Required minimum version of encrypted protocol
You can now configure the required minimum version of the default web listener.
The default setting is TLS 1.2. You can configure SPS to use TLS 1.0, but it is not advised, because there are known serious attacks against TLS (for details, see: https://tools.ietf.org/html/rfc7457).
For more information, see "Configuring user and administrator login addresses" in the Administration Guide.
Boot messages and upgrade logs displayed on web interface
In addition to displaying upgrade logs and boot messages on the local console, SPS now shows information about the upgrade and reboot processes on the web interface, too. The information displayed in the browser and on the console is the same. For details, see "Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown" in the Administration Guide and "Upgrade checklist" in the Administration Guide.
|
|
NOTE:
This feature is enabled after the first boot to version 5 F2 or later. So during the upgrade from 5.0 to version 6.0, you will not be able to see any upgrade logs on the web interface. |
Maximum Transmission Unit (MTU) for network interfaces
To support deployment in more complex networking environments, it is now possible to set the MTU for each network interface individually. For details, see "Network settings" in the Administration Guide and "Managing logical interfaces" in the Administration Guide.
Other changes
-
When using X.509 certificates to authenticate on the SPS web interface, SPS can now extract the name of the user from the UserPrincipalName field of the certificate. For details, see "Authenticating users with X.509 certificates" in the Administration Guide.
- Command detection and window title detection in content policies have changed and they are case-insensitive as of SPS version 5.8.0. In earlier versions, both used to be case-sensitive. For more information, see "Creating a new content policy" in the Administration Guide.
- The Indexing history section on the Indexer > Indexer status page has been removed and it is now possible to search for indexing details. For more information about the indexing search filters that you can use, see "List of available search filters" in the Administration Guide.
-
Alerts defined in Content Policies are now only sent out again if there is change in the matched screen contents to avoid flooding security administrators with alerts.
- The script used for exporting and importing the configuration of SPS through the console has changed, it is now: /opt/scb/bin/configbundle.py. As a result, the required commands have changed, too. For details, see "Exporting and importing the configuration of SPS using the console" in the Administration Guide.
- It is now possible to upload a certificate chain when configuring a remote syslog server to send system log messages to. This is handled both on the web interface and the REST API of SPS. For details, see "Configuring system logging" in the Administration Guide.
-
It is now possible to specify the base DN of LDAP subtrees for users and for groups separately. Specifying a sufficiently narrow base for the LDAP subtrees can speed up LDAP operations. For details, see "Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database" in the Administration Guide and "Authenticating users to an LDAP server" in the Administration Guide.
-
Backup policies can be configured to run more than once a day.
-
You can now select which Server Message Block protocol version to use in the Archive and Backup policies if your server uses SMB/CIFS.