Safeguard for Privileged Passwords (SPP) can be run in the cloud using Amazon Web Services (AWS).
To deploy the Amazon Machine Image (AMI) of Safeguard for Privileged Passwords from AWS, visit the AWS marketplace listing for Safeguard for Privileged Passwords (here) and follow the Deployment steps.
Disk size considerations
|
|
CAUTION: Before making any changes to the disk size, shut down the VM (stopped and deallocated). |
Safeguard for Privileged Passwords deploys with a minimal OS disk size. You should increase the size of the OS disk based on your estimated usage and budget. SPP on hardware comes with 1 TB of disk. You can use more or less than this depending on how many assets, accounts, and daily users you expect to have. 500 GB is a minimal production disk size and 2 TB is the maximum.
Disk size can be handled through Amazon Elastic Compute Cloud (Amazon EC2). For more information, see Getting Started with Amazon EC2. When you start up the VM, SPP automatically resizes the OS disk volume to use the available space.
AWS security considerations
Running Safeguard for Privileged Passwords in AWS comes with some security considerations that do not apply to the hardware appliance. We recommend:
Static IP address required
Configure the SPP VM with a static IP address in AWS. In AWS, the IP address must not change after the VM is deployed. If you need to change the IP address, take a backup, deploy again, and restore the backup. You can script the VM deploy to pick up an existing virtual NIC with the IP address configuration. For details, see the Amazon Virtual Private Cloud (VPC) documentation.
Deployment steps
AWS automatically licenses the operating system during the deployment with an AWS KMS.
Larger deployments warrant larger sizing choices. Safeguard for Privileged Passwords hardware appliances have 32GB of RAM and 4 processors with at least 1 TB of disk space.
AWS Marketplace steps
-
Go to the AWS marketplace listing for Safeguard for Privileged Passwords (here).
-
On the One Identity Safeguard for Privileged Passwords page, click Continue to Subscribe.
-
Advance through the resource creation screens to configure your instance. In addition to the Disk size considerations, AWS security considerations, and Static IP address required; One Identity recommends you select the m4.2xlarge instance type.
-
Once you have finished configuring the instance, select to launch the instance.
NOTE: The instance launch process may take a while to complete.
-
Once the instance has finished launching, log into the web client using your static IP address. You will need to use the default username (admin) and password (<instance id>). You should change the admin password immediately. For more information, see Setting a local user's password.For details, see Setting a local user's password in the Safeguard for Privileged Passwords Administration Guide.
NOTE: The password is unique for each deployment and the initial password will always be the instance ID of the deployed SPP server.
View or change the cloud virtual appliance setup
You can view or change the virtual appliance setup.
You can use the Safeguard for Privileged Passwords web management kiosk on port 9337 for diagnostics and troubleshooting.
You can also check the system logs via AWS:
-
To view the system log from AWS, select Actions, then Instance Settings, and then Get System Log.
-
Log in via https://<your IP>:9337
To patch to a new version, use the API.
Safeguard for Privileged Passwords (SPP) can be run in the cloud using Azure. A version of Safeguard for Privileged Passwords is available in the Azure Marketplace and an Azure Virtual Machine (VM) is required. See Windows virtual machines in Azure for details of setting up your VM.
When using Azure, Safeguard for Privileged Passwords is available on HTTPS X0. The Azure deployment does not use the MGMT service. The Recovery (Serial) Kiosk is used to view appliance information, Administrator password reset, power restart or shut down, and generating a support bundle. For more information, see Recovery Kiosk (Serial Kiosk).
Disk size considerations
|
|
CAUTION: Before making any changes to the disk size, shut down the VM (stopped and deallocated). |
Safeguard for Privileged Passwords deploys with a minimal OS disk size. You should increase the size of the OS disk based on your estimated usage and budget. SPP on hardware comes with 1 TB of disk. You can use more or less than this depending on how many assets, accounts, and daily users you expect to have. 500 GB is a minimal production disk size and 2 TB is the maximum.
-
Deploy SPP.
-
Verify you can log in.
-
Shut down the VM (stopped and deallocated).
-
Follow Microsoft’s guidance for increasing the disk size: How to expand the OS drive of a virtual machine.
When you start up the VM, SPP automatically resizes the OS disk volume to use the available space.
Azure security considerations
Running Safeguard for Privileged Passwords in Azure comes with some security considerations that do not apply to the hardware appliance. We recommend:
-
Do not giveSPP a public IP address.
-
Use the Azure key vault to encrypt the disk.
-
Limit access within Azure to the SPP virtual machine. SPP in Azure cannot protect against rogue Administrators in the same way the hardware appliance can.
Static IP address recommended
Configure the SPP VM with a static IP address in Azure. In Azure, the IP address must not change after the VM is deployed. If you need to change the IP address, take a backup, deploy again, and restore the backup. You can script the VM deploy to pick up an existing virtual NIC with the IP address configuration. For details, see Microsoft’s Virtual Network documentation.
Deployment steps
Safeguard for Privileged Passwords is deployed from the Azure Marketplace. Azure automatically licenses the operating system during the deployment with an Azure KMS.
The Azure base image includes the required configuration necessary to deploy into Azure following Microsoft's guidance, Prepare a Windows VHD or VHDX to upload to Azure.
-
Log into the Azure portal.
-
Under Azure services, click Create a resource.
-
Search for “One Identity Safeguard for Privileged Passwords” and click the tile.
-
On the One Identity Safeguard for Privileged Passwords screen, click Create.
-
Advance through the resource creation screens. Considerations follow:
-
For small deployments, it is recommended to choose at least VM size Standard D2s v3. Larger deployments warrant larger sizing choices. SPP hardware appliances have 32 GB of RAM and 4 processors with at least 1 TB of disk space.
-
You must set an administrator user name and password as part of the image creation, however, SPP will disable this account during initial setup.
-
Set public inbound ports to None.
-
Choose your Windows licensing option.
-
Make sure to enable boot diagnostics and the serial kiosk. The Azure Serial console will be used to provide access to the Safeguard Recovery Kiosk.
-
Once you are finished configuring the VM, click Create. Azure will deploy the SPP virtual machine.
-
When the virtual machine deployment is finished, SPP will automatically start initializing and configuring itself for the first use. This usually takes between 5-30 minutes, depending on the VM sizing. During initialization, SPP will enable the firewall and disable remote access to the VM. You can monitor the progress of initialization from the Azure Serial console. While the initialization is running, do not log in to the VM or power off or restart the VM.
-
When initialization is complete, you will see the Safeguard Recovery (Serial) Kiosk on the Azure Serial console screen.
-
Log in to the appliance via the web using the default username and password admin / Admin123. You should change the admin password immediately. For more information, see Setting a local user's password.For details, see Setting a local user's password in the Safeguard for Privileged Passwords Administration Guide.
-
After clustering, change the trusted servers, CORS and redirects setting.
As a best practice, after you have created your Safeguard for Privileged Passwords cluster (or if just using a single VM), change the Trusted Servers, CORS and Redirects setting to the empty string or a list of values to integration applications you wish to allow. For more information, see Trusted Servers, CORS and Redirects in the Safeguard for Privileged Passwords Administration Guide.
View or change the cloud virtual appliance setup
You can view or change the virtual appliance setup.
The Administrator uses the Recovery Kiosk (Serial Kiosk) to perform the following.
-
Get appliance information
-
Reset the Administrator password
-
Restart or shut down the virtual appliance
-
Generate a support bundle
- Resolve a quarantine (for more information, see What do I do when an appliance goes into quarantine).
For more information, see Recovery Kiosk (Serial Kiosk).
To patch to a new version, use the API.
Safeguard for Privileged Passwords (SPP) can be run in the cloud using Google Cloud Platform (GCP).
Disk size considerations
|
|
CAUTION: Before making any changes to the disk size, shut down the VM (stopped and deallocated). |
Safeguard for Privileged Passwords deploys with a minimal OS disk size. You should increase the size of the OS disk based on your estimated usage and budget. SPP on hardware comes with 1 TB of disk. You can use more or less than this depending on how many assets, accounts, and daily users you expect to have. 500 GB is a minimal production disk size and 2 TB is the maximum.
-
Deploy SPP.
-
Verify you can log in.
-
Shut down the VM (stopped and deallocated).
-
For more information on increasing the disk size, see Storage options in the Google Cloud documentation.
NOTE: When you start up the VM, Safeguard for Privileged Passwords automatically resizes the OS disk volume to use the available space.
Security considerations
Running Safeguard for Privileged Passwords in Google Cloud Platform comes with some security considerations that do not apply to the hardware appliance. One Identity recommends the following:
-
Do not give SPP a public IP address.
-
Limit access within Google Cloud Platform to the SPP virtual machine. SPP in Google Cloud Platform cannot protect against rogue Administrators in the same way the hardware appliance can.
Deployment steps
Safeguard for Privileged Passwords is shared privately via Google Cloud Platform.
Larger deployments warrant larger sizing choices. Safeguard for Privileged Passwords hardware appliances have 32 GB of RAM and 4 processors with at least 1 TB of disk space.
To deploy SPP
-
Go to https://console.cloud.google.com/ and navigate to Storage > Images.
-
Click on the SPP image, and click Create instance. For more information, see Create and start a Compute Engine instance in the Google Cloud documentation.
-
Configure your SPP instance. One Identity recommends using the following settings:
-
Under Machine Configuration, click General purpose and select series E2.
-
Under Machine type, select the preset Shared-core > e2-medium.
-
Under Identity & API Access, for the Service account, select no service account.
-
Under Advanced Options > Networking > Network Interfaces, set your Network and Subnetwork.
-
After the instance has finished launching, log into the SPP web client using your IP address. Use the default username (admin) and password (Admin123). Change the admin password immediately. For more information, see Setting a local user's password. For details, see the Safeguard for Privileged Passwords Administration Guide, Setting a local user's password.
View or change the cloud virtual appliance setup
You can view or change the virtual appliance setup.
You can use the Safeguard for Privileged Passwords web management kiosk on port 9337 for diagnostics and troubleshooting.
Safeguard for Privileged Passwords (SPP) can be run in the cloud using Oracle Cloud Infrastructure (OCI).
Disk size considerations
|
|
CAUTION: Before making any changes to the disk size, shut down the VM (stopped and deallocated). |
Safeguard for Privileged Passwords deploys with a minimal OS disk size. You should increase the size of the OS disk based on your estimated usage and budget. SPP on hardware comes with 1 TB of disk. You can use more or less than this depending on how many assets, accounts, and daily users you expect to have. 500 GB is a minimal production disk size and 2 TB is the maximum.
-
Deploy SPP.
-
Verify you can log in.
-
Shut down the VM (stopped and deallocated).
-
For more information on increasing the boot volume, see Resizing a Volume in the Oracle documentation.
NOTE: When you start up the VM, Safeguard for Privileged Passwords automatically resizes the OS disk volume to use the available space.
OCI security considerations
Running Safeguard for Privileged Passwords in OCI comes with some security considerations that do not apply to the hardware appliance. We recommend:
-
Do not give SPP a public IP address.
-
Use the OCI key vault to encrypt the disk.
-
Limit access within OCI to the SPP virtual machine. Safeguard for Privileged Passwords in OCI cannot protect against rogue Administrators in the same way the hardware appliance can.
Deployment steps
Safeguard for Privileged Passwords is deployed using a custom image which you can download from the One Identity Support Portal. OCI automatically licenses the operating system during the deployment with an OCI KMS.
Larger deployments warrant larger sizing choices. Safeguard for Privileged Passwords hardware appliances have 32 GB of RAM and 4 processors with at least 1 TB of disk space.
To deploy SPP
-
Go to the One Identity Support Portal for Safeguard for Privileged Passwords.
-
On the One Identity Safeguard for Privileged Passwords page, on the side panel, under Self Service Tools, click Software Downloads.
-
To download the OCI image, click 
next to the image.
-
After you have downloaded the image, import it.
For instructions, see Importing Custom Windows Images.
-
After the instance has finished launching, log into the web client using your static IP address. You will need to use the default username (admin) and password (<instance id>). You should change the admin password immediately. For more information, see Setting a local user's password.For details, see the Safeguard for Privileged Passwords Administration Guide, Setting a local user's password.
NOTE: The password is unique for each deployment and the initial password will always be the instance ID of the deployed SPP server.
View or change the cloud virtual appliance setup
You can view or change the virtual appliance setup.
You can use the Safeguard for Privileged Passwords web management kiosk on port 9337 for diagnostics and troubleshooting. To access the kiosk on an OCI appliance, an administrator must create a policy to allow cloud shell access. You can the access the kiosk by connecting to the Cloud Shell. Once connected, to display the kiosk, press Ctrl+r. For more information on Cloud Shell, see Cloud Shell in the Oracle Cloud Infrastructure Documentation.
You can check the system logs on the Logging Audit page in OCI.
To patch to a new version, use the API.
