runs Ubuntu, disable AppArmor before configuring ransomware protection. Use the instructions in the following section for your Ubuntu version.

Disable AppArmor on Ubuntu

If the MediaAgent runs Ubuntu, disable AppArmor before enabling ransomware protection.

The procedure differs depending on the Ubuntu version. Select the applicable environment.

Stop and disable the AppArmor service by running the following commands:

systemctl stop apparmor.service
systemctl disable apparmor.service

On Ubuntu 24.04 and later, stopping and disabling the AppArmor service doesn't permanently disable AppArmor. To disable AppArmor across reboots, configure the GRUB kernel parameter.

  1. Open /etc/default/grub in a text editor with root privileges:

    sudo nano /etc/default/grub

  2. Locate the GRUB_CMDLINE_LINUX parameter and include apparmor=0 in its value.

    For example:

    GRUB_CMDLINE_LINUX="apparmor=0"

    If GRUB_CMDLINE_LINUX already contains other parameters, retain the existing parameters and append apparmor=0.

  3. Update the GRUB boot configuration:

    sudo update-grub

  4. Reboot the MediaAgent to apply the change:

    sudo reboot

Enable ransomware protection

After completing the requirements and, if applicable, disabling AppArmor, enable ransomware protection on the Linux MediaAgent.

  1. Log on to the MediaAgent.

  2. Stop the Commvault services.

  3. If the MediaAgent runs a RHEL or CentOS 8.x kernel, install Python 3.x if it isn't already installed.

    Run the following command to create a symbolic link to Python 3:

    ln -s /usr/bin/python3 /usr/bin/python

  4. Go to the following directory:

    /opt/commvault/MediaAgent64

  5. Run the following command to enable ransomware protection:

    ./cvsecurity.py enable_protection -i $[InstanceID]

    Replace InstanceID with the instance ID of the MediaAgent. For example, Instance001.

  6. Reboot the MediaAgent for ransomware protection to take effect.

    Note

    This reboot is required only when you enable ransomware protection for the first time.

  7. After the MediaAgent restarts successfully, go to the following directory:

    /opt/commvault/MediaAgent64

  8. Run the following command to load the Commvault SELinux policy and restart the Commvault services:

    ./cvsecurity.py restart_cv_services -i $[InstanceID]

    Replace InstanceID with the instance ID of the MediaAgent.

  9. Remove the MediaAgent from maintenance mode.

    For instructions, see Put a MediaAgent into maintenance mode.

Expected behavior

After you enable ransomware protection, the following behavior applies:

  • Any new library that you create using local or external disk storage is automatically protected from ransomware.

  • If you create a shared disk library with a mount path on an NFS share, you must configure ransomware protection separately for that library.

    For instructions, see Configure ransomware protection for a disk library on an NFS share.

  • The DDB, metadata drives, and Index Cache remain outside the scope of ransomware protection.

Verify ransomware protection

The software records ransomware protection activities and unauthorized access attempts in the following log files:

Log file Description
/var/log/commvault/Log_Files/cvsecurity.log Records ransomware protection configuration and related activities.
/var/log/commvault/Log_Files/audit/audit.log Records unauthorized activities detected by the system.
×

Loading...