Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 6.0.12 LTS - Appliance Setup Guide

Completing the appliance setup

After setting up the hardware appliance or virtual appliance, complete these steps.

During initial installation and when applying a patch, make sure the desktop client file is the one supplied with the appliance version. If the versions are not compatible, errors will occur.

Step 1: Install the desktop client application and desktop player

NOTE: PuTTY is used to launch the SSH client for SSH session requests and is included in the install. The desktop client looks for any user-installed PuTTY in the following locations:

  • Any reference to putty in the PATH environment variable
  • c:/Program Files/Putty
  • c:/Program Files(x86)/Putty
  • c:/Putty

If PuTTY is not found, the desktop client uses the version of PuTTY that it installed at:

<user-home-dir>/AppData/Local/Safeguard/putty.

If the user later installs PuTTY in any of the locations above, the desktop client uses that version which ensures the user has the latest version of PuTTY.

Installing the Safeguard for Privileged Passwords desktop client application

  1. To download the Safeguard for Privileged Passwords desktop client Windows installer .msi file, open a browser and navigate to:

    https://<Appliance IP>/Safeguard.msi

    Save the Safeguard.msi file in a location of your choice.

  2. Run the MSI package.
  3. Select Next in the Welcome dialog.
  4. Accept the End-User License Agreement and select Next.
  5. Select Install to begin the installation.
  6. Select Finish to exit the desktop client setup wizard.
  7. Check your desktop resolution. The desktop client works the best at a resolution of 1024 x 768 or greater.

Installing the Desktop Player

CAUTION: If the Desktop Player is not installed and a user tries to play back a session from the Activity Center, a message like the following will display: No Desktop Player. The Safeguard Desktop Player is not installed. Would you like to install it now? The user will need to click Yes to go to the download page to install the player following step 2 below.

  1. Once the Safeguard for Privileged Passwords installation is complete, go to the Windows Start menu, Safeguard folder, and click Download Safeguard Player to be taken to the One Identity Safeguard for Privileged Sessions - Download Software web page.

  2. Follow the Install Safeguard Desktop Player section of the player user guide found here:

    1. Go to One Identity Safeguard for Privileged Sessions - Technical Documentation.
    2. Scroll to User Guide and click One Identity Safeguard for Privileged Sessions [version] Safeguard Desktop Player User Guide.

  3. For Safeguard Desktop player version 1.8.6 and later, ensure your signed web certificate has a Subject Alternative Name (SAN) that includes each IP address of each of your cluster members. If the settings are not correct, the Safeguard Desktop Player will generate a certificate warning like the following when replaying sessions: Unable to verify SSL certificate. To resolve this issue, import the appropriate certificates including the root CA.

New Desktop Player versions

When you have installed a version of the Safeguard Desktop Player application, you will need to uninstall the previous version to upgrade to a newer player version.

Step 2: Start the desktop client
  1. Log in using the Bootstrap Administrator account.
  2. Run the desktop client and log in with the configured IPv4 or IPv6 address for the primary interface (X0). To log in with an IPv6 address, enter it in square brackets.
  3. License Safeguard for Privileged Passwords using the provided license file. Go to Licensing:
    • (web client): Click  Settings on the left. The Settings: Appliance page displays. Click Licensing .
    • (desktop client): Navigate to Administrative Tools | Settings | Appliance | Licensing.

    Click to upload a new license file.

  4. Designate an archive server for storing session recordings. Defining archive server configurations and assigning an archive server to an appliance are done from the desktop's Administrative Tools view:

    • Go to Settings | Backup and Retention | Archive Servers to configure archive servers.
    • Go to Settings | Sessions | Session Recordings Storage Management to assign an archive server to an appliance for storing recording files.

  5. To configure the time zone:

    1. Navigate to Administrative Tools | Settings | Safeguard Access | Time Zone.
    2. Select the time zone in the Default User Time Zone drop-down menu.
  6. Ensure that your Safeguard for Privileged Passwords Appliance has the latest software version installed. To check the version:
    1. From the Safeguard for Privileged Passwords Desktop Client, log in with admin account credentials.
    2. Click Settings | Appliance | Appliance Information. The Appliance Version is displayed.

    3. Go to the following product support page for the latest version:

      https://support.oneidentity.com/one-identity-safeguard/download-new-releases

    4. If necessary, apply a patch. Wait for maintenance. If you are installing multiple patches, repeat as needed.

Changing the Bootstrap Administrator's password

The Bootstrap Administrator is a built-in account that allows you to get the appliance set up for first-time use. To keep your Safeguard for Privileged Passwords Appliance secure, once the license is added, change the default password for the Bootstrap Administrator’s account.

To change the password:

  • (web client): Click your user name in the upper-right corner of the screen and select Change Password.
  • (desktop client): Click your user name in the upper-right corner of the screen and select My Account then Change Password.

If this password is ever lost, you can reset it to the default of Admin123. See the Safeguard for Privileged Passwords Administration Guide, Admin password reset topic.

Step 3: Backup Safeguard for Privileged Passwords

Immediately after your initial installation of Safeguard for Privileged Passwords, make a backup of your Safeguard for Privileged Passwords Appliance.

NOTE: The default backup schedule runs at 22:00 MST, which can be modified rather than manually running a backup.

  1. From the Safeguard for Privileged Passwords desktop Home page, select  Administrative Tools.
  2. In Settings, select Backup and Retention | Backups.
  3. Click  Run Now.
Step 4: Update Safeguard for Privileged Passwords

Download the latest update from: https://support.oneidentity.com/one-identity-safeguard/.

  1. From the Safeguard for Privileged Passwords desktop Home page, select  Administrative Tools.
  2. In Settings, select Appliance | Updates.

  3. Click Upload a File and browse to select an update file.

    NOTE: When you select a file, Safeguard for Privileged Passwords uploads it to the server, but does not install it.

  4. Click Install Now to install the update file immediately.
  5. Once you have updated Safeguard for Privileged Passwords, be sure to back up your Safeguard for Privileged Passwords Appliance.
Step 5: Add a user with Authorizer administrative permissions

The Authorizer Administrator is responsible for granting administrative access to One Identity Safeguard for Privileged Passwords.

  1. From the Safeguard for Privileged Passwords desktop Home page, select  Administrative Tools.

    NOTE: This is where you add all the objects you need to write access request policies, such as users, accounts, and assets.

  2. In Administrative Tools, select Users.
  3. Click  Add User to create a Safeguard for Privileged Passwords user with a local authentication provider and Authorizer Administrator permissions.

    NOTE: When you choose Authorizer permissions, Safeguard for Privileged Passwords also selects User and Help Desk permissions. These additional settings cannot be cleared.

  4. Log out:
    1. In the upper-right corner of the screen, click the user avatar.
    2. Select Log Out.

Cloud deployments

Safeguard for Privileged Passwords can be run from:

  • The One Identity Safeguard for Privileged Passwords 3000 Appliance or 2000 Appliance (hardware)
  • A virtual machine
  • The cloud

This section covers the background and steps you need to deploy from the cloud for the first time.

Cloud deployment considerations

Safeguard for Privileged Passwords can be run from the cloud.

Before you start: platforms and resources

When setting up a virtual environment, carefully consider the configuration aspects such as CPU, memory availability, I/O subsystem, and network infrastructure to ensure the virtual layer has the necessary resources available. See One Identity's Product Support Policies for more information on environment virtualization.

Platforms that have been tested with the cloud deployments follow.

For these deployments, the minimum resources used in test are 4 CPUs, 10GB RAM, and a 60GB disk. Choose the appropriate machine and configuration template. For example, when you click Create in the Azure Marketplace, default profiles display. You can click Change size to choose a different template.

Restricting access to the web management kiosk for cloud deployments

The web management kiosk runs on port 9337 in AWS and Azure and is intended for diagnostics and troubleshooting by Appliance Administrators.

CAUTION: The Management web kiosk is available via HTTPS port 9337 for cloud platforms (including AWS and Azure). The Management web kiosk gives access to functions without authentication, such as pulling a support bundle or rebooting the appliance. In AWS, all ports are denied unless explicitly allowed. To deny access to port 9337, the port should be left out of the firewall rules. If the port is used, firewall rules should allow access to targeted users.

Azure: Block port 9337

Use the following steps to block access to port 9337 in Azure.

  1. Navigate to the virtual machine running Safeguard for Privileged Passwords.
  2. In the left hand navigation menu select Networking.
  3. Click Add inbound port rule.
  4. Configure the inbound security rule as follows:
    Source: Any
    Source port ranges: *
    Destination: Any
    Destination port ranges: 9337
    Protocol: Any
    Action: Deny
    Priority: 100 (use the lowest priority for this rule)
    Name: DenyPort9337
  5. Click Add.

AWS: Block port 9337

Use the following steps to block access to port 9337 in AWS.

  1. From the EC2 Dashboard, navigate to the EC2 Instance running Safeguard for Privileged Passwords.
  2. Select the instance.
  3. In the Description tab, locate the Security groups field then click the name of the security group.
  4. Select the Inbound tab.
  5. Click Edit.
  6. Remove any existing rules and add the following rules:
    • Type: Custom TCP Rule
      Protocol: TCP
      Port Range: 655
      Source: Anywhere
      Description: Cluster VPN
    • Type: Custom UDP Rule
      Protocol: UDP
      Port Range: 655
      Source: Anywhere
      Description: Cluster VPN
    • Type: HTTPS
      Protocol: TCP
      Port range: 443
      Source: Anywhere
      Description: Web API
    • Type: Custom TCP Rule
      Protocol: TCP
      Port Range: 8649
      Source: Anywhere
      Description: SPS Cluster
  7. Click Save.

AWS deployment

IMPORTANT: Before deploying, make sure you have read the Cloud deployment considerations.

Safeguard for Privileged Passwords (SPP) can be run in the cloud using Amazon Web Services (AWS).

To deploy the Amazon Machine Image (AMI) of Safeguard for Privileged Passwords from AWS, visit the AWS marketplace listing for Safeguard for Privileged Passwords (here) and follow the Deployment steps.

Disk size considerations

CAUTION: Before making any changes to the disk size, shut down the VM (stopped and deallocated).

Safeguard for Privileged Passwords (SPP) deploys with a minimal OS disk size. You should increase the size of the OS disk based on your estimated usage and budget. SPP on hardware comes with 1TB of disk. You can use more or less than this depending on how many assets, accounts, and daily users you expect to have. 500GB is a minimal production disk size and 2TB is the maximum.

Disk size can be handled through Amazon Elastic Compute Cloud (Amazon EC2). For more information, see Getting Started with Amazon EC2. When you start up the VM, SPP automatically resizes the OS disk volume to use the available space.

AWS security considerations

Running Safeguard for Privileged Passwords (SPP) in AWS comes with some security considerations that do not apply to the hardware appliance. We recommend:

  • Do not give Safeguard a public IP address.
  • Use the AWS key vault to encrypt the disk.

  • Limit access within AWS to the Safeguard virtual machine. SPP in AWS cannot protect against rogue Administrators in the same way the hardware appliance can.

Static IP address required

Configure the SPP VM with a static IP address in AWS. In AWS, the IP address must not change after the VM is deployed. If you need to change the IP address, take a backup, deploy again, and restore the backup. You can script the VM deploy to pick up an existing virtual NIC with the IP address configuration. For details, see the Amazon Virtual Private Cloud (VPC) documentation.

Deployment steps

AWS automatically licenses the operating system during the deployment with an AWS KMS.

Larger deployments warrant larger sizing choices. Safeguard for Privileged Passwords hardware appliances have 32GB of RAM and 4 processors with at least 1TB of disk space.

AWS Marketplace steps

  1. Go to the AWS marketplace listing for Safeguard for Privileged Passwords (here).
  2. On the One Identity Safeguard for Privileged Passwords page, click Continue to Subscribe.
  3. Advance through the resource creation screens to configure your instance. In addition to the Disk size considerations, AWS security considerations, and Static IP address required

  4. Once you have finished configuring the instance, select to launch the instance.

    NOTE: The instance launch process may take a while to complete.

  5. Once the instance has finished launching, log into the web client using your static IP address. You will need to use the default username (admin) and your instance ID as the password. You should change the admin password immediately. For more details, see the Safeguard for Privileged Passwords Administration Guide, Setting a local user's password.

  6. After launching the instance, you need to update the instance to use your official license. The official license is the one that will be sent via email upon purchasing Safeguard for Privileged Passwords. For more information, see Licensing in the Safeguard for Privileged Passwords Administration Guide.
View or change the cloud virtual appliance setup

You can view or change the virtual appliance setup.

You can use the Safeguard for Privileged Passwords web management kiosk on port 9337 for diagnostics and troubleshooting.

You can also check the system logs via AWS:

  1. To view the system log from AWS, select Actions, then Instance Settings, and then Get System Log.
  2. Log in via https://<your IP>:9337

To patch to a new version, use the desktop client or API.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating