security on baclient

[cisse]

hello,

We don't want that everybody who can logon to a client also is able to start the baclient pgm and start performing restores , retrieves or maling backups. Is there a possibility to avoid this? Or the baclient may be started but then a userid/passwd defined in TSM is asked.

we have different tsm server and client versions but i don't think this is version related.

thanks for any help

 

[Harry_Redl]

Hi,

NTFS permissions are not enough?
What you can do is to use "passwordaccess prompt" in your dsm.opt file, but in that case you may not be able to perform scheduled backups (run your scheduler service).

Harry

 

[cisse]

thanks for your reaction

do you mean by ntfs permissions the windows security?
For soxs reasons nobody else then the tsm admins and helpdesk for some user data restores may perform the restores. So everyone who has access to a client can startup the baclient and launch restores.
passwordaccess prompt : we use tsm schedules so we can't put it in the opt file

 

[Harry_Redl]

Hi,

I meant only administrator (and members of defined group) can have Read/Execute permission for the dsm.exe and dsmc.exe.

Another thing you may consider is to use webclient for helpdesk restores - in that way they only need TSM user and password and do not need windows account (access to the server) at all.

Harry

 

[cisse]

helpdesk : indeed we use that already they don't have to access the client
administrator : that's correct but we don't want them to have access to dsm.exe and dsmc.exe They may have access but when they receive the view (backup-restore and archive-retrieve) they have to provide a userid (known in tsm) and passwd before they can get further in this pgm. They won't because they don't have a user in TSM.

 

[Harry_Redl]

Hi,

if you use scheduled backups (and therefore have your password saved - in encrypted file or in the registry) then you are newer asked for TSM password when running the dsm.exe or dsmc.exe programs. So OS security is the only thing left.

Read this - maybe you can find what are you looking for
http://www.redbooks.ibm.com/redbooks/pdfs/sg247505.pdf

Harry

 

[cisse]

thanks i hoped for a tsm solution now i have to talk with our os team.

have a nice day and thank you for the quick reactions