지금 지원 담당자와 채팅
지원 담당자와 채팅

Safeguard for Privileged Passwords On Demand Hosted - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Getting started with the desktop client Using the desktop client Activity Center Search box Privileged access requests Toolbox Accounts Account Groups Assets
General/Properties tab (asset) Accounts tab (asset) Account Dependencies tab (asset) Owners tab (asset) Access Request Policies tab (asset) Asset Groups tab (asset) Discovered SSH Keys (asset) Discovered Services tab (asset) History tab (asset) Managing assets
Asset Groups Discovery Entitlements Linked Accounts Partitions Profiles Settings
Access Request settings Appliance settings Asset Management settings Tags Backup and Retention settings Certificates settings Cluster settings Enable or Disable Services settings External Integration settings Password Management settings Real-Time Reports Safeguard Access settings SSH Key Management settings Security Policy Settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 or later migration guidance Appendix C: SPP and SPS join guidance Appendix D: Regular Expressions About us

Restore a backup

Safeguard for Privileged Passwordsallows you to restore the data on your appliance with data from a selected backup. Safeguard for Privileged Passwords does not restore the appliance IP address, NTP settings, or the DNS settings.

To verify that the settings are correct after a restore, go to:

  • web client: Navigate to Appliance | Appliance Information.
  • desktop client: Navigate to Administrative Tools | Settings | Appliance | Appliance Information.

There are special considerations for restoring a clustered appliance. For more information, see Using a backup to restore a clustered appliance.

Caution: If you restore a backup that is older than the Maximum Password Age set in the Local Login Control settings, all user accounts (including the bootstrap administrator) will be disabled and you will have to reset all of the user account passwords or SSH keys. If your bootstrap administrator's password is locked out, you can reset it from the Recovery Kiosk. For more information, see Admin password reset.

CAUTION: When restoring a backup that was created with a Hardware Security Module integration in place, the encryption key used at the time of the backup creation needs to still be present and accessible by the Safeguard for Privileged Passwords appliance. If not, the appliance will not be able to verify the Hardware Security Module configuration used to encrypt the data in the backup. You will be allowed to continue with the restore, however the Safeguard for Privileged Passwords appliance will most likely Quarantine in the process, so this is not recommended.

Version considerations when restoring a backup

An Appliance Administrator can restore backups as far back as Safeguard for Privileged Passwords version 2.2.0.6958. Only the data is restored; the running version is not changed.

If the administrator attempts to restore a version earlier than 2.2.0.6958, a message like the following displays: Restore failed because the backup version '[version]' is older than the minimum supported version '2.2.0.6958' for restore.

You cannot restore a backup from a version newer than the one running on the appliance. The restore will fail and a message like the following displays: Restore failed because backup version [version] is newer then the one currently running [version].

The backup version and the running version display in the Activity Center logs that are generated when Safeguard starts, completes, or fails a restore.

To restore the Safeguard for Privileged Passwords appliance from a backup

  1. Go to Backup and Restore:
    • web client: Navigate to Backup and Retention | Backup and Restore.
    • desktop client: Administrative Tools | Settings | Backup and Retention | Safeguard Backup and Restore.
  2. Select a backup. If the backup file is not listed, you can  Upload the .sgb backup file. For more information, see Upload a backup.
  3. Click Restore.
    If a problematic condition is detected, Warning for Restore of Backup displays along with details in the Restore Warnings, Warning X of X message. Click Cancel to stop the restore process and address the warning or click Continue to move to the next warning (if any) or complete the process.
  4. If the backup is protected by a password, the Protected Backup Password dialog displays. Type the password in the Enter Backup Password text box. If the password entered is not correct, the OK button is disabled and you cannot proceed. For more information, see Backup protection settings.
  5. When the Restore dialog displays, enter the word Restore in the box and click OK.

    Safeguard for Privileged Passwords automatically restarts the appliance, if necessary.

  6. After restoring from backup verify that the following are set correctly.

    • Check the archive server in the automated backup schedule. If necessary, set the correct archive server. For more information, see Archive backup.

    • Check the archive server in the session archive settings. If necessary, set the correct archive server. If you used the embedded sessions module and had an archive server configured, the archive server must be configured to play back the archived sessions.

