PowerProtect Data Manager 19.17 Virtual Machine User Guide

Performing file-level restores as a domain user on Linux

Perform the following configuration steps before configuring a file-level restore on supported Linux platforms as a domain user. Completing this configuration will allow you the domain user to perform file-level restores of files and folders belonging to any domain user from any Linux virtual machine backup copy.

1. If you are using an Active Directory authentication method, perform the following substeps:
   NOTE:These substeps manage the System Security Services Daemon (SSSD) service.
   1. Edit /etc/sssd/sssd.conf and add the following three lines under the appropriate sssd.conf domain section:

      use_fully_qualified_names = True
      default_shell = /bin/bash 
      ad_gpo_map_permit = +vmtoolsd, +vproxyra

      This is required to allow the vmtoolsd process to authenticate with AD.
   2. Run systemctl restart sssd.service to apply the changes.
2. Edit /etc/sudoers.d/sudoers to include the following content

   %<AD-groupname@domain-name.com> ALL=(ALL) NOPASSWD: /usr/bin/rpm, /opt/emc/vproxyra/bin/postinstall.sh, /opt/emc/vproxyra/bin/preremove.sh, /opt/emc/vproxyra/bin/vflrbrowse, /opt/emc/vproxyra/bin/vflrcopy
   Defaults:%<AD-groupname@domain-name.com> !requiretty
   Defaults:%<AD-groupname@domain-name.com>  !authenticate

   • The first line is for providing sudoer permission to the required AD-group and to the five binaries (rpm, postinstall.sh, preremove.sh, vflrbrowse, vflrcopy) required for file-level restore.
   • The second line is required for sudo to work without a terminal session, which is necessary for file-level restore.
   • The third line is required for sudo to work without needing password authentication, which is necessary for file-level restore.

   For example, if your group name in AD is set to AD-group-sudoers and your domain name is set to tunga.com, the content would look similar to the following:

   %AD-group-sudoers@tunga.com ALL=(ALL) NOPASSWD: /usr/bin/rpm, /opt/emc/vproxyra/bin/postinstall.sh, /opt/emc/vproxyra/bin/preremove.sh, /opt/emc/vproxyra/bin/vflrbrowse, /opt/emc/vproxyra/bin/vflrcopy
   Defaults:%AD-group-sudoers@tunga.com !requiretty
   Defaults:%AD-group-sudoers@tunga.com !authenticate

3. On Red Hat Enterprise Linux and CentOS, run the command cat /etc/pam.d/vmtoolsd to verify that the /etc/pam.d/vmtoolsd file contains the following four lines.
   On Red Hat Enterprise Linux and CentOS:

   auth substack password-auth
   auth include postlogin
   auth required pam_nologin.so
   account include password-auth

   NOTE:On Red Hat Enterprise Linux and CentOS, this content is often populated in the file by default if using open-vm-tools version 11.2.x.
   On SuSE Linux Enterprise Server (SLES) version 12 or 15:

   auth required pam_shells.so
   auth requisite pam_nologin.so
   auth include common-auth
   account include common-account

   NOTE:This content is often populated in the file by default if using open-vm-tools version 12.x

   Alternatively, on all Linux platforms, you can update the open-vm-tools package to the latest version, which will automatically update the /etc/pam.d/vmtoolsd content with these four lines, by following the instructions in this VMware article.

4. Ensure the domain user has the required sudoers group set as the Primary group in the AD domain user properties window, as shown in the following figure. If the Primary group if set to Domain Users, change this group to the required sudoers group.