CA ARCserve Backup Security

The caroot User Profile

CA ARCserve Backup is designed with a root-level, super user profile, to which complete control of CA ARCserve Backup is granted. This profile, referred to as the "caroot" user profile, is set up during the first-time installation of CA ARCserve Backup. The password for the caroot profile can be set during installation, or it can be set (or changed) later using the ca_auth utility.

Note: The caroot user profile only controls access to the CA ARCserve Backup Manager GUI and backup-related functions, and should not be confused with the security required to log in to your operating system.

Equivalence

CA ARCserve Backup allows you to create an equivalence to caroot for any Windows account. A user that has been granted equivalence to caroot can run all of the command line utilities, but cannot log in to the Manager GUI. Creating an equivalence for a Windows user has the following additional advantages:

• Ease of Command Line Usage--When you have created an equivalence for a Windows user, the equivalence performs an implicit login on behalf of the logged-in user whenever a command line function requires authentication. Therefore, the command line utilities can be run without requiring the user to enter a username and password each time a command is submitted.
• Access Restriction--Although a user that is equivalent to caroot can run all of the command line utilities, the user does not have access to the CA ARCserve Backup Manager GUI. Access to the GUI is granted only through the caroot account or through a CA ARCserve Backup User account with the proper privileges. You cannot use an account that has only been granted equivalency to login to the GUI. To give additional CA ARCserve Backup users access to the GUI, use the ca_auth utility.

The System Account

The CA ARCserve Backup services require a valid Windows system account that has Administrator and Backup Operator privileges on the local machine. The services use this account to access local resources, such as the hard drive and the local network.

You are given the option of entering a Windows system account during the first-time installation of CA ARCserve Backup. If you enter a Windows account during installation, CA ARCserve Backup will automatically grant this account Administrator and Backup Operator privileges. If you select Skip during installation, you will need to enter a valid Windows system account using the CA ARCserve Backup Server Administrator and grant it the required privileges manually.

You can change the system account information at any time using the CA ARCserve Backup Server Administrator, or the bsconfig.exe utility, located in the CA ARCserve Backup home directory.

Caroot, Equivalency, and the System Account

Do not confuse the caroot user profile with the CA ARCserve Backup System Account. The caroot user profile is used to control access to the CA ARCserve Backup Manager GUI and its related backup functions; the System Account gives the CA ARCserve Backup services the security privileges they need to operate on the local machine.

Although the System Account and the caroot user profile perform different functions, in order for CA ARCserve Backup to run all its jobs successfully, you must grant the System Account equivalency to caroot. For example, if the System Account is named "BackupAdmin", and the local machine name is BAB01, use the following ca_auth command to give the account equivalency to caroot:

ca_auth -equiv add BackupAdmin BAB01 caroot caroot caroot_password

For more information on the System Account, see the Administration Guide or see the System Account Help topic. For more information on ca_auth, see the Administration Guide or the ca_auth Help topic.