    • If you restored a backup to a different appliance, managed networks will no longer have any assigned appliances. Password and SSH key management and discovery tasks will fail. For more information, see Managed Networks.
  7. Once the appliance is fully operational, it asks you to restart the Windows desktop client. All modifications to Safeguard for Privileged Passwords objects since the backup was created will be lost.

Caution: After a restore, requesters, approvers, and reviewers will not have access to any access request workflow events that were in process at the time of the backup. The Activity Center displays those workflow events as incomplete.

Archive backup

Safeguard for Privileged Passwords allows you to store backup files on an external archive server.

To archive a backup file

The archive server must be set up. For more information, see Adding an archive server.

  1. Go to Backup and Restore:
    • web client: Navigate to Backup and Retention | Backup and Restore.
    • desktop client: Administrative Tools | Settings | Backup and Retention | Safeguard Backup and Restore.
  2. Select the backup to be archived.
  3. Proceed to archive the backup:
    • web client: Click  Archive. On the Archive Servers dialog, choose an archive server.
    • desktop client: Click  Archive and select Archive Backup. In the Archive Servers dialog, choose an archive server. You can add an archive server from the Archive Servers dialog by clicking the Add Archive Server toolbar button.

Safeguard for Privileged Passwords copies the backup file to the archive server.

Backup settings

You can configure an automatic backup schedule.

If you schedule a backup and a backup has already occurred for that interval (minute, hour, day, week, or month), another backup will not execute until the following minute, hour, day, week, or month. For example, if a backup has already occurred today and you set the backup schedule to run a daily backup, Safeguard for Privileged Passwords will not run the backup until tomorrow.

The backup schedule window end time must be after the start time.

Backup files to retain

In addition to completing the settings in the steps which follow, you can configure the maximum number of backup files you want Safeguard for Privileged Passwords to store on the appliance on the Backup Retention page.

To configure the backup schedule

  1. Go to Backup and Restore:
    • web client: Navigate to Backup and Retention | Backup and Restore.
    • desktop client: Navigate to Administrative Tools | Settings | Backup and Retention | Safeguard Backup and Restore.
  2. Based on the client you are using, do one of the following:
    • web client: Click  Settings.
    • desktop client: Click  Settings and select Backup Settings.

  3. In the Backup Settings dialog, specify the backup schedule.

  4. Enter the schedule. (If you are using the desktop client, select the Backup Every check box to enter the schedule; if you deselect Backup Every, the details are lost).

    • Select a time frame:

      • Never: The job will not run according to a set schedule. You can still manually run the job.
      • Minutes: The job runs per the frequency of minutes you specify. For example, Run Every 30/Minutes runs the job every half hour over a 24-hour period. It is recommended you do not use the frequency of minutes except in unusual situations, such as testing.

      • Hours: The job runs per the minute setting you specify. For example, if it is 9 a.m. and you want to run the job every two hours at 15 minutes past the hour starting at 9:15 a.m., select Run Every 2/Hours/@ minutes after the hour 15.

      • Days: The job runs on the frequency of days and the time you enter.

        For example, Run Every 2/Days/Starting @ 11:59:00 PM runs the job every other evening just before midnight.

      • Weeks The job runs per the frequency of weeks at the time and on the days you specify.

        For example, Run Every 2/Weeks/Starting @ 5:00:00 AM and Repeat on these days with MON, WED, FRI selected runs the job every other week at 5 a.m. on Monday, Wednesday, and Friday.

      • Months: The job runs on the frequency of months at the time and on the day you specify.

        For example, If you select Run Every 2/Months/Starting @ 1:00:00 AM along with Day of Week of Month/First/Saturday, the job will run at 1 a.m. on the first Saturday of every other month.

    • Select Use Time Windows if you want to enter the Start and End time. You can click Add or Remove to control multiple time restrictions. Each time window must be at least one minute apart and not overlap.

      For example, for a job to run every ten minutes every day from 10 p.m. to 2 a.m., enter these values:

      Enter Run Every 10/Minutes and set Use Time Windows:

      • Start 10:00:00 PM and End 11:59:00 PM

      • Start 12:00:00 AM and End 2:00:00 AM

        An entry of Start 10:00:00 PM and End 2:00:00 AM will result in an error as the end time must be after the start time.

      If you have selected Days, Weeks, or Months, you will be able to select the number of times for the job to Repeat in the time window you enter.

      For a job to run two times every other day at 10:30 am between the hours of 4 a.m. and 8 p.m., enter these values:

      For days, enter Run Every 2/Days and set Use Time Windows as Start 4:00:00 AM and End 8:00:00 PM and Repeat 2.

    • (UTC) Coordinated Universal Time is the default time zone. Select a new time zone, if desired.

    If the scheduler is unable to complete a task within the scheduled interval, when it finishes execution of the task, it is rescheduled for the next immediate interval.

  5. In Send to archive server, select an already configured archive server to store the backup files externally from the appliance during a scheduled backup or when manually running a backup.This option is only available if you have configured an archive server. For more information, see Adding an archive server. If you use the desktop client, you have to select the Send to archive server check box to make a selection.
  6. web client: You can select the Backup Protection settings. For more information, see Backup protection settings.
  7. Click OK to save your changes and leave the page. In the web client, you can click Apply to save your changes and stay on the page.

Backup protection settings

For maximum protection, set backup encryption on an appliance or on a primary appliance for cluster-wide protection. You may encrypt a Safeguard Backup File (.sgb) with one of the following methods:

  • Standard (default): No password or GPG key is required.

  • Password: You can enter any password value. You must have the password to restore the backup.

    CAUTION: Make sure to save the password in a safe vault. There is no way to recover the password needed to restore the backup.

  • GNU Privacy Guard (GPG) public key (RSA only): You can upload a .txt file with the public key and meta data or copy and paste the public key and meta data to Safeguard for Privileged Passwords. A backup file created with a GPG public key is encrypted when it is downloaded or archived. Only the private key holder can decrypt the backup file prior to the file being uploaded and restored. Once the private key holder decrypts the backup, the backup is the same as a backup generated when only appliance protection was selected.

    CAUTION: Make sure to save the GPG private key in a safe vault. There is no way to unencrypt the GPG protected file without the private key.

Once set, future backups created manually or automatically are protected.

Safeguard for Privileged Passwords detects all attempted uploads of an invalid backup. If a backup is GNU Privacy Guard (GPG) encrypted, a message like the following displays: The uploaded file could not be validated as a genuine Safeguard backup image. It has been blocked from the appliance. An audit event is created for the failed backup load with the error reasons which include an invalid signature.

For details, see:

To configure backup protection

  1. If you will use GPG key protection, generate your public key file and create a .txt file to be uploaded or copy and pasted.
  2. Go to Backup and Restore:
    • web client: Navigate to Backup and Retention | Backup and Restore. Then, click Settings.
    • desktop client: Navigate to Administrative Tools | Settings | Backup and Retention | Safeguard Backup and Restore. Then, click Settings then click Backup Protection Settings
  3. From the Backup Settings dialog, select the type of backup protection for the appliance. The settings on a primary appliance are replicated to the cluster. The settings are read-only on each cluster node.
    • Appliance Protection Only: This is the default and includes no password or GPG Key protection of the backup. The backup is only encrypted as a Safeguard genuine backup.
    • Add Password Protection: Once selected, enter the password in the Backup Password text box. If a password already exists, a static number of dots display. You can type in a new password in place of the existing password and then confirm the password. The password you type in is used for backups made from the time the password is set until it is changed. Make sure to keep the password information in a safe vault.
    • Add GPG Key Protection: Once selected, do one of the following:
      • Click Browse to upload the public key file from a .txt file you created earlier.
      • Paste the public key information generated earlier into the text box.

      When you navigate back to this dialog, you will see the name, fingerprint, and the detail to identify the public key file.

      The GPG public key you submit is used for backups generated from the time protection is set until it is changed. Once a backup is generated while GPG is set, it will always be downloaded or archived with the GPG public key encryption, regardless of any settings changed on the appliance after it is generated. The GPG public key encryption stays with the backup metadata. In addition, if you upload the backup to another appliance, downloading the backup again will encrypt it with the same GPG public key originally provided.

  4. Click OK.

관련 문서

The document was helpful.

평가 결과 선택

I easily found the information I needed.

평가 결과 선택