Chatee ahora con Soporte

Obtener ayuda en vivo
Completar registro

Iniciar sesión

Solicitar precios

Comuníquese con Ventas

One Identity Safeguard for Privileged Passwords 7.0 LTS - Administration Guide

Navegación de contenido

Introduction to Safeguard for Privileged Passwords

Overview of the entities

Appliance specifications

System requirements and versions

Web client system requirements Web management console system requirements Supported platforms Licenses Long Term Support (LTS) and Feature Releases

Using API and PowerShell tools

Customize the response using API query parameters

Using Safeguard PowerShell

Using the virtual appliance and web management console

Setting up the virtual appliance Virtual appliance backup and recovery Support Kiosk

Cloud deployment considerations

AWS deployment Azure deployment Virtual appliance backup and recovery

Setting up Safeguard for Privileged Passwords for the first time

Step 1: Create the Authorizer Administrator Step 2: Authorizer Administrator creates administrators Step 3: Appliance Administrator configures the appliance Step 4: User Administrator adds users Step 5: Asset Administrator adds managed systems Step 6: Security Policy Administrator adds access request policies

Using the web client

Change password FIDO2 keys

Application switcher Log out Search box

Search by attribute

My Requests Personal password vault Approvals Reviews Favorites

Privileged access requests

Configuring alerts

Email notifications

Password release request workflow

Requesting a password release

Taking action on a password release request

Approving a password release request Reviewing a completed password release request

SSH key release request workflow

Requesting an SSH key release

Taking action on an SSH key release request

Approving an SSH key release request Reviewing a completed SSH key release request

Session request workflow

About sessions and recordings Requesting session access

Taking action on a session request

Approving a session request Launching the SSH client Launching an RDP session Configuring and launching a Remote Desktop Application session Reviewing a session request

Appliance Management

Appliance Diagnostics Appliance Information

Shutting down the appliance Restarting the appliance Setting the appliance name and Host DNS Suffix

Debug Licensing settings Factory Reset Lights Out Management (BMC) Network Diagnostics

ARP Netstat NS Lookup Ping Show Routes Telnet Throughput Trace Route

Networking Operating System Licensing SSH Algorithms Patch Updates Power Support bundle Time Time Zone

Backup and Retention

About backups Archive servers

Adding an archive server

Audit Log Maintenance Backup and Restore

Run Now Download a backup Upload a backup Restore a backup Archive backup Backup settings Backup protection settings

Backup Retention Authorize VM Compatible Backups

About Certificate Signing Requests (CSRs) Audit Log Signing Certificate

Creating an audit log Certificate Signing Request Installing an audit log certificate

Certificate Signing Request Hardware Security Module Certificates

Installing a Hardware Security Module client certificate Assigning a Hardware Security Module client certificate Uploading a Hardware Security Module server certificate

SMTP Certificate

Creating an SMTP Certificate Signing Request Installing an SMTP certificate

SSL/TLS Certificates

Creating an SSL/TLS Certificate Signing Request Installing an SSL/TLS certificate Assigning an SSL/TLS certificate to appliances

Syslog Client Certificate

Creating a syslog client Certificate Signing Request Installing a syslog client certificate

Trusted CA Certificates

Adding a trusted certificate Removing a trusted certificate

Cluster Management

Unlocking a locked cluster

Managed Networks

Adding a managed network Deleting a managed network Resolving IP address

Offline Workflow (automatic)

Enable automatic Offline Workflow Manually override automatic Offline Workflow

Session Appliances with SPS link

Enable or Disable Services External Integration

Enabling email notifications

Add an email event

Email Templates Hardware Security Module SNMP

Configuring SNMP subscriptions Verifying SNMP configuration

Join Starling After joining Starling Unjoin Starling

Configuring and verifying a syslog server

Add a syslog event subscriber

ServiceNow ticketing system integration Remedy ticketing system integration Not integrated with ticketing system

Trusted Servers, CORS, and Redirects

Real-Time Reports Safeguard Access

Messaging settings

Login Notification Message of the Day

Local Login Control Local Password Rule

Modifying user password requirements

Identity and Authentication

Authentication provider combinations Adding identity and authentication providers

