Procedure

Telnet settings determine the parameters of the connection on the protocol level, including timeout value, and so on. Complete the following procedure to create a new Telnet settings profile or edit an existing one:

Caution: Modifying the Telnet settings is recommended only to advanced users. Do not modify these settings unless you exactly know what you are doing.

To create and edit protocol-level Telnet settings

1. Navigate to the Settings tab of the Telnet Control menu item and click to create a Telnet setting profile. Enter a name for the profile (for example telnet_special).

2. Click to display the parameters of the connection.

3. Modify the parameters as needed. The following parameters are available:

   • Network idle timeout: Connection timeout value in seconds. To avoid early timeout, set it to a larger value, for example a week (604800 seconds).

     Even if the user is not active, the session can contain activity that must be audited (for example, the output of a script). The idle timeout period will start only after this activity has stopped.

     Caution: Determining if a connection is idle is based on the network traffic generated by the connection, not the activity of the user. For example, if an application or the taskbar of a graphical desktop displays the time which is updated every minute, it generates network traffic every minute, negating the effects of timeout values greater than one minute and preventing One Identity Safeguard for Privileged Sessions (SPS) from closing the connection.

   • User idle timeout: If no user activity is detected, terminate the session after the configured time has passed since the last user activity.

     This can be useful if only user-generated network traffic is important in a session. By using this option, situations described in the caution of Network idle timeout (such as a taskbar clock keeping the network traffic open indefinitely) can be avoided. To enable user idle timeout, select Enable user idle timeout and enter a value that is greater than or equal to the value of Network idle timeout.

   • Enable pre channel check: Select this option to evaluate the connection and channel policies before establishing the server-side connection. That way if the connection is not permitted at all, SPS does not establish the server-side connection.

   • To configure TLS security settings on both the Client side and the Server side, proceed to TLS security settings.

     Figure 257: <Protocol> Control > Settings > TLS security settings - configuring TLS security settings

     

     • Cipher strength specifies the cipher string OpenSSL will use. The following options are possible:

       • Recommended: this setting only uses ciphers with adequate security level.

       • Custom: this setting allows you to specify the list of ciphers you want to permit SPS to use in the connection. This setting is only recommended to ensure compatibility with older systems. For more details on customizing this list, check the 'openssl-ciphers' manual page on your SPS appliance.

         For example: ALL:!aNULL:@STRENGTH

     • Minimum TLS version specifies the minimal TLS version SPS will offer during negotiation. The following options are possible:

       • TLS 1.2: this setting only offers TLS version 1.2 during the negotiation. This is the recommended setting.

       • TLS 1.1: this setting offers TLS version 1.1 and later versions during the negotiation.

       • TLS 1.0: this setting offers TLS version 1.0 and later versions during the negotiation.

       NOTE: Setting up sessions to legacy systems that do not support at least TLS 1.2 is only possible when the security level of the connection is degraded to 0, which is possible by specifying the TLS ciphers manually and appending the string `:@SECLEVEL=0` to the cipher list. However, this setting also enables the use of known vulnerable algorithms and key sizes, therefore it is absolutely critical to only use such connection settings when it is necessary and when you can fully trust your network between SPS and the legacy system. It is strongly recommended to use different security settings on the server and the client side of the connection, when degrading the security level of a connection is unavoidable.

     NOTE: Note that SPS only permits TLS-encrypted connections. SSLv3 is not supported.

4. Click .

5. To display a banner message to the clients before authentication, enter the message into the Banner field. For example, this banner can inform the users that the connection is audited.

6. Select this settings profile in the TELNET settings field of your connections.