Chatta subito con l'assistenza
Chat con il supporto

Safeguard for Privileged Sessions On Demand Hosted - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing IPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers and operating systems The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving and cleanup Using plugins Forwarding data to third-party systems Starling integration
User management and access control Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received Using UPN usernames in audited SSH connections
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Displaying the privileges of users and user groups

One Identity Safeguard for Privileged Sessions (SPS) version 3.2 and later provides an interface to query the user-rights and privileges of individual users and user groups. To display the privileges of a user or usergroup, navigate to Users & Access Control > Access Rights Report, enter the name of the user or group into the respective field, then click Filter. Note that:

  • It is not possible to filter on both the username and the group at the same time.

  • Partial matches are also displayed.

  • Usergroups can be local usergroups, userlists, or LDAP usergroups.

Web interface permissions

For usergroups accessing the SPS web interface, a table is displayed that lists the pages of the SPS web interface that the user or usergroup can access. The following information is displayed:

  • Page: The name of the page or group of pages, for example, Basic Settings.

  • Element: If a group has access only to a section of a page, the name of the element is listed here. For example, a particular Channel Policy.

  • Group: The name of the usergroup.

  • Permission: The type of access that the user or usergroup has to the page: read or read and write/perform.

Figure 100: Users & Access Control > Access Rights Report — Displaying web interface permissions

Connection permissions

To review which servers a user or usergroup can access, SPS collects the main information about the connections the user or group is permitted to use. The following information is displayed.

NOTE:

To display the usergroups that can access a specific Connection Policy, open the Connection Policy, then on the Connections page, select Show connection permissions > Show.

Figure 101: Users & Access Control > Connection permissions — Displaying connection permissions

  • Gateway group: Lists the group memberships required to access the connection. Group memberships can be restricted at the following places:

    • Connection > Gateway authentication > Groups

    • Channel Policies > Gateway group

    • Policies > Usermapping Policies > Groups

  • Source: Refers to the following field from the session database:

    Source IP: The IP address of the client.

  • To: Refers to the following field from the session database:

    Destination IP: The IP address of the server as requested by the client.

  • To port: Refers to the following field from the session database:

    Destination port: The port number of the server as requested by the client.

  • Target: Refers to the following field from the session database:

    Server IP: The IP address of the server connected by SPS.

  • Target port: Refers to the following field from the session database:

    Server port: The port number of the server connected by SPS.

  • Remote user: Refers to the following field from the session database:

    Username on server: The username used to log in to the remote server. This username can differ from the client-side username if usermapping is used in the connection. For details on usermapping, see Configuring usermapping policies.

  • Remote group: The group that can access the destination server, as set in the Usermapping Policy (if any).

  • Protocol: The protocol used in the connection (Citrix ICA, HTTP, RDP, SSH, Telnet, or VNC).

  • Connection: Refers to the following field from the session database:

    Connection policy ID: The identifier of the connection policy.

  • Authorizer: Refers to the following field from the session database:

    Four-eyes authorizer: The username of the user who authorized the session. Available only if 4-eyes authorization is required for the channel. For details on 4-eyes authorization, see Configuring four-eyes authorization.

  • Auth type: The authentication method used in the client-side connection during gateway authentication.

  • Channel: The type of the channel, for example, session-shell.

  • Time: The name of the Time Policy used in the connection.

  • LDAP: The name of the LDAP Server used in the connection (if any).

  • Credential store: The name of the Credential Store used in the connection (if any).

  • Audit: Indicates if the connection is recorded into audit trails.

Usergroup memberships

When searching for users, the table displays the group memberships of the matching users. When searching for usergroups, the table displays the members of the matching groups. The following information is displayed:

  • User: The username of the user.

  • Group: The name of the usergroup or userlist.

  • Exception: Usernames that are denied in case of default-deny userlists managed locally on SPS.

Figure 102: Users & Access Control > Connection permissions — Displaying usergroup and userlist memberships

Listing and searching configuration changes

One Identity Safeguard for Privileged Sessions (SPS) automatically tracks every change of its configuration. To display the history of changes, select Users & Access Control > Configuration History. The changes are displayed on a search interface. For more information on using and customizing this interface, see Using the internal search interface.

The following information is displayed about each modification:

Figure 103: Users & Access Control > Configuration History — Browsing configuration changes

  • Timestamp: The date of the modification.

  • Author: Username of the administrator who modified the configuration of SPS.

  • Page: The menu item that was modified.

  • Field name: The name of the field or option that was modified.

  • New value: The new value of the configuration parameter.

  • Message: The changelog or commit log that the administrator submitted. This field is available only if the Require commit log option is enabled (see below).

  • Old value: The old value of the configuration parameter.

  • Swap: Signs if the order of objects was modified on the page (for example the order of two policies in the list).

To request the administrators to write an explanation to every configuration change, navigate to Users & Access Control > Settings > Accounting settings and select the Require commit log option.

Using the internal search interface

The internal search interface is for browsing and filtering the configuration changes and reports of One Identity Safeguard for Privileged Sessions (SPS).

Figure 104: Users & Access Control > Configuration History — The internal search interface

The bars display the number of results in the selected interval. Use the and icons to zoom, and the arrows to display the previous or the next intervals. To explicitly select a date, select Jump to and set the date in the calendar. You can change the length of the displayed interval with the Scale option.

Hovering the mouse above a bar displays the number of entries and the start and end date of the period that the bar represents. Click a bar to display the entries of that period in the table. Use Shift+Click to select multiple bars.

If data is too long to fit on one line, it is automatically wrapped and only the first line is displayed. To expand a row, click . To shrink the row back to its original size, click . To expand/shrink all rows, click the respective button on the header of the table. The rows can also be expanded/shrunk by double clicking on the respective row.

Filtering

The tables can be filtered for any parameter, or a combination of parameters. To filter the list, enter the filter expression in the input field of the appropriate column, and pressEnter, or click on an entry in the table.

NOTE: When you use filters, the bars display the statistics of the filtered results.

Filtering displays also partial matches. For example, filtering the Author column on the Users & Access Control > Configuration History screen for adm displays all changes performed by users whose username contains the adm string.

You can use the icon to perform an exact search, and the icon for inverse filtering ("does not include"). To clear filters from a column, click .

To restore the original table, click Clear all filters.

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione