One Identity Safeguard for Privileged Passwords 7.4.2 - Administration Guide

Select an operating system or directory service, for this asset.

A custom platform can be selected. For more information, see Custom platforms..

Generic operating system selections:

Safeguard for Privileged Passwords allows you to select a generic operating system of Other, Other Managed, Other Directory, or Linux. This allows you to add an asset to Safeguard for Privileged Passwords without designating a specific platform.

• Other: An asset with an Other operating system cannot be managed. You can manually change passwords on accounts associated with an asset with an Other operating system. Safeguard for Privileged Passwords cannot connect to the asset so there is no automatic password or SSH key check and change, test connection, or other activity requiring a connection.
• Other Managed: Safeguard for Privileged Passwords stores the password or SSH key and can automatically check and change it per the profile configuration. There is no active connection or service account. The passwords are rotated internally and event notifications are sent when the rotation is complete. Another component or piece of automation can change the password or SSH key or make use of the password or SSH key in configuration files. For example, a listener can pick up the change event via the Safeguard for Privileged Passwords Application to Application (A2A) service and perform actions, as required.

• Other Directory: Other Directory supports the addition of directory properties at the asset and account levels. This allows for the accounts stored on them to be used in session policy via linked accounts or directory account using the access configuration settings. Since an Other Directory is not actually connected to a directory, it is unable to discover accounts or assets that belong to the actual directory that the Other Directory represents. Therefore, all accounts, assets, and credentials will have to be manually entered in Safeguard for Privileged Passwords.

  CAUTION: Since an Other Directory is not actually connected to a directory, you are responsible for making sure that the Other Directory assets and accounts stay in sync with the actual directory that the Other Directory represents. For example, if you change the password in Safeguard for Privileged Passwords the password will not be set in the actual directory. This will cause the account in Safeguard for Privileged Passwords to be out of sync with the account in the actual directory. Until manually corrected, you will be unable to use the password.

  IMPORTANT: Other Directory requires a one to one relationship between the directory and the domain. If your license is per system, this may result in a large number of licenses being required to fully support your assets.

• Linux: Safeguard for Privileged Passwords manages an asset with "Linux" on a best effort basis.

Other platform details: Any Other platform type can be changed to a different platform type. Conversely, any platform type can be changed to Other; however, any property values specific to the current platform type will be lost. For example, you may want to change a Linux operating system to any type of Linux, such as AIX, HP-UX, or Solaris. Then, the specific platform type can be changed back to Other, if needed.

(Optional) Select the operating system version. When adding a Linux or Macintosh OS X system, Safeguard for Privileged Passwords allows you to choose an Other version. Custom platforms do not allow for a version to be selected.

Safeguard for Privileged Passwords does not manage passwords for accounts on domain controllers. Manage accounts on domain controllers through the directory asset that hosts the domain controller. For more information, see Adding an account to an asset..

(Optional) The product's system architecture. Custom platforms do not allow for an architecture to be set.

If applicable, enter a network DNS name or the IP address used to connect to the managed system over the network.

For Amazon Web Services assets, enter the Amazon AWS Account ID or Alias.

For SPS assets, if you're using both REST and SSH as part of your management protocol they will need to be hosted on the same IP.

This is required for all assets that are using the Connect for Safeguard Assets service in Starling. Use the Browse button to select an agent registered in the Starling subscription. For more information on installing an agent, see the Connect for Safeguard Assets User Guide.

Select the authentication method to use for the asset.

The domain for the asset (Name on the General tab). A domain can be identified for more than one directory asset so that multiple directory assets can be governed the same domain.

The NetBios name of the asset.

The unique domain identifier for the asset.

The naming context for the asset.

Select if you want to manage the whole forest. Do not select if you want to manage just one domain.

This value is set for a directory (such as Active Directory). To manage tasks and services on a Windows Domain Controller, you need to add a Windows Asset for the Domain Controller.

For Active Directory, instead of having Safeguard for Privileged Passwords automatically find domain controllers from a DNS and CLDAP ping, you can specify domain controllers.

If applicable, specify the access port on the target server to be used for RDP session requests.

Default: Port 3389

If applicable, specify the access port on the target server to be used for SSH session requests.

Default: Port 22

If connecting to TN3270 or TN5250, the port for connection. By default, a telnet server typically listens on port 23.

Sync additions (incremental sync) syncs all changes except deletions. This is the faster type of sync.

For directory assets, enter or select how often you want to synchronize additions (in minutes). This updates Safeguard for Privileged Passwords with any additions or modifications that have been made to the objects, including group membership and user account attributes mapped to Safeguard for Privileged Passwords.

The default is 15 minutes and the range is between 1 and 2147483647 minutes.

Directory Sync is enabled by default and can be disabled. For more information, see Global Services.

Sync deletions (full sync) syncs all changes and deletions. This sync takes longer (perhaps hours), especially the first time it is run based on your directory setup.

For directory assets, enter or select how often you want Safeguard for Privileged Passwords to synchronize deletions (in minutes).

This updates Safeguard for Privileged Passwords with any additions, changes, and deletions that have been made to the objects, including group membership and user account attributes mapped to Safeguard for Privileged Passwords.

The default is 15 minutes and the range is between 1 and 1440 minutes.

Directory Sync is enabled by default and can be disabled. For more information, see Global Services.

You can run the deletion (full) sync on demand using the API Assets/Synchronize and IdentityProviders/Synchronize.

When configuring Cisco IOS, Cisco ASA, or Check Point GAiA assets, this read-only field displays enable (Cisco IOS and Cisco ASA) or expert (Check Point GAiA).

For SPS assets, enter the name of the service account to be managed. Use the Reset button to remove a previously configured account.

To authenticate to the asset using a directory account from an external identity store such as Microsoft Active Directory.

To authenticate to the asset using a connector configured in Starling Connect.

For SQL Server assets, to authenticate to the asset using a local system account, which is a Windows user account on the server that is hosting the SQL database.

To authenticate to the asset using a local service account and password.

When the function account credentials are not in the custom script, for example, Amazon Web Services. For more information, see Adding a cloud platform account..

For Amazon Web Services assets, to authenticate to the asset using an access key. For more information, see Adding a cloud platform account..

No authentication information is taken because the custom parameters or parameters in a customer platform script are used. No accounts associated with the asset are stored. For more information, see Custom platforms..

No authentication information is taken and check/change functions are disabled. No accounts associated with the asset are stored.

Safeguard for Privileged Passwords discovers the SSH host key of discovered assets even if you selected None as the service account credential type.

Verify that Safeguard can log in to the asset using the service account credentials that you have provided.