Chat now with support
Chat mit Support

One Identity Safeguard for Privileged Sessions 7.4 - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing IPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving Cleaning up audit data Using plugins Forwarding data to third-party systems Starling integration
User management and access control
Login settings Managing One Identity Safeguard for Privileged Sessions (SPS) users locally Setting password policies for local users Managing local user groups Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database Authenticating users to a RADIUS server Authenticating users with X.509 certificates Authenticating users with SAML2 Managing user rights and usergroups Creating rules for restricting access to search audit data Displaying the privileges of users and user groups Listing and searching configuration changes
Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received Using UPN usernames in audited SSH connections
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Performing gateway authentication to RDP servers using local Credential Store and NLA

The following describes how to perform a gateway authentication to RDP servers using local Credential Store and Network Level Authentication (NLA).

To perform a gateway authentication to RDP servers using local Credential Store and NLA

  1. Initiate the RDP connection.

  2. Enter your gateway credentials during the gateway authentication. This can be web gateway authentication, or inband gateway authentication using RD Gateway.

  3. Enter the following:

    • In the Username field, enter the domain name, the -AUTO suffix, and your username. For example, EXAMPLEDOMAIN-AUTO\Administrator.

      NOTE: The -AUTO suffix is the default value of the RDP Control > Settings > Autologon domain suffix option of One Identity Safeguard for Privileged Sessions (SPS). If your SPS administrator has changed this option, use the appropriate suffix instead of -AUTO.

    • Enter your username (only the username, without the domain, for example, Administrator) into the Password field.

  4. If the authentication is successful, the desktop of the remote server is displayed.

Configuring password-protected Credential Stores

The following describes how to configure a local Credential Store that stores the credentials used to login to the target host. The Credential Store will be protected by custom passwords. This password must be entered every time One Identity Safeguard for Privileged Sessions (SPS) is rebooted to make the Credential Store available.

Prerequisites

NOTE: Users accessing connections that use Credential Stores to authenticate on the target server must authenticate on SPS using gateway authentication or an AA plugin. Therefore gateway authentication or an AA plugin must be configured for these connections.

For more information, see and .

To configure a local Credential Store that stores the credentials used to login to the target host

  1. Navigate to Policies > Credential Stores.

  2. Click and enter a name for the Credential Store.

  3. Select Local.

  4. Select Encryption key > Password protected.

    NOTE: The contents of the Credential Store, as well as the passwords are included in the configuration backups of SPS. Make sure to encrypt the configuration backups.

  5. Select Master passwords and click .

    Figure 340: Policies > Credential Stores > Local > Password protected — Set Master Password

    • To protect the Credential Store with a single password, select Single password and enter the password into the Password and Verify password fields. Anyone who knows this password and has the Unlock Credential Store privilege will be able to open the Credential Store. Password-protected Credential Stores must be unlocked on the SPS web interface or console after every SPS reboot.

    • To protect the Credential Store with multiple passwords, select Compound password, click and enter a password. Click to add additional passwords. After finishing listing every password, click Add. All of these passwords will be needed to unlock the Credential Store.

    SPS encrypts the master passwords using an aes-256-cbc cipher, and stores them in a local database.

    NOTE: SPS accepts passwords that are not longer than 150 characters and supports the following characters:

    • Letters A-Z, a-z

    • Numbers 0-9

    • The space character

    • Special characters: !"#$%&'()*+,-./:;<>=?@[]\^-`{}_|

    Figure 341: Policies > Credential Stores > Local > Password protected — Configure Credential Store

  6. Repeat the previous step to add another single or compound password. That way, different password sets can be defined for the Credential Store. For example, if a single and a compound password is configured, the chief administrator can unlock the Credential Store with a single password, and two of his subordinates can open the Credential Store together if they know one element each of the compound password.

    TIP: To change the password, just click to delete the old password. Then add new passwords as needed.

  1. Add credentials to the Credential Store.

    1. Click and enter the destination host and the username. For the destination host, you can use hostname, IP address, or subnet as well. To use the same credentials for every destination host, enter the 0.0.0.0/0 subnet. To use the credentials only on the hosts of a specific domain, enter *.domain. Note that:

      • Usernames are case sensitive.

      • To authenticate users of a Windows domain, enter the name of the domain into the Host field.

      Use an IPv4 address.

    2. Set the credentials. SPS will use these credentials to login to the destination host if the credential store is selected in a Connection policy. If more than one credential is specified to a host-username pair, SPS will attempt to use the credentials as the destination host requests it.

      • To add a password, click Passwords > , then enter the password corresponding to the username.

      • To upload a private key, click SSH Keys > >, then paste or upload a private key.

        NOTE: If the private key is protected by a passphrase, enter the passphrase. The passphrase is needed only once during the upload, it is not required for the later operation of the Credential Store.

      • To generate a keypair on SPS click SSH Keys > > , set the length and type of the key, then click Generate. After that, click the fingerprint of the key to download the public part of the keypair. There is no way to download the private key from the SPS web interface.

        NOTE:

        TIP: One Identity recommends using 2048-bit RSA keys (or stronger).

      • To upload a certificate and the corresponding private key, click X509 Keys > > , then paste or upload a certificate and the private key.

        NOTE: If the private key is protected by a passphrase, enter the passphrase. The passphrase is needed only once during the upload, it is not required for the later operation of the Credential Store.

      NOTE: SPS accepts passwords that are not longer than 150 characters and supports the following characters:

      • Letters A-Z, a-z

      • Numbers 0-9

      • The space character

      • Special characters: !"#$%&'()*+,-./:;<>=?@[]\^-`{}_|

    3. Repeat the previous step to add further credentials to the username as necessary.

  2. Repeat the previous step to add further hosts or usernames as necessary.

    NOTE: Credential Stores can be used together with usermapping policies to simplify the administration of users on the target hosts.

    For more information, see Configuring usermapping policies.

  1. Click .

  2. Navigate to the Connection policy where you want to use the Credential Store (for example, to SSH Control > Connections), select the Credential Store to use in the Credential Store field, then click .

    Figure 342: Control > Connections — Select a Credential Store to use

  3. Navigate to Basic Settings > Alerting & Monitoring > Traffic related traps and enable the Decryption of a credential failed (scbCredStoreDecrpytError) and The requested credential store is closed (scbCredStoreClosed) events. That way SPS sends automatic alerts if a Credential Store needs to be unlocked.

    		 Caution:

    Password-protected Credential Stores must be unlocked every time after SPS is rebooted. Connections using a password-protected Credential Store will automatically fail until the Credential Store is locked.

    To unlock a Credential Store, users must have the Unlock Credential Store privilege, or editing (read and write) privileges to the particular Credential Store.

Unlocking Credential Stores

To unlock a Credential Store and make it available for use, complete the following steps.

Prerequisites

To unlock a Credential Store, users must have the Unlock Credential Store privilege, or editing (read and write) privileges to the particular Credential Store.

  1. Login to the One Identity Safeguard for Privileged Sessions (SPS) web interface.

  2. Navigate to Unlock Credential Store and select the Credential Store to unlock.

  3. Enter the password(s) for the Credential Store. For compound passwords, enter every element of the compound password in the correct order.

    NOTE: SPS accepts passwords that are not longer than 150 characters and supports the following characters:

    • Letters A-Z, a-z

    • Numbers 0-9

    • The space character

    • Special characters: !"#$%&'()*+,-./:;<>=?@[]\^-`{}_|

  4. Click Unlock.

  5. Repeat the previous steps for other Credential Stores as needed.

    NOTE: Alternatively, Credential Stores can be unlocked also from the SPS Console Menu.

Using a custom Credential Store plugin to authenticate on the target hosts

The following describes how to configure One Identity Safeguard for Privileged Sessions (SPS) to retrieve the credentials used to login to the target host using a custom plugin.

Prerequisites

  • To use a custom Credential Store plugin, you have to upload a working Credential Store plugin to SPS. This plugin is a script that can be used to access an external Credential Store or Password Manager. If you want to create such a custom Credential Store plugin, contact our Support Team or see the documentation about custom Credential Store plugins.

    For more information on uploading plugins, see Uploading plugins.

    NOTE: Users accessing connections that use Credential Stores to authenticate on the target server must authenticate on SPS using gateway authentication. Therefore, gateway authentication must be configured for these connections. For details, see Configuring gateway authentication.

  • Verify the integrity of the plugin.

    For more information on verifying the integrity of plugins, see Verifying the integrity of a plugin.

To configure SPS to retrieve the credentials used to login to the target host using a custom plugin

  1. Navigate to Policies > Credential Stores.

  2. Click and enter a name for the Credential Store.

  3. Select External Plugin, then select the plugin to use from the Plugin list.

  4. If your plugin supports configuration, then you can create multiple customized configuration instances of the plugin for your site. The Configuration textbox displays the example configuration of the plugin you selected. If you wish to create a customized configuration instance of the plugin for your site, then edit the configuration here.

    NOTE: Plugins created and issued before the release of SPS 5.1 do not support configuration. If you create a configuration for a plugin that does not support this, the affected connection will stop with an error message.

  5. Click .

  6. Navigate to the Connection policy where you want to use the Credential Store (for example, to SSH Control > Connections), select the Credential Store configuration instance to use in the Credential Store field, then click .

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen