# Considerations for Ransomware Protection

Review the following considerations before you enable ransomware protection for a MediaAgent:

- If any root intrusion occurs in the MediaAgent and modifies the SELinux module configuration, then the module cannot offer protection. For more information, see SELinux documentation from the operating system vendor.

- Ransomware protection can be enabled only on a single instance.

- The following table presents the support for various types of disk libraries.

  Type of Disk Library | New or Existing | Support for Protection
  --- | --- | ---
  Library configured on under a root filesystem directory (“/”) | Existing | Not supported
  Library configured using local or external SAS/SATA disk storage | Existing | Supported
  Library configured using local or external disk storage | New | Supported
  Shared library with the mount path on an NFS share | Existing | Supported You must run protect_disk_library command when you configure ransomware protection on a Linux MediaAgent or a HyperScale MediaAgent.
  Shared library with the mount path on an NFS share | New | Supported Configure ransomware protection for a disk library on an NFS share.
  Library on a HyperScale MediaAgent | Existing | Supported
  Library on a HyperScale MediaAgent | New | Supported
  HPE StoreOnce Catalyst Library | New | N/A

- Ransomware protection is not supported for both new and existing cloud libraries.

- If you want to upgrade or update the kernel or the operating system on the MediaAgent after you enable ransomware protection, you must pause SELinux prior to the operation and then resume SELinux again after the operation is complete.

  - To pause SELinux, complete the following steps:

  - Log on to the MediaAgent computer as a root user.

  - Execute the following command:

        #setenforce 0

  - Open the /etc/selinux/config file, set the value as SELINUX=permissive, and then save the file.

  - To confirm that SELinux is paused successfully, execute the following command:

        #sestatus

  - The output appears as follows:

        SELinux status:                 enabled
        SELinuxfs mount:                /sys/fs/selinux
        SELinux root directory:         /etc/selinux
        Loaded policy name:             default
        Current mode:                   permissive
        Mode from config file:          permissive
        Policy MLS status:              enabled
        Policy deny_unknown status:     allowed
        Memory protection checking:     requested (insecure)
        Max kernel policy version:      33

    You must see that the value for Current mode is set to permissive.

  - To resume SELinux, complete the following steps:

  - Execute the following command:

        #setenforce 1

  - Open the /etc/selinux/config file, set the value as SELINUX=enforcing, and then save the file.

  - To confirm that SELinux is paused successfully, execute the following command:

        #sestatus

    The output appears as follows:

        SELinux status:                 enabled
        SELinuxfs mount:                /sys/fs/selinux
        SELinux root directory:         /etc/selinux
        Loaded policy name:             targeted
        Current mode:                   enforcing
        Mode from config file:          enforcing
        Policy MLS status:              enabled
        Policy deny_unknown status:     allowed
        Memory protection checking:     actual (secure)
        Max kernel policy version:      33

    You must see that the value for Current mode is set to enforcing.

×

Loading...