Asset Management

Account Automation Accounts

Properties (account) Owners tab (account) Dependent Assets (account) Check and Change Log tab (account) Discovered SSH Keys (account) History tab (account) Managing accounts

Adding an account Adding a cloud platform account Manually adding a tag to an account Deleting an account Adding users or user groups to an account Checking, changing, or setting an account password Viewing password archive Checking, changing, or setting an SSH key Viewing SSH key archive

Properties tab (asset) Accounts tab (asset) Account Dependencies tab (asset) Owners tab (asset) Discovered SSH Keys (asset) Discovered Services tab (asset) History tab (asset) Managing assets

Adding an asset

General tab (add asset) Connection tab (add asset)

About service accounts About Test Connection SSH Key Directory Account Starling Connect Local System Account Password (local service account) Access Key None

Management tab (add asset) Attributes tab (edit asset)

Checking an asset's connectivity Assigning an asset to a partition Assigning a profile to an asset Manually adding a tag to an asset Adding an account to an asset Adding account dependencies Adding users or user groups to an asset Deleting an asset Account Discovery tab (add asset) Downloading a public SSH key

About profiles Properties tab (partitions) Assets tab (partitions) Accounts tab (partitions) Owners tab (partitions) Password Profiles tab (partitions) SSH Key Profiles tab (partitions) History tab (partitions) Managing partitions

Adding a partition Adding assets to a partition Adding an account to a partition Removing assets from a partition Adding users or user groups to a partition Creating a password profile Creating an SSH key profile Setting a default partition Setting a default profile Assigning assets or accounts to a password profile and SSH key profile Deleting a partition

Asset Discovery

Asset Discovery job workflow Adding an Asset Discovery job

General tab (asset discovery) Information tab (asset discovery) Asset Discovery Rules tab (asset discovery)

Add Condition (asset discovery) Edit Connection Template (asset discovery) Add Asset Profile (asset discovery)

Schedule tab (asset discovery)

Deleting an Asset Discovery job

Asset Discovery Results Account Discovery

Account Discovery job workflow Adding an Account Discovery job

Adding an Account Discovery rule

Deleting an Account Discovery job

Account Discovery Results Discovered Accounts Service Discovery Results Discovered Services SSH Key Discovery

SSH Key Discovery job workflow Adding an SSH Key Discovery job SSH Key Discovery Results Discovered SSH Keys

Password Profiles (profiles)

Properties tab (profiles) Assets tab (profiles) Accounts tab (profiles) View Password Profile Components (profiles)

Managing password profiles

Adding a password profile Password Profiles

Adding check password settings

Change Password

Adding change password settings

Account Password Rules

Adding an account password rule

Password sync groups

Adding a password sync group

Setting a default password profile Deleting a password profile

SSH Key Profiles (profiles)

View SSH Key Profile Components (profiles)

Managing SSH key profiles

Adding an SSH key profile SSH Key Profiles

Check SSH Key settings

Adding SSH key check settings

Change SSH Key settings

Adding SSH key change settings

Discover SSH Key settings

Adding SSH key discovery

SSH Key Sync Groups settings

Adding SSH key sync groups

Setting a default SSH key profile Deleting an SSH key profile

Adding a tag for tagging of assets or asset accounts Deleting an asset or asset account tag Modifying an asset or asset account tag Copying an asset or asset account tag to another partition Viewing asset and asset account tag assignments

Registered Connectors

Adding a registered connector

Custom platforms

Creating a custom platform script Adding a custom platform

Security Policy Management

Access Request Activity Account Groups

Properties tab (account group) Accounts tab (account group) Access Request Policies tab (account group) History tab (account group) Managing account groups

Adding an account group Adding a dynamic account group

General tab (add dynamic account group) Account Rules tab (add dynamic account group)

Adding one or more accounts to an account group Adding accounts to an access request policy Deleting an account group

Application to Application

About Application to Application functionality Setting up Application to Application Adding an application registration Deleting an application registration Regenerating an API key Making a request using the Application to Application service

Cloud Assistant

Adding authorized user for Cloud Assistant

Properties tab (asset group) Assets tab (asset group) Access Request Policies tab (asset group) History tab (asset group) Managing asset groups

Adding an asset group Adding a dynamic asset group

General tab (add dynamic asset group) Asset Rules tab (add dynamic asset group)

Adding assets to an asset group Deleting an asset group

General tab (entitlements) Users tab (entitlements) Access Request Policies tab (entitlements) History tab (entitlements) Managing entitlements

Adding an entitlement How Safeguard for Privileged Passwords evaluates policy when a user submits an access request Creating an access request policy

General tab (create access request policy) Security tab (create access request policy) Scope tab (create access request policy) Workflow tab (create access request policy)

Adding users or user groups to an entitlement Deleting an access request policy Modifying an access request policy Copying an access request policy Deleting an entitlement

Linked Accounts

Users (linked accounts) Accounts (linked accounts) Managing linked accounts

Linking a user to an account Linking an account to a user Removing a linked account from a user Removing a user from a linked account

Properties tab (user groups) Users tab (user groups) Entitlements tab (user groups) History tab (user groups) Managing user groups

Adding a user group Adding a directory user group Adding users to a user group Adding a user group to an entitlement Deleting a user group

Security Policy Settings Reasons

User Management

Properties tab (user) User Groups tab (user) Entitlements tab (user) History (user) Managing users

Identity tab (add user) Authentication tab (add user) Permissions tab (add user)

Requiring secondary authentication log in Adding a user to user groups Adding a user to entitlements Activating or deactivating a user account Deleting a user Setting a local user's password Unlocking a local user's account

Properties tab (user groups) Users tab (user groups) Entitlements tab (user groups) History tab (user groups) Managing user groups

Adding a user group Adding a directory user group Adding users to a user group Adding a user group to an entitlement Deleting a user group

Activity Center

Applying search criteria Saving search criteria and loading previously saved search criteria Generating an activity audit log report Scheduling an activity audit log report Editing or deleting a saved search or scheduled report Viewing event details Auditing request workflow Sorting report results

Entitlement reports Exporting a detailed user entitlement report Ownership reports

Disaster recovery and clusters

Enrolling replicas into a cluster Unjoining replicas from a cluster Maintaining and diagnosing cluster members

About Offline Workflow Mode

Manually control Offline Workflow Mode

Failing over to a replica by promoting it to be the new primary Activating a read-only appliance Diagnosing a cluster member Patching cluster members

About cluster patching

Using a backup to restore a clustered appliance Resetting a cluster that has lost consensus Performing a factory reset Unlocking a locked cluster

Troubleshooting tips

Appliance states

Administrator permissions

Appliance Administrator permissions Asset Administrator permissions Auditor permissions Authorizer Administrator permissions Help Desk Administrator permissions Operations Administrator permissions Security Policy Administrator permissions User Administrator permissions

Preparing systems for management

Preparing ACF - Mainframe systems Preparing Amazon Web Services platforms Preparing Cisco devices Preparing Dell iDRAC devices Preparing VMware ESXi hosts Preparing Fortinet FortiOS devices Preparing F5 Big-IP devices Preparing HP iLO servers Preparing HP iLO MP (Management Processors) Preparing IBM i (AS/400) systems Preparing JunOS Juniper Networks systems Preparing MongoDB Preparing MySQL servers Preparing Oracle databases Preparing PAN-OS (Palo Alto) networks Preparing PostgreSQL Preparing RACF mainframe systems Preparing SAP HANA Preparing SAP Netweaver Application Servers Preparing Sybase (Adaptive Server Enterprise) servers Preparing SonicOS devices Preparing SonicWALL SMA or CMS appliances Preparing SQL Servers Preparing Top Secret mainframe systems Preparing Unix-based systems Preparing Windows systems Preparing WinRM systems Preparing Windows SSH systems Minimum required permissions for Windows assets

Troubleshooting

Appliance is sick Connectivity failures

Change password or SSH key fails Incorrect authentication credentials Missing or incorrect SSH host key No cipher supported error Service account has insufficient privileges

Cannot connect to remote machine through SSH or RDP Cannot delete account Cannot play session message Domain user denied access to Safeguard for Privileged Passwords LCD status messages

Appliance LCD and controls

My Mac keychain password or SSH key was lost Password fails for Unix host Password or SSH key is pending a reset Password or SSH key profile did not run Recovery Kiosk (Serial Kiosk)

Appliance information (Recovery Kiosk) Power options

Rebooting the appliance Shutting down the appliance

Admin password reset Factory reset from the Recovery Kiosk Support bundle

Replica not adding System services did not update or restart after password or SSH key change Test Connection failures

Test Connection failures on archive server Certificate issue Cipher support Domain controller issue Networking issue Windows WMI connection

Timeout errors causing operations to fail User locked out User not notified

Frequently asked questions

How do I audit transaction activity How do I configure external federation authentication

How do I add an external federation provider trust How do I create a relying party trust for the STS How do I add an external federation user account

How do I manage accounts on unsupported platforms How do I modify the appliance configuration settings How do I prevent Safeguard for Privileged Passwords messages when making RDP connections How do I set up telnet and TN3270/TN5250 session access requests How do Safeguard for Privileged Passwords database servers use SSL What are the access request states What do I do when an appliance goes into quarantine When does the rules engine run for dynamic grouping and tagging Why did the password or SSH key change during an open request

Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions About us

Preparing VMware ESXi hosts

Safeguard for Privileged Passwords supports VMware ESXi hosts.

IMPORTANT: Safeguard for Privileged Passwords can only manage local users on a VMware host.

To prepare a VMware ESXi host for Safeguard for Privileged Passwords

Use an existing account or create a new account as the service account on the asset and assign it a password.

The default administrator account is suitable.
Grant the service account the privileges required to set user passwords using the web management API.
When adding a VMware ESXi host to Safeguard for Privileged Passwords:
1. Specify the network address.
2. Specify port 443 as the HTTPS port.

Preparing Fortinet FortiOS devices

Safeguard for Privileged Passwordssupports Fortinet Internet appliances. Safeguard for Privileged Passwords uses the SSH protocol to connect to Fortinet devices.

To prepare a Fortinet FortiOS device for Safeguard for Privileged Passwords

Create the service account as a local user on the managed system and assign it a password.
Add the service account to the Fortinet Administrators group. This allows the service account to access the device with SSH to manage users.

IMPORTANT: Safeguard for Privileged Passwords can only manage passwords for users that are members of the Fortinet Administrators group.
Enable and configure the SSH server to allow the service account to log in remotely.
Add the Fortinet device to Safeguard for Privileged Passwords using password authentication.

Preparing F5 Big-IP devices

Safeguard for Privileged Passwordssupports F5 Big-IP devices. Safeguard for Privileged Passwords uses the SSH protocol to connect to F5 Big-IP devices.

To prepare an F5 Big-IP device for Safeguard for Privileged Passwords

Create the service account as a local user on the F5 Big-IP managed system and assign it a password. Assign that service account the Administrator Role on all partitions. This allows the service account to manage users.
Enable console access by setting Terminal Access to either Advanced or tmsh, which will allow the service account to log in remotely via SSH.
Add the F5 Big-IP device to Safeguard for Privileged Passwords using password or SSH key authentication.

Preparing HP iLO servers

In Safeguard for Privileged Passwords, the HP iLO operating system is an HP Integrated Lights-Out (iLO) HP Proliant server. Safeguard for Privileged Passwords connects to HP iLO systems using SSH. Password check and change is supported. Account discovery is not supported.

To prepare an HP iLO server for Safeguard for Privileged Passwords

Create a service account with the Administrate User Accounts privilege and assign it a password.

The service account must have login privileges and must be able to configure users.
Verify that SSH is enabled.
In Safeguard for Privileged Passwords, create the asset and accounts for the HP iLO server using password authentication.

Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación

© ALL RIGHTS RESERVED. Términos de uso Privacidad Cookie Preference Center