立即与支持人员聊天
与支持团队交流

Safeguard for Privileged Passwords On Demand Hosted - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Getting started with the desktop client Using the desktop client Activity Center Search box Privileged access requests Toolbox Accounts Account Groups Assets
General/Properties tab (asset) Accounts tab (asset) Account Dependencies tab (asset) Owners tab (asset) Access Request Policies tab (asset) Asset Groups tab (asset) Discovered SSH Keys (asset) Discovered Services tab (asset) History tab (asset) Managing assets
Asset Groups Discovery Entitlements Linked Accounts Partitions Profiles Settings
Access Request settings Appliance settings Asset Management settings Tags Backup and Retention settings Certificates settings Cluster settings Enable or Disable Services settings External Integration settings Password Management settings Real-Time Reports Safeguard Access settings SSH Key Management settings Security Policy Settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 or later migration guidance Appendix C: SPP and SPS join guidance Appendix D: Regular Expressions About us

Backup Retention

It is the responsibility of the Appliance Administrator to configure the maximum number of backup files you want Safeguard for Privileged Passwords to store on the appliance.

To configure the appliance backup retention settings

  1. Go to Backup Retention:
    • web client: Navigate to Backup and Retention | Backup Retention.
    • desktop client: Navigate to Administrative Tools | Settings | Backup and Retention | Safeguard Backup Retention.
  2. desktop client only: Select the Enable Backup Retention check box.
  3. Enter the maximum number of backup files you want to store on the appliance.
    • web client: You can enter 0 to 40 for the number of backup files that will be stored on the appliance. Then click Save.
    • desktop client: You can enter 1 to 40 for the number of backup files that will be stored on the appliance. Then click OK.

Once Safeguard for Privileged Passwords saves the maximum number of backup files, next time it performs a backup, it deletes the backup file with the oldest date.

Authorize VM Compatible Backups (web client)

The Safeguard for Privileged Passwords web client allows you to generate a backup on a hardware appliance which can then be uploaded and restored on a Safeguard virtual machine.

IMPORTANT: Due to the potential security risk with migrating from a hardware appliance to a virtual machine, the Appliance Administrator making the request is required to contact One Identity Support as part of this process before they will be able to complete enabling this feature. This approval is indicated by the Not Authorized/Authorized indicator at the top of the Authorize VM Compatible Backups page.

IMPORTANT: You cannot upload a backup to a hardware appliance which was previously downloaded from hardware as VM compatible. Such a backup can only be uploaded to a Safeguard virtual machine.

IMPORTANT: This feature is not available on a replica within a cluster.

To authorize generating a hardware appliance backup for use on a virtual machine

  1. Navigate to Backup and Retention | Authorize VM Compatible Backups.
  2. In the Challenge Request User Identifier field, enter the name of the user requesting permission for the backup to be generated.

  3. Click Generate Request.

    NOTE: Only one challenge request can be active at a time. If there is a pending challenge request already active, you can cancel the active request by selecting the Invalidate Existing Challenge Request check box before generating a new request.

  4. A Challenge Request text box will appear. This text box contains the information needed by One Identity to confirm the VM compatible backup authorization request is valid. Use one of the following options to copy the information:

    • Copy Request: This copies the challenge request to your clipboard.

    • Download Request: This downloads the challenge request to a text file.

  5. Contact One Identity Support regarding your request to authorize the download of VM compatible backups from a hardware appliance. When requested, send the copied or downloaded challenge request to One Identity Support.

  6. Once One Identity Support has confirmed the request, a challenge response will be sent back. This text needs to be copy/pasted or uploaded (using the Browse button) to the Challenge Response text box.

  7. Click Verify Response to confirm the request as been approved.

    Once confirmed, an Authorized indicator will be displayed at the top of the Authorize VM Compatible Backups page. The Download VM Compatible option will now be available through the button on the Backup and Restore page on hardware appliances. In order to download a VM compatible backup it must have been created with password or GPG public key protection settings.

    You can use the Remove Authorization button to disable this feature. To reenable a new Challenge Request must be sent to One Identity Support.

Certificates settings

Use the Certificate settings to manage the certificates used to secure One Identity Safeguard for Privileged Passwords. The panes on this page display default certificates that can be replaced or user-supplied certificates that have been added to Safeguard for Privileged Passwords.

It is the responsibility of the Appliance Administrator to manage the Certificate Signing Requests (CSRs) used by Safeguard for Privileged Passwords.

Go to Certificates:

  • web client: Navigate to Certificates.
  • desktop client: Navigate to Administrative Tools | Settings | Certificates.
Table 184: Certificates settings
Setting Description

Audit Log Signing Certificate

Where you manage the audit log signing certificate used to validate audit logs stored on an archive server. When the audit log is exported, the log is signed with this certificate to ensure that it is legitimate and has not been tampered with after export.

Certificate Signing Request

Where you can view and manage certificate signing requests (CSRs) that have been issued by Safeguard for Privileged Passwords. CSRs that may be created in Safeguard for Privileged Passwords include: Audit Log Signing Certificate, SMTP Client Certificate, SSL Certificates, or Syslog Client Certificates.

Hardware Security Module Certificates

Where you manage client and server Hardware Security Module certificates. These certificates are used for connecting to Hardware Security Module devices.

SMTP Certificate

Where you manage SMTP client certificates.

SSL/TLS Certificates Where you manage SSL/TLS certificates, including installing certificates or creating CSRs to enroll a public SSL/TLS certificate. This certificate is used to secure all HTTP traffic.

Syslog Client Certificate

Where you manage the syslog client certificate used to secure traffic between Safeguard for Privileged Passwords and the syslog server.

Trusted CA Certificates Where you add and manage certificates trusted by Safeguard for Privileged Passwordsand used to verify the chain of trust on certificates for various usages. For example , a trusted certificate may be your company's root Certificate Authority (CA) certificate or an intermediate certificate .

About Certificate Signing Requests (CSRs)

You can create a certificate signing request (CSR) in Safeguard for Privileged Passwords. The private key is kept securely on the Safeguard for Privileged Passwords Appliance and is not released. The public key and details are in an encoded text file. Here is the process:

  1. Create a CSR through Safeguard for Privileged Passwords. See:
  2. Submit the encoded text file to a Certificate Authority (CA) to create an appropriate X509 certificate that is trusted by other entities trusting the CA.
  3. Install the certificate generated by the CA on Safeguard for Privileged Passwords where it is associated with the private key. See:
  4. If necessary, add the CA certification to Trusted Certificates in Safeguard for Privileged Passwords. For more information, see Trusted CA Certificates.

The certificate infrastructure in One Identity Safeguard for Privileged Passwords consists of the following.

Replaceable certificates

One Identity Safeguard for Privileged Passwords ships with the following default certificates which are untrusted and are meant to be replaced:

User-supplied certificates

You can specify the security certificates to be used. When replacing or adding certificates, keep the following considerations in mind:

  • Safeguard for Privileged Passwords supports Certificate Signing Requests (CSRs) to enroll any type of certificate. CSRs use the Public-Key Cryptography Standard (PKCS) #10 format.
  • For imports, Safeguard for Privileged Passwords must access the relevant network resources to validate the CRL end points specified in the signed CSR.

  • For uploading certificates with private keys, Safeguard for Privileged Passwords supports .pfx ( or .p12) files that follow the PKCS #12 standard.

  • For installing certificates generated with a CSR, Safeguard for Privileged Passwords supports DER Encoded Files (.cer, .crt, or .der) and PEM Encoded Files (.pem).
  • For SSL/TLS certificates, Safeguard for Privileged Passwords allows you to upload or use a CSR to enroll multiple certificates that can then be applied to different appliances.
  • Safeguard for Privileged Passwords provides an SSL/TLS certificate store that allows you to assign any uploaded or enrolled a certificate to any appliance.
  • Consider if the server's signing authority certificate must be added to the Trusted Certificates store in Safeguard for Privileged Passwords. For example, prior to adding an asset that uses SSL/TLS server certificate validation, you must add the signing authority certificate to the Trusted Certificates store. Or, if you uploaded a syslog certificate with a private key, you may upload the certificate's root CA to the list of trusted certificates. For more information, see Trusted CA Certificates.
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级