Chatee ahora con Soporte
Chat con el soporte

One Identity Safeguard for Privileged Passwords 8.0 LTS - Administration Guide

Introduction System requirements Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home page Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms Importing objects
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Vaults Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

KVM-deployment

  1. Build a disk image for the KVM platform in SPP Coordinator.

  2. Go to Virtual machines and click Import VM

  3. Enter a name for the virtual machine (VM).

  4. Select the disk image with qcow extension.

  5. Select Windows 10 for the operating system

  6. Assign at least 15GB of memory.

  7. Unselect Immediately start VM.

  8. Click Import.

  9. Go back to Virtual machines page and select the newly created VM.

  10. Go to Network interfaces.

  11. Make sure that you have two network interfaces for the VM.

    The first network adapter is X0

    The second network adapter is MGMT. To maintain security, this network adapter should not be attached to the same network that is used by X0.

    To add and configure network interfaces:

    1. Click Add network interfaces.

    2. Set the Interface type.

    3. Set Source to the value that you dedicated for KVM.

    4. Set Model.

    5. Set MAC address to Generate automatically.

    6. Click Add.

  12. Increase the vCPUs count at least to 4.

  13. Power on/run the VM.

  14. When the initial screen appears in the VNC console, set up the VM similar to other hypervisors, for more information, see Setting up the virtual appliance.

Cloud deployment considerations

Safeguard for Privileged Passwords can be run from the cloud.

Before you start: platforms and resources

When setting up a virtual environment, carefully consider the configuration aspects such as CPU, memory availability, I/O subsystem, and network infrastructure to ensure the virtual layer has the necessary resources available. See One Identity's Product Support Policies for more information on environment virtualization.

Platforms that have been tested with the cloud deployments follow.

For these deployments, the minimum resources used in test are 4 CPUs, 10 GB RAM, and a 60 GB disk. Choose the appropriate machine and configuration template. For example, when you click Create in the Azure Marketplace, default profiles display. You can click Change size to choose a different template. Whereas in OCI, select a supported shape to allocate the appropriate resources for your instance.

Restricting access to the web management kiosk for cloud deployments

The web management kiosk runs on port 9337 in AWS, Azure, Google Cloud Platform , and OCI, and is intended for diagnostics and troubleshooting by Appliance Administrators.

CAUTION: The Management web kiosk is available via HTTPS port 9337 for cloud platforms (including AWS, Google Cloud, OCI, and Azure). The Management web kiosk gives access to functions without authentication, such as pulling a support bundle or rebooting the appliance. In AWS and OCI, all ports are denied unless explicitly allowed. To deny access to port 9337, the port should be left out of the firewall rules. If the port is used, firewall rules should allow access to targeted users.

Azure: Block port 9337

Use the following steps to block access to port 9337 in Azure.

  1. Navigate to the virtual machine running Safeguard for Privileged Passwords.

  2. In the left hand navigation menu select Networking.

  3. Click Add inbound port rule.

  4. Configure the inbound security rule as follows:

    Source: Any

    Source port ranges: *

    Destination: Any

    Destination port ranges: 9337

    Protocol: Any

    Action: Deny

    Priority: 100 (use the lowest priority for this rule)

    Name: DenyPort9337

  5. Click Add.

AWS: Block port 9337

Use the following steps to block access to port 9337 in AWS.

  1. From the EC2 Dashboard, navigate to the EC2 Instance running Safeguard for Privileged Passwords.

  2. Select the instance.

  3. In the Description tab, locate the Security groups field and click the name of the security group.

  4. Select the Inbound tab.

  5. Click Edit.

  6. Remove any existing rules and add the following rules:

    • Type: Custom UDP Rule

      Protocol: UDP

      Port Range: 655

      Source: Anywhere

      Description: Cluster VPN

    • Type: HTTPS

      Protocol: TCP

      Port range: 443

      Source: Anywhere

      Description: Web API

    • Type: Custom TCP Rule

      Protocol: TCP

      Port Range: 8649

      Source: Anywhere

      Description: SPS Cluster

  7. Click Save.

Google Cloud Platform: Block port 9337

Use the following steps to block access to port 9337 in Google Cloud Platform.

  1. In the Navigation menu, navigate to VPC Network > Firewall.

  2. Under Cloud NGFW, click Firewall policies and scroll down to Network firewall policies.

  3. Click on your policy, then click Create firewall rule and set the following:

    • Priority: 1

    • Action on match: Deny

    • Source, IP ranges: 0.0.0.0/32

    • Destination, Protocols and ports: Specified protocols and ports

      Protocol: TCP

      Ports: 9337

  4. Click Create.

OCI: Block port 9337

Use the following steps to block access to port 9337 in OCI.

  1. Navigate to the Virtual Cloud Network assigned to the instance running Safeguard for Privileged Passwords.

  2. Navigate to the Subnet assigned to the instance.

  3. Open the Security List for the subnet.

  4. Ensure no ingress rules allow for traffic from any source (with any IP Protocol) to destination port 9337. Review the ingress rules carefully as they might apply to a range of destination ports instead of explicitly listing port 9337.

AWS deployment

IMPORTANT: Before deploying, make sure you have read Cloud deployment considerations.

Safeguard for Privileged Passwords (SPP) can be run in the cloud using Amazon Web Services (AWS).

To deploy the Amazon Machine Image (AMI) of Safeguard for Privileged Passwords from AWS, visit the AWS marketplace listing for Safeguard for Privileged Passwords (here) and follow the Deployment steps.

Disk size considerations

CAUTION: Before making any changes to the disk size, shut down the VM (stopped and deallocated).

Safeguard for Privileged Passwords deploys with a minimal OS disk size. You should increase the size of the OS disk based on your estimated usage and budget. SPP on hardware comes with 1 TB of disk. You can use more or less than this depending on how many assets, accounts, and daily users you expect to have. 500 GB is a minimal production disk size and 2 TB is the maximum.

Disk size can be handled through Amazon Elastic Compute Cloud (Amazon EC2). For more information, see Getting Started with Amazon EC2. When you start up the VM, SPP automatically resizes the OS disk volume to use the available space.

AWS security considerations

Running Safeguard for Privileged Passwords in AWS comes with some security considerations that do not apply to the hardware appliance. We recommend:

  • Do not give SPP a public IP address.
  • Use the AWS key vault to encrypt the disk.

  • Limit access within AWS to the SPP virtual machine. SPP in AWS cannot protect against rogue Administrators in the same way the hardware appliance can.

Static IP address required

Configure the SPP VM with a static IP address in AWS. In AWS, the IP address must not change after the VM is deployed. If you need to change the IP address, take a backup, deploy again, and restore the backup. You can script the VM deploy to pick up an existing virtual NIC with the IP address configuration. For details, see the Amazon Virtual Private Cloud (VPC) documentation.

Deployment steps

AWS automatically licenses the operating system during the deployment with an AWS KMS.

Larger deployments warrant larger sizing choices. Safeguard for Privileged Passwords hardware appliances have 32GB of RAM and 4 processors with at least 1 TB of disk space.

AWS Marketplace steps

  1. Go to the AWS marketplace listing for Safeguard for Privileged Passwords (here).

  2. On the One Identity Safeguard for Privileged Passwords page, click Continue to Subscribe.

  3. Advance through the resource creation screens to configure your instance. In addition to the Disk size considerations, AWS security considerations, and Static IP address required; One Identity recommends you select the m4.2xlarge instance type.

  4. Once you have finished configuring the instance, select to launch the instance.

    NOTE: The instance launch process may take a while to complete.

  5. Once the instance has finished launching, log into the web client using your static IP address. You will need to use the default username (admin) and password (<instance id>). You should change the admin password immediately. For more information, see Setting a local user's password..For details, see Setting a local user's password in the Safeguard for Privileged Passwords Administration Guide.

    NOTE: The password is unique for each deployment and the initial password will always be the instance ID of the deployed SPP server.

View or change the cloud virtual appliance setup

You can view or change the virtual appliance setup.

You can use the Safeguard for Privileged Passwords web management kiosk on port 9337 for diagnostics and troubleshooting.

You can also check the system logs via AWS:

  1. To view the system log from AWS, select Actions, then Instance Settings, and then Get System Log.

  2. Log in via https://<your IP>:9337

To patch to a new version, use the API.

Azure deployment

IMPORTANT: Before deploying, make sure you have read Cloud deployment considerations.

Safeguard for Privileged Passwords (SPP) can be run in the cloud using Azure. A version of Safeguard for Privileged Passwords is available in the Azure Marketplace and an Azure Virtual Machine (VM) is required. See Windows virtual machines in Azure for details of setting up your VM.

When using Azure, Safeguard for Privileged Passwords is available on HTTPS X0. The Azure deployment does not use the MGMT service. The Recovery (Serial) Kiosk is used to view appliance information, Administrator password reset, power restart or shut down, and generating a support bundle. For more information, see Recovery Kiosk (Serial Kiosk).Recovery Kiosk (Serial Kiosk) in the Safeguard for Privileged Passwords Administration Guide.

Disk size considerations

CAUTION: Before making any changes to the disk size, shut down the VM (stopped and deallocated).

Safeguard for Privileged Passwords deploys with a minimal OS disk size. You should increase the size of the OS disk based on your estimated usage and budget. SPP on hardware comes with 1 TB of disk. You can use more or less than this depending on how many assets, accounts, and daily users you expect to have. 500 GB is a minimal production disk size and 2 TB is the maximum.

  1. Deploy SPP.

  2. Verify you can log in.

  3. Shut down the VM (stopped and deallocated).

  4. Follow Microsoft’s guidance for increasing the disk size: How to expand the OS drive of a virtual machine.

When you start up the VM, SPP automatically resizes the OS disk volume to use the available space.

Azure security considerations

Running Safeguard for Privileged Passwords in Azure comes with some security considerations that do not apply to the hardware appliance. We recommend:

  • Do not giveSPP a public IP address.

  • Use the Azure key vault to encrypt the disk.

  • Limit access within Azure to the SPP virtual machine. SPP in Azure cannot protect against rogue Administrators in the same way the hardware appliance can.

Static IP address recommended

Configure the SPP VM with a static IP address in Azure. In Azure, the IP address must not change after the VM is deployed. If you need to change the IP address, take a backup, deploy again, and restore the backup. You can script the VM deploy to pick up an existing virtual NIC with the IP address configuration. For details, see Microsoft’s Virtual Network documentation.

Deployment steps

Safeguard for Privileged Passwords is deployed from the Azure Marketplace. Azure automatically licenses the operating system during the deployment with an Azure KMS.

The Azure base image includes the required configuration necessary to deploy into Azure following Microsoft's guidance, Prepare a Windows VHD or VHDX to upload to Azure.

  1. Log into the Azure portal.

  2. Under Azure services, click Create a resource.

  3. Search for “One Identity Safeguard for Privileged Passwords” and click the tile.

  4. On the One Identity Safeguard for Privileged Passwords screen, click Create.

  5. Advance through the resource creation screens. Considerations follow:

    • For small deployments, it is recommended to choose at least VM size Standard D2s v3. Larger deployments warrant larger sizing choices. SPP hardware appliances have 32 GB of RAM and 4 processors with at least 1 TB of disk space.

    • You must set an administrator user name and password as part of the image creation, however, SPP will disable this account during initial setup.

    • Set public inbound ports to None.

    • Choose your Windows licensing option.

    • Make sure to enable boot diagnostics and the serial kiosk. The Azure Serial console will be used to provide access to the Safeguard Recovery Kiosk.

  6. Once you are finished configuring the VM, click Create. Azure will deploy the SPP virtual machine.

  7. When the virtual machine deployment is finished, SPP will automatically start initializing and configuring itself for the first use. This usually takes between 5-30 minutes, depending on the VM sizing. During initialization, SPP will enable the firewall and disable remote access to the VM. You can monitor the progress of initialization from the Azure Serial console. While the initialization is running, do not log in to the VM or power off or restart the VM.

  8. When initialization is complete, you will see the Safeguard Recovery (Serial) Kiosk on the Azure Serial console screen.

  9. Log in to the appliance via the web using the default username and password admin / Admin123. You should change the admin password immediately. For more information, see Setting a local user's password..For details, see Setting a local user's password in the Safeguard for Privileged Passwords Administration Guide.

  10. After clustering, change the trusted servers, CORS and redirects setting.

    As a best practice, after you have created your Safeguard for Privileged Passwords cluster (or if just using a single VM), change the Trusted Servers, CORS and Redirects setting to the empty string or a list of values to integration applications you wish to allow. For more information, see Trusted Servers, CORS and Redirects in the Safeguard for Privileged Passwords Administration Guide.

View or change the cloud virtual appliance setup

You can view or change the virtual appliance setup.

The Administrator uses the Recovery Kiosk (Serial Kiosk) to perform the following.

  • Get appliance information

  • Reset the Administrator password

  • Restart or shut down the virtual appliance

  • Generate a support bundle

  • Resolve a quarantine (for more information, see What do I do when an appliance goes into quarantineWhat do I do when an appliance goes into quarantine in the Safeguard for Privileged Passwords Administration Guide).

For more information, see Recovery Kiosk (Serial Kiosk).Recovery Kiosk (Serial Kiosk) in the Safeguard for Privileged Passwords Administration Guide.

To patch to a new version, use the API.

Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación