Chat now with support
Chat mit Support

One Identity Safeguard for Privileged Sessions 7.4 - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing IPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving Cleaning up audit data Using plugins Forwarding data to third-party systems Starling integration
User management and access control
Login settings Managing One Identity Safeguard for Privileged Sessions (SPS) users locally Setting password policies for local users Managing local user groups Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database Authenticating users to a RADIUS server Authenticating users with X.509 certificates Authenticating users with SAML2 Managing user rights and usergroups Creating rules for restricting access to search audit data Displaying the privileges of users and user groups Listing and searching configuration changes
Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received Using UPN usernames in audited SSH connections
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Configuring system logging

One Identity Safeguard for Privileged Sessions (SPS) can send its system log messages to remote syslog servers (for example, syslog-ng Premium Edition, syslog-ng Store Box, Splunk, or HPE ArcSight Data Platform).

NOTE: To send log messages in any custom format, contact our Support Team.

 Caution:

The retention time for local logs of SPS is seven days. To retain them longer, forward them to a remote logserver.

Figure 58: Basic Settings > Management > Syslog — Configuring system logging

To configure logging to a remote server

  1. Navigate to Basic Settings > Management.

  2. Click in the Syslog > Syslog receivers field to add a new syslog server.

  3. Enter the IP address and port of the syslog server into the respective fields.

    Use an IPv4 address.

  4. Select the network protocol used to transfer the messages in the Protocol field. The legacy- prefix corresponds to the legacy BSD-syslog protocol described in RFC3164, while the syslog- prefix corresponds to the new IETF-syslog protocol described in RFC5424. Note that not every syslog server supports the IETF protocol yet.

    Select TCP+TLS to send the log messages using a TLS-encrypted connection.

    TIP: Transferring the syslog messages using TCP ensures that the server receives them.

    Transferring the syslog messages using TLS encryption ensures that third parties cannot read the messages. However, not every syslog server accepts encrypted connections. The syslog-ng Premium Edition and Open Source Edition applications, and the syslog-ng Store Box (which is a log-collector appliance similar to SPS) support both encrypted connections and the new IETF-syslog protocol as well. For details on these products, see syslog-ng Premium Edition and syslog-ng Store Box.

  5. If the syslog server requires mutual authentication, that is, a certificate from SPS, check Authenticate as client.

    1. Generate and sign a certificate for SPS, then click the icon in the Client X.509 certificate field to upload the certificate. After that, click the icon in the Client key field and upload the private key corresponding to the certificate.

  6. If you have selected the TCP+TLS protocol and you want SPS to verify the certificate of the syslog server, complete the following steps. Otherwise, click .

    1. Select Check server certificate.

    2. Select a Trust Store.

      NOTE: You can only select a trust store with None or Full revocation check type.

      SPS will use this trust store to verify the certificate of the server, and reject the connections if the verification fails. For more information on creating trust stores, see Verifying certificates with Certificate Authorities using trust stores.

    3. Click .

  7. To display separate hostnames for syslog messages sent by the nodes of a SPS HA cluster, select the Include node ID in hostname in boot firmware messages option. The node ID included in the hostname file of the syslog message is the MAC address of the node's HA interface. (Messages of the core firmware are always sent by the primary node.)

    The boot firmware boots up SPS, provides High Availability support, and starts the core firmware. The core firmware, in turn, handles everything else: provides the web interface, manages the connections, and so on.

  8. Click the and icons to add new servers or delete existing ones.

    NOTE: To reduce the risk of the syslog server not receiving log messages from SPS because of a network outage or other problem with the syslog server, SPS buffers up to 10 Megabytes of log messages to its hard disk in case the syslog server becomes unaccessible.

Configuring e-mail alerts

The following describes how to configure e-mail alerts.

To configure e-mail alerts

  1. Navigate to Basic Settings > Management > Mail settings.

  2. If you want to encrypt the communication between SPS and the SMTP server, in Encryption, select the STARTTLS option and complete the following steps:

    • If you want SPS to verify the certificate of the server, select Only accept certificates issued by the specified CA certificate and click the icon in the CA X.509 certificate field. A pop-up window is displayed.

      Click Browse, select the certificate of the Certificate Authority (CA) that issued the certificate of the SMTP server, then click Upload. Alternatively, you can paste the certificate into the Copy-paste field and click Set.

      SPS will use this CA certificate to verify the certificate of the server, and reject the connections if the verification fails.

    • If the SMTP server requires mutual authentication, that is, it expects a certificate from SPS, enable Authenticate as client. Generate and sign a certificate for SPS, then click in the Client X.509 certificate field to upload the certificate. After that, click in the Client key field and upload the private key corresponding to the certificate.

    TIP: One Identity recommends using 2048-bit RSA keys (or stronger).

  3. If you want SPS to authenticate to the SMTP server, in Authentication, select the Enabled option. Enter the Username to authenticate with.

    To configure or change the password to use to authenticate to the SMTP server, click Change and enter the password. Click Update. Click .

    NOTE: SPS accepts passwords that are not longer than 150 characters and supports the following characters:

    • Letters A-Z, a-z

    • Numbers 0-9

    • The space character

    • Special characters: !"#$%&'()*+,-./:;<>=?@[]\^-`{}_|

  4. Enter the IP address or the hostname of the mail server into the SMTP server address field.

    Use an IPv4 address.

    Figure 59: Basic Settings > Management > Mail settings — Configuring e-mail sending

  5. Enter the e-mail address where you want to receive e-mails from into the Send e-mails as field. This can be useful for e-mail filtering purposes. SPS sends e-mails from the address provided here. If no e-mail address is entered, e-mails will be sent from the default e-mail address.

  6. Enter the e-mail address of the administrator into the Administrator's e-mail address field. SPS sends notifications related to system-events (but not alerts and reports) to this address.

  7. Enter the e-mail address of the administrator into the Send e-mail alerts to field. SPS sends monitoring alerts to this address.

  8. Enter the e-mail address the person who should receive traffic reports from SPS into the Send reports to field. For details on reports, see Reports.

  9. Click .

  10. Click Test to send a test message.

    If the test message does not arrive to the server, check if SPS can access the server. For details, see Troubleshooting One Identity Safeguard for Privileged Sessions (SPS).

  11. Navigate to Basic Settings > Alerting & Monitoring and select in which situations should SPS send an e-mail alert. For details, see Configuring system monitoring on SPS.

  12. Click .

Configuring SNMP alerts

SPS can send alerts to a central monitoring server through SNMP (Simple Network Management Protocol).

To configure SNMP alerts

  1. Navigate to Basic Settings > Management > SNMP trap settings.

  2. Enter the IP address or the hostname of the SNMP server into the SNMP server address field.

    Use an IPv4 address.

    Figure 60: Basic Settings > Management > SNMP trap settings — Configuring SNMP alerts

  3. Select the SNMP protocol to use.

    (Optional) To use the SNMP v2c protocol for SNMP queries, select SNMP v2c, and enter the community to use into the Community field. Otherwise, skip these steps.

    (Optional) To use the SNMP v3 protocol, select SNMP v3 and complete the following steps. Otherwise, skip these steps.

    1. Enter the username to use into the Username field.

    2. Enter the engine ID to use into the Engine ID field. The engine ID is a hexadecimal number at least 10 digits long, starting with 0x. For example, 0xABABABABAB.

    3. Select the authentication method (MD5 or SHA1) to use from the options under the Authentication method: field.

    4. Enter the password to use into the Authentication password field.

    5. Select the encryption method (Disabled, DES or AES) to use from the options under the Encryption method: field .

    6. Enter the encryption password to use into the Encryption password: field.

    Figure 61: Basic Settings > Management > SNMP trap settings — Configuring SNMP alerts using SNMPv3

    NOTE: SPS accepts passwords that are not longer than 150 characters and supports the following characters:

    • Letters A-Z, a-z

    • Numbers 0-9

    • The space character

    • Special characters: !"#$%&'()*+,-./:;<>=?@[]\^-`{}_|

  4. Click .

  5. Navigate to Basic Settings > Alerting & Monitoring and select in which situations SPS should send an SNMP alert. For details, see Configuring system monitoring on SPS.

  6. Click .

Querying SPS status information using agents

External SNMP agents can query the basic status information of SPS.

To configure which clients can query status information

  1. Navigate to Basic Settings > Local Services > SNMP server settings.

    Figure 62: Basic Settings > Local Services > SNMP server settings — Configuring SNMP agent access

  2. Enable the SNMP server.

  3. Optionally, you can enter the details of the SNMP server into the System location, System contact, and System description fields.

  4. To use the SNMP v2c protocol for SNMP queries, enable SNMP v2c agent, and enter the community to use into the Community field.

  5. To use the SNMP v3 protocol, select SNMP v3 agent and complete the following steps:

    1. Click

    2. Enter the username used by the SNMP agent into the Username field.

    3. Select the authentication method (MD5 or SHA1) to use from the options under the Auth. method field.

    4. Enter the password used by the SNMP agent into the Auth. password field.

    5. Select the encryption method (Disabled, DES or AES) to use from the options under the Encryption method field.

    6. Enter the encryption password to use into the Encryption password field.

    7. To add other agents, click .

    NOTE: SPS accepts passwords that are not longer than 150 characters and supports the following characters:

    • Letters A-Z, a-z

    • Numbers 0-9

    • The space character

    • Special characters: !"#$%&'()*+,-./:;<>=?@[]\^-`{}_|

  6. In the Listening addresses field, choose and select the IP address and port for the SNMP server.

    The available addresses correspond to the interface addresses configured in Basic Settings > Network > Interfaces. Only IPv4 addresses can be selected.

    Repeat this step to add multiple addresses.

  7. (Optional) To permit access to the SNMP server only from selected subnets or IP addresses, select Restrict clients, click and enter the IP address and netmask of the allowed clients.

    Use an IPv4 address.

    Repeat this step to add multiple addresses.

  8. Click .

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen