Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 7.2 - Appliance Setup Guide

Completing the appliance setup

After setting up the hardware appliance or virtual appliance, complete these steps.

Step 1: Log in to the web client
  1. Log in using the Bootstrap Administrator account with the configured IPv4 or IPv6 address for the primary interface (X0). To log in with an IPv6 address, enter it in square brackets.
  2. License Safeguard for Privileged Passwords using the provided license file. Go to Licensing:
    • (web client): Appliance Management > Appliance > Licensing.

    Click to upload a new license file.

    The Software Transaction Agreement will be displayed after a new license is uploaded and must be read and accepted in order to use Safeguard for Privileged Passwords.

  3. Defining archive server configurations and assigning an archive server to an appliance are done from Appliance Management:

    • Go to Appliance Management > Backup and Retention > Archive Servers to configure archive servers.

  4. To configure the time zone:

    1. Navigate to User Management > Settings > Time Zone.
    2. Select the time zone in the Default User Time Zone drop-down menu.
  5. Ensure that your Safeguard for Privileged Passwords Appliance has the latest software version installed. To check the version:
    1. Click Appliance Management > Appliance > Appliance Information. The Appliance Version is displayed.

    2. Go to the following product support page for the latest version:

      https://support.oneidentity.com/one-identity-safeguard/download-new-releases

    3. If necessary, apply a patch. Wait for maintenance to complete. If you are installing multiple patches, repeat as needed.

      1. Download the latest update from: https://support.oneidentity.com/one-identity-safeguard/.

      2. From the Safeguard for Privileged Passwords Home page, select Appliance Management > Appliance > Patch Updates.

      3. Click Upload a File and browse to select an update file.

        NOTE: When you select a file, Safeguard for Privileged Passwords uploads it to the server, but does not install it.

      4. Click Install Now to install the update file immediately.
      5. In the confirmation dialog, enter the word Install and click OK.
      6. Once you have updated Safeguard for Privileged Passwords, be sure to back up your Safeguard for Privileged Passwords Appliance.

Changing the Bootstrap Administrator's password

The Bootstrap Administrator is a built-in account that allows you to get the appliance set up for first-time use. To keep your Safeguard for Privileged Passwords Appliance secure, once the license is added, change the default password for the Bootstrap Administrator’s account.

To change the password (local users):

  • web client: Click your user name in the upper-right corner of the screen and select My Settings. Open the My Account page and click the Change Password button.

If this password is ever lost, you can reset it to the default of Admin123. See the Safeguard for Privileged Passwords Administration Guide, Admin password reset topic.

Step 2: Backup Safeguard for Privileged Passwords

Immediately after your initial installation of Safeguard for Privileged Passwords, make a backup of your Safeguard for Privileged Passwords Appliance.

NOTE: The default backup schedule runs at 4:00 AM UTC, which can be modified or you can manually run a backup.

  1. From the Safeguard for Privileged Passwords Home page, open Appliance Management > Backup and Retention > Backup and Restore.
  2. Click  Run Now.
Step 3: Add a user with Authorizer administrative permissions

The Authorizer Administrator is responsible for granting administrative access to One Identity Safeguard for Privileged Passwords.

  1. From the Safeguard for Privileged Passwords Home page, open User Management > Users.

  2. Click  New User to create a Safeguard for Privileged Passwords user with local identity and authentication, and Authorizer permissions.

    NOTE: When you choose Authorizer permissions, Safeguard for Privileged Passwords also selects User and Help Desk permissions. These additional settings cannot be cleared.

  3. Log out:
    1. In the upper-right corner of the screen, click your user name.
    2. Select Log Out.

Cloud deployments

Safeguard for Privileged Passwords can be run from:

  • The One Identity Safeguard for Privileged Passwords 4000 Appliance, 3000 Appliance and 2000 Appliance (hardware)
  • A virtual machine
  • The cloud

This section covers the background and steps you need to deploy from the cloud for the first time.

Cloud deployment considerations

Safeguard for Privileged Passwords can be run from the cloud.

Before you start: platforms and resources

When setting up a virtual environment, carefully consider the configuration aspects such as CPU, memory availability, I/O subsystem, and network infrastructure to ensure the virtual layer has the necessary resources available. See One Identity's Product Support Policies for more information on environment virtualization.

Platforms that have been tested with the cloud deployments follow.

For these deployments, the minimum resources used in test are 4 CPUs, 10GB RAM, and a 60GB disk. Choose the appropriate machine and configuration template. For example, when you click Create in the Azure Marketplace, default profiles display. You can click Change size to choose a different template.

Restricting access to the web management kiosk for cloud deployments

The web management kiosk runs on port 9337 in AWS and Azure and is intended for diagnostics and troubleshooting by Appliance Administrators.

CAUTION: The Management web kiosk is available via HTTPS port 9337 for cloud platforms (including AWS and Azure). The Management web kiosk gives access to functions without authentication, such as pulling a support bundle or rebooting the appliance