Eric, 

>>Is full client auth overkill?

Depends the level of security desired. If you want to disallow 
Root/Administrators from doing local backup and restore on client systems, then 
you would need complete NBAC.

>> certificates expiry

Certificates that are issued via the ?bpnbat ?LoginMachine? command get 
(automatically) renewed periodically. So in most cases you would not need to 
log into the client and issue the command again to request another cert.

HTH,
Tejas

+----------------------------------------------------------------------
|This was sent by LTejas AT gmail DOT com via Backup Central.
|Forward SPAM to abuse AT backupcentral DOT com.
+----------------------------------------------------------------------

_______________________________________________
Veritas-bu maillist  -  Veritas-bu AT mailman.eng.auburn DOT edu
http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu