The SPS license must be updated before the existing license expires or when you purchase a new license.
|
Caution:
Before uploading a new license, One Identity recommends that you backup the configuration of SPS. For details, see Exporting the configuration of One Identity Safeguard for Privileged Sessions (SPS). |
To update the license
Navigate to Basic Settings > System > License.
Click Browse and select the new license file.
|
NOTE:
It is not required to manually decompress the license file. Compressed licenses (for example .zip archives) can also be uploaded. |
Click Upload, then .
|
Caution:
This step terminates all controlled connections going through SPS. Disconnect your clients from the protected servers before proceeding. |
To activate the new license, navigate to Traffic control > All services and click Restart.
The following topics describe how to use the console menu of One Identity Safeguard for Privileged Sessions (SPS), how to enable remote SSH access to SPS, and how to change the root password from the web interface.
Using the console menu of One Identity Safeguard for Privileged Sessions (SPS)
Enabling SSH access to the One Identity Safeguard for Privileged Sessions (SPS) host
Changing the root password of One Identity Safeguard for Privileged Sessions (SPS)
Connecting to One Identity Safeguard for Privileged Sessions (SPS) locally or remotely using Secure Shell (SSH) allows you to access the console menu of SPS. The console menu provides access to the most basic configuration and management settings of SPS. It is mainly used for troubleshooting purposes, the primary interface of SPS is the web interface.
The console menu is accessible to the root user using the password set during completing the Welcome Wizard.
Figure 106: The console menu
The console menu provides allows you to perform the following actions.
This is usually not recommended and only required in certain troubleshooting situations. Select the boot/core shell's keyboard layout for the local console. This will not affect the keyboard layout if you have accessed the shell via SSH.
The boot firmware boots up SPS, provides high availability support, and starts the core firmware. The core firmware, in turn, handles everything else: provides the web interface, manages the connections, and so on.
Accessing the firmware management is useful if after an update the new firmware does not operate properly and the web interface is not available to activate the previous firmware.
For more information about backup processes, see Data and configuration backups.
For details, see Changing the root password of One Identity Safeguard for Privileged Sessions (SPS).
If the web interface is inaccessible, it can be the result of an internal locking error. To resolve this issue, delete the lock files. After deletion, they are archived, and included in the support bundle if they are not older than 30 days. To create a support bundle, if the web interface is inaccessible, select Create support bundle.
|
NOTE:
If deleting the lock files did not resolve the issue, contact our Support Team. |
For details, see Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown.
For details, see Sealed mode.
For more information about assigning an IP address to the HA interface of a node, see Resolving an IP conflict between cluster nodes.
|
NOTE:
Note that logging in to the console menu automatically locks the SPS interface, meaning that users cannot access the web interface while the console menu is used. The console menu can be accessed only if there are no users accessing the web interface. The connection of web-interface users can be terminated to force access to the console menu. |
Exclusively for troubleshooting purposes, you can access the One Identity Safeguard for Privileged Sessions (SPS) host using SSH.
Completing the Welcome Wizard automatically disables SSH access to SPS. Re-enabling it allows you to connect remotely to the SPS host and login using the root user. The password of the root user is the one you provided in the Welcome Wizard. For details on how to change the root password from the web interface, see Changing the root password of One Identity Safeguard for Privileged Sessions (SPS).
|
Caution:
Accessing the One Identity Safeguard for Privileged Sessions (SPS) host directly using SSH is not recommended or supported, except for troubleshooting purposes. In such case, the One Identity Support Team will give you exact instructions on what to do to solve the problem. For security reasons, disable SSH access to SPS when it is not needed. For details, see "Enabling SSH access to the One Identity Safeguard for Privileged Sessions (SPS) host" in the Administration Guide. |
The following encryption algorithms are configured on the local SSH service of SPS:
Key exchange (KEX) algorithms:
diffie-hellman-group-exchange-sha256
Ciphers:
aes256-ctr,aes128-ctr
Message authentication codes:
hmac-sha2-512,hmac-sha2-256
SSH access is, by default, protected against brute-force attacks: after 20 unsuccessful login attempts, the offending IP is blocked from accessing the SSH service for ten minutes.
You can turn off brute force protection by unselecting the Protect against brute-force attacks option for the SSH server.
To enable SSH access to the SPS host
Navigate to Basic Settings > Local Services > SSH server.
Figure 107: Basic Settings > Local Services > SSH server — Enabling remote SSH access to SPS
Select the Enable option.
|
NOTE:
Remote SSH access is automatically disabled if Sealed mode is enabled. For details, see Sealed mode. |
Choose the authentication method for the remote SSH connections.
To enable password-based authentication, select the Enable password authentication option.
To enable public-key authentication, click in the Authorized keys field, click and upload the private keys of the users who can access and manage SPS remotely via SSH.
One Identity recommends using 2048-bit RSA keys (or stronger).
Choose an address and a port for the SSH server in the Listening addresses section.
The available addresses correspond to the interface addresses configured in Basic Settings > Network > Interfaces. Only IPv4 addresses can be selected.
To add multiple addresses, click .
(Optional) To permit SSH acces only from selected subnets or IP addresses, select Restrict clients, click and enter the IP address and netmask of the allowed clients.
Use an IPv4 address.
To add multiple addresses, click .
Click .
© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center