Chat now with support
Chat mit Support

One Identity Safeguard for Privileged Sessions 7.3.1 - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing IPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving Cleaning up audit data Using plugins Forwarding data to third-party systems Starling integration
User management and access control
Login settings Managing One Identity Safeguard for Privileged Sessions (SPS) users locally Setting password policies for local users Managing local user groups Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database Authenticating users to a RADIUS server Authenticating users with X.509 certificates Authenticating users with SAML2 Managing user rights and usergroups Creating rules for restricting access to search audit data Displaying the privileges of users and user groups Listing and searching configuration changes
Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received Using UPN usernames in audited SSH connections
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Modifying group privileges

The following describes how to modify the privileges of an existing group.

To modify the privileges of an existing group

  1. Navigate to Users & Access Control > Appliance Access.

  2. Find the group you want to modify and click Edit. The list of available privileges is displayed.

  3. Select the privileges (pages of the One Identity Safeguard for Privileged Sessions (SPS) interface) to which the group will have access and click Save.

    Figure 95: Users & Access Control > Appliance Access > Edit — Modifying group privileges

    		 Caution:

    Assigning the Search privilege to a user on the Users & Access Control page automatically enables the Search in all connections privilege, and grants the user access to every audit trail, even if the user is not a member of the groups listed in the Access Control option of the particular connection policy.

  4. Select the type of access (read or read & write) from the Type field.

  5. Click .

The admin user is available by default and has all privileges. It is not possible to delete this user.

Finding specific usergroups

The Filter ACLs section of the Users & Access Control > Appliance Access page provides you with a simple searching and filtering interface to search the names and privileges of usergroups.

Figure 96: Users & Access Control > Appliance Access — Finding specific usergroups

  • To filter on a specific usergroup, enter the name of the group into the Group field and select Search.

  • To select usergroups who have a specific privilege, click Edit, select the privilege or privileges you are looking for, and click Search.

  • To filter for read or write access, use the Type option.

Using usergroups

How you should name usergroups depends on the way you manage your One Identity Safeguard for Privileged Sessions (SPS) users.

  • Local users: If you use only local users, create or modify usergroups on the Users & Access Control > Local User Groups page, assign or modify privileges on the Users & Access Control > Appliance Access page, and add users to the groups on the Users & Access Control > Local Users or the Users & Access Control > Local User Groups page.

  • LDAP users and LDAP groups: If you manage your users from LDAP, and also have LDAP groups that match the way you want to group your SPS users, create or modify your usergroups on the Users & Access Control > Appliance Access page and ensure that the name of your LDAP group and the SPS usergroup is the same. For example, to make members of the admins LDAP group be able to use SPS, create a usergroup called admins on the Users & Access Control > Appliance Access page and edit the privileges of the group as needed.

  • RADIUS users and local groups: This is the case when you manage users from RADIUS, but you cannot or do not want to create groups in LDAP. Create your local groups on the Users & Access Control > Appliance Access page, and add your RADIUS users to these groups on the Users & Access Control > Local User Groups page.

Built-in usergroups of One Identity Safeguard for Privileged Sessions (SPS)

One Identity Safeguard for Privileged Sessions (SPS) has the following usergroups by default. Note that you can modify and delete these usergroups as you see fit.

Figure 97: Users & Access Control > Appliance Access — Built-in usergroups of SPS

 Caution:

If you use LDAP authentication on the SPS web interface and want to use the default usergroups, you have to create these groups in your LDAP database and assign users to them. For details on using usergroups, see Using usergroups.

  • basic-view: View the settings in the Basic Settings menu, including the system logs of SPS. Members of this group can also execute commands on the Troubleshooting tab.

  • basic-write: Edit the settings in the Basic Settings menu. Members of this group can manage SPS as a host.

  • auth-view: View the names and privileges of the SPS administrators, the configured usergroups, and the authentication settings in the Users & Access Control menu. Members of this group can also view the history of configuration changes.

  • auth-write: Edit authentication settings and manage users and usergroups.

    		 Caution:

    Members of the auth-write group, or any other group with write privileges to the Users & Access Control menu are essentially equivalent to system administrators of SPS, because they can give themselves any privilege. Users with limited rights should never have such privileges.

    If a user with write privileges to the Users & Access Control menu gives himself new privileges (for example gives himself group membership to a new group), then he has to relogin to the SPS web interface to activate the new privilege.

  • search: Browse and download various logs and alerts in the Search menu. The members of this group have access to the audit trail files as well. Note that to open encrypted audit trail files, the proper encryption keys are required.

  • changelog: View the history of SPS configuration changes in the Users & Access Control > Configuration History menu.

  • report: Browse, create and manage reports, and add statistics-based chapters to the reports in the Reports menu. Users with this privilege can access every report. To grant access to users only to specific reports, use the Reports are accessible by the following groups option of the report. For details, see Configuring custom reports.

    NOTE: To control exactly which statistics-based chapters and reports can the user include in a report, use the Use static subchapters privileges.

  • policies-view: View the policies and settings in the Policies menu.

  • policies-write: Edit the policies and settings in the Policies menu.

  • ssh-view: View all connection and policy settings in the SSH Control menu.

  • ssh-write: Edit all connection and policy settings in the SSH Control menu.

  • rdp-view: View all connection and policy settings in the RDP Control menu.

  • rdp-write: Edit all connection and policy settings in the RDP Control menu.

  • telnet-view: View all connection and policy settings in the Telnet Control menu.

  • telnet-write: Edit all connection and policy settings in the Telnet Control menu.

  • vnc-view: View all connection and policy settings in the VNC Control menu.

  • vnc-write: Edit all connection and policy settings in the VNC Control menu.

  • indexing: Allows hosts running external indexers to access and download audit trails for automatic indexing. Note that the members of this group can access the SPS web interface as well, and download any audit trail directly.

  • ica-view: View all connection and policy settings in the ICA Control menu.

  • ica-write: Edit all connection and policy settings in the ICA Control menu.

  • http-view: View all connection and policy settings in the HTTP Control menu.

  • http-write: Edit all connection and policy settings in the HTTP Control menu.

  • indexer-view: View all connection and policy settings in the Indexer menu.

  • indexer-write: Edit all connection and policy settings in the Indexer menu.

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen