Chatta subito con l'assistenza
Chat con il supporto

One Identity Safeguard for Privileged Passwords 8.0 LTS - Administration Guide

Introduction System requirements Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home page Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms Importing objects
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Vaults Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

Asset Management

In the web client, expand the Asset Management section in the left navigation pane.

Account Automation

Also available as a pane on the Home page, the Asset Management > Account Automation page allows Asset Administrators to view information regarding accounts that are failing or succeeding different types of tasks. This page includes both automated and manual tasks in the results. Clicking one of the tasks on the view displays additional information.

Click the button to customize the tasks that are displayed.

Account Automation: Toolbar

After selecting a task to view additional information, use the toolbar at the top of the details grid to perform the following tasks.

  • View Details: After selecting a task from the table, click this button to view additional information on the task.
  • Re-Run Task: Available for failed tasks only, select to rerun the selected task.
  • Remove: Available for failed tasks only, select to remove the selected task.
  • Export: Select to create a .csv or .json file of the currently displayed account automation grid and save it to a location of your choice. For more information, see Exporting data.
  • Refresh: Select to refresh the data displayed in the table.
  • Columns: Select to display a list of columns that can be displayed in the grid. Select the check box for data to be included in the grid. Clear the check box for data to be excluded from the grid.

Accounts

A Safeguard for Privileged Passwords account is a unique identifier that Safeguard for Privileged Passwords uses to control access to assets. Managed accounts (including directory accounts and service accounts) and groups of accounts can be associated with an asset. Each account has an associated asset; if you delete an asset, Safeguard for Privileged Passwords permanently deletes all the accounts associated with it.

The Auditor and the Asset Administrator have permission to access Accounts.

On Unix assets, the accounts are stored in etc/passwd; however, each platform implements this concept differently.

Service accounts are designated with a Service Account icon. For more information, see About service accounts.

To access Accounts, in the web client, navigate to Asset Management > Accounts. If needed, you can use the partition drop-down to select the parent partition of the account. Select an account, then click to display additional information and options.

Selecting one of the accounts displays the following information:

  • Properties (account): Displays general information about the selected account. It also allows you to manage Passwords, SSH keys, API keys, and TOTP authenticators for the account.

  • Owners tab (account): Displays information about the owners of the account.

  • Dependent Assets (account): (Directory assets) Displays the assets that have dependency on the selected directory account. This tab only displays for a directory asset and displays the assets that have dependency on the selected directory account.

  • Check and Change Log tab (account): Displays the password and SSH key validation and reset history for the selected account.
  • Discovered Services tab (account): (Windows and Active Directory accounts) Displays information on the services dependent to a selected account.

  • Discovered SSH Keys (account): Displays the SSH keys discovered on the account.

  • History tab (account): Displays the details of each operation that has affected the selected account.

For information about configuring Account Discovery in Safeguard for Privileged Passwords, see Account Discovery job workflow.

Use these toolbar buttons to manage accounts.

  • New Account: Add accounts to Safeguard for Privileged Passwords. Adding an account.

  • Delete: Remove the selected account. Deleting an account.

  • View Details: Select an account then click this button to open additional information and options for the account.

  • Account Secrets: Possible menu options include:

    • Check Password

    • Change Password

    • Check SSH Key

    • Change SSH Key

  • Access Request: Allows you to enable or disable access request services for the selected account. Menu options include:

    • Enable Password Request

    • Disable Password Request

    • Enable Session Request

    • Disable Session Request

    • Enable SSH Key Request

    • Disable SSH Key Request

    • Enable API Key Request

    • Disable API Key Request

  • Discover SSH Keys: Run the SSH Key Discovery job.

  • Show Disabled: Display the accounts that are not managed and are disabled and have no associated assets.

    • Click Disable to prevent Safeguard for Privileged Passwords from managing the selected account.

    • Click Enable to manage the selected account and assign it to the scope of the default profile.

  • Hide Disabled: Hide the accounts that are not managed and are disabled and have no associated assets.

    • Click Disable to prevent Safeguard for Privileged Passwords from managing the selected account.

    • Click Enable to manage the selected account and assign it to the scope of the default profile.

  • Import: Click this to open a drop-down menu from which you can select to add accounts, passwords, or SSH keys to One Identity Safeguard for Privileged Passwords using a CSV file. For more information, see Importing objects.

  • Export: Use this button to export the listed data as either a JSON or CSV file. For more information, see Exporting data.

  • Refresh: Update the list of accounts.

  • Search: You can search by a character string or by a selected attribute with conditions you enter. To search by a selected attribute click Search and select an attribute to search. For more information, see Search box.

Properties (account)

The Properties tab lists information about the selected account.

To access Properties:

  • web client: Navigate to Asset Management > Accounts > (View Details) > Properties.

Information for the account displays. Not all the information listed below is applicable for every account.

The following options are available on the top of the Properties tab:

  • Discover SSH Keys: Use this option to run the selected SSH Key Discovery job.
  • Enable-Disable: Select one of the following:

    Select Enable to have Safeguard for Privileged Passwords manage a disabled asset. Account Discovery jobs find all accounts that match the discovery rule's criteria regardless of whether it has been marked Enabled or Disabled in the past.

    Select Disable to prevent Safeguard for Privileged Passwords from managing the selected asset. When you disable an asset, Safeguard for Privileged Passwords disables it and removes all associated accounts. If you choose to manage the asset later, Safeguard for Privileged Passwords re-enables all the associated accounts.

The following fields and options display on the secondary tabs on the Properties tab based on the type of asset (for example, Windows, Linux, LDAP, or Active Directory). Clicking the Edit button on one of the secondary tabs allows you to edit the account.

Table 72: Accounts Properties tab: General properties
Property Description
Name The name of the selected account.

Description

Description of the selected account.

Asset

The display name of the managed system associated with this account. Accounts are only associated with one asset.

Table 73: Accounts Properties tab: Management properties
Property Description
Access Requests Indicates which type(s) of access requests are enabled for this account.

Password Profile

The name of the password profile that governs the accounts assigned to a partition.

When a password profile is inherited from an asset or partition this will be indicated by the text (Inherited) next to the name of the password profile. When the password profile is explicitly set, a button will appear that allows you to clear the explicitly set password profile and instead use the inherited password profile.

SSH Key Profile

The name of the SSH key profile.

When an SSH key profile is inherited from an asset or partition this will be indicated by the text (Inherited) next to the name of the SSH key profile.

When the SSH key profile is explicitly set, a button will appear that allows you to clear the explicitly set SSH key profile. Once the cleared profile change is applied, the assigned inherited profile will be displayed. If there is no default SSH key profile designated for the partition, the asset will no longer have an SSH key profile assigned. If there is no SSH key profile explicitly set on the asset, the accounts on that asset will no longer have an SSH key profile assigned. Designating a default SSH key profile for the partition will ensure all assets and accounts in that partition have an inherited SSH key profile.

Table 74: Accounts Properties tab: Secrets properties
Property Description
Passwords

This tile is for managing the password for the account. The following options are available from the tile:

  • View Archive: Available once a password has been set, clicking this link displays previously assigned passwords for the selected asset. This dialog does not display the current password for the asset. The password archive is never purged. For more information, see Viewing password archive.

  • Set: Click this button to set the account password in the Safeguard for Privileged Passwords database. The Set option does not change the account password on the asset.

  • Check: Click this button to verify the account password is in sync with the Safeguard for Privileged Passwords database. If the password verification fails, you can change it.

  • Change: Click this button to reset and synchronize the account password with the Safeguard for Privileged Passwords database.

For more information, see Checking, changing, or setting an account password.

TOTP Authenticator

This tile is for managing the TOTP Authenticator for the account. The following options are available from the tile:

SSH keys

This tile is for managing the SSH keys for the account. The following options are available from the tile:

  • View Archive: Available once an SSH key has been set, clicking this link displays previously assigned SSH keys for the selected asset. This dialog does not display the current SSH key for the asset. The SSH key archive is never purged. For more information, see Viewing SSH key archive.

  • Set: Click this button to set the SSH key in the Safeguard for Privileged Passwords database. The Set option does not change the account SSH key on the asset.

  • Check: Click this button to verify the account SSH key is in sync with the Safeguard for Privileged Passwords database. If the SSH key verification fails, you can change it.

  • Change: Click this button to reset and synchronize the SSH key with the Safeguard for Privileged Passwords database.

For more information, see Checking, changing, or setting an SSH key.

API keys

Viewing API Key Archive

  • New API Key: Click this button to add a new API key to an account. For more information, see Adding an API key.

Each API key configured for the account will have a tile containing the following options:

NOTE: Should 4 or more API keys be configured, the tiles will be condensed into a single summary tile. To access and manage the individual API keys, click the name of the tile (API Keys <n>). This will open a pane containing a table view of the configured API keys as well as toolbar options for managing the keys.

  • View Archive: Click this link to access an archive of the API Key. For more information, see Viewing API Key Archive.

  • Set: Click this button to set the API key in the Safeguard for Privileged Passwords database. The Set option does not change the account SSH key on the asset.
  • Check: Click this button to verify the account SSH key is in sync with the Safeguard for Privileged Passwords database. If the SSH key verification fails, you can change it.

  • Change: Click this button to reset and synchronize the SSH key with the Safeguard for Privileged Passwords database.

  • (Remove): Click this button to remove a previously configured API Key.

For more information, see Checking, changing, or setting an API key.

Files

This tile is for managing the files for the account. The following options are available from the tile:

  • View Details: Available after a file has been set, clicking this link displays previously assigned file for the selected account.

    View Archive: Available after a file has been set, clicking this link displays previously assigned files for the selected account.

    Set: Click this button to set the file.

Tags: Tag assignments for the selected account.

The information displayed in the Tags pane includes both the dynamic tags added through tagging rules and static tags that were added manually. In addition to viewing tag assignments, Asset Administrators can add and remove statically assigned tags.

Delete: Click this button to delete the selected account.

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione