Safeguard for Privileged Passwords automatically assigns a name to the appliance; however, you can change the name from the Appliance Information page. In the web client, you can also edit the Host DNS Suffix that was set during the initial setup of Safeguard for Privileged Passwords.
To edit the appliance name and host DNS suffix
- Go to the page:
web client: Navigate to 
Appliance > Appliance Information.
- To the right of the Appliance Name and Host DNS Suffix, click
Edit to enable both fields for editing.
- Make any changes required to the Appliance Name or Host DNS Suffix.
- Click Save.
For each Safeguard for Privileged Passwords internal service, you can specify the level of logging and the external syslog server for storing debug logs. This allows for debugging in real time.
Debug logging is appliance specific. The data sent to the syslog server can include but is not limited to Support Bundle debug data. Cluster wide TLS audit event can be logged to a syslog server (see Syslog Events).
Debug logging is off by default but you can turn it on or off. Because debug logs can be sizable, you may want to turn it on for debugging a specific scenario or testing and turn it off for daily operations.
Using the API to control TLS log connection messages
Using the API, you can control if TLS log connection messages are generated to the debug logs when the TLS connection to an external server is closed. If the log level is set (see below), the event is also sent to the syslog server.
To log TLS connection information, set the NetworkDebugEnabled property from the https://<network address>/service/appliance/v3/Service/Debug endpoint to true. For more information, see Using the API.
To configure debug logs to send to a syslog server
- You will need a configured syslog server. If you have not configured a syslog server, you will see a message like this: To configure additional debut logging options, you need to configure a syslog server. Click Configure a syslog server. For more information, see Configuring and verifying a syslog server.
- If you have a syslog server configured, navigate to Appliance > Debug.
- Select a Syslog Server to which you want to send debug logs. The default is Do not log to syslog.
- In Facility, select which syslog facility to which you want to use: Kernel, User, Mail, Daemons, Authorization, or Syslog.
-
Set the log level.
- To set all log levels, click
Set All then choose to Set All at one of the levels. This is useful to set the most common level of logging you want for most services.
- To set an individual Service Name's log level, select
next to the service to change the log level for that service.
When you select from either the set all levels or the individual service name level, the log includes the log level selected as well as those listed below the level you selected. The information is immediately sent to the server. For example:
- Debug (includes Debug, Information, Warning, and Error)
- Information (includes Information, Warning, and Error)
- Warning (includes Warning and Error)
- Error (includes only Error)
- None (Disabled): No logs are sent
- The grid displays each Service Name (enum name) that supports debug logging and the current Log Level.
- Click
Refresh at any time to display the latest information.
- Click
Search to locate a specific service.
|
|
CAUTION: All customers upgrading to Safeguard for Privileged Passwords 7.0 require a new license. For more information, contact Support. |
It is the responsibility of the Appliance Administrator to manage the Safeguard for Privileged Passwords licenses.
Hardware appliance
The One Identity Safeguard for Privileged Passwords 4000 Appliance, 3000 Appliance and 2000 Appliance ship with the Privileged Passwords module which requires a valid license to enable functionality.
You must install a valid license. Once the module is installed, Safeguard for Privileged Passwords shows a license state of Licensed and is operational. If the module license is not installed, you have limited functionality. That is, even though you will be able to configure access requests, if a Privileged Passwords module license is not installed, you will not be able to request a password release.
Virtual appliance Microsoft Windows licensing
You must license the virtual appliance with a Microsoft Windows license. We recommend using either the MAK or KMS method. Specific questions about licensing should be directed to your Sales Representative. The virtual appliance will not function unless the operating system is properly licensed.
Licensing setup and update
To enter licensing information when you first log in
The first time you log in as the Appliance Administrator, you are prompted to add a license. The Success dialog displays when the license is added.
On the virtual appliance, the license is added as part of Initial Setup. For more information, see Setting up the virtual appliance.
IMPORTANT: After successfully adding a license, the Software Transaction Agreement will be displayed and must be read and accepted in order to use Safeguard for Privileged Passwords.
To configure reminders for license expiration
To avoid disruptions in the use of Safeguard for Privileged Passwords, the Appliance Administrator must configure the SMTP server, and define email templates for the License Expired and the License Expiring Soon event types. This ensures you will be notified of an approaching expiration date. For more information, see Enabling email notifications.
Users are instructed to contact their Appliance Administrator if they get an "appliance is unlicensed" notification.
As an Appliance Administrator, if you receive a "license expiring" notification, apply a new license.
To update the licensing file
Licensing update is only available using a virtual machine, not via the hardware.
To perform licensing activities
Go to the licensing page:
- Navigate to Appliance > Licensing.
- To upload a new license file, click
Upload new license file and browse to select the current license file. The Software Transaction Agreement will also be displayed during this process and must be read and accepted in order to complete the licensing process.
- To remove the license file, select the license and click
Remove selected license.
As an Appliance Administrator, you can use the Factory Reset feature to reset a Safeguard for Privileged Passwords Appliance to recover from major problems or to clear the data and configuration settings on the appliance.
Factory reset is not an option for virtual appliances. You will need to redeploy the appliance.
|
|
Caution: Care should be taken when performing a factory reset against a physical appliance, because this operation removes all data and audit history, returning it to its original state when it first came from the factory. Performing a factory reset will NOT reset the BMC/IPMI interface or the IP address. However, the BMC/IPMI interface will need to be reenabled after the reset has completed (for more information, see Lights Out Management (BMC)). The appliance must go through configuration again as if it had just come from the factory. For more information, see Setting up Safeguard for Privileged Passwords for the first time.
In addition, performing a factory reset may change the default SSL certificate and default SSH host key.
The appliance resets to the current Long Term Support (LTS) version. For example, if the appliance is running version 6.6 (feature release) or 6.0.6 LTS (maintenance Long Term Support release) and then factory reset, the appliance will reset down to 6.0 LTS and you will have to patch up to your desired version. For more information, see Long Term Support (LTS) and Feature Releases. |
Factory reset on a clustered appliance
Performing a factory reset on a clustered hardware appliance will not automatically remove the appliance from a cluster. The recommended best practice is to unjoin an appliance from the cluster before performing a factory reset on the appliance. After the unjoin and factory reset, the appliance must be configured again. For more information, see Setting up Safeguard for Privileged Passwords for the first time.
To perform a factory reset from the web client
- Go to Factory Reset on hardware (not virtual machine):
- Navigate to Appliance Management > Appliance > Factory Reset.
- Click Factory Reset.
-
In the Factory Reset confirmation dialog, enter the words Factory Reset and click Factory Reset.
The appliance will go into Maintenance mode to revert the appliance. If the appliance was in a cluster, you may need to unjoin the factory reset appliance. The factory reset appliance must be configured again. For more information, see Setting up Safeguard for Privileged Passwords for the first time. In addition, when you log in to the appliance, you will be prompted to add your Safeguard for Privileged Passwords licenses.
You can also perform a factory reset from the Recovery Kiosk or Support Kiosk. For more information, see Performing a factory reset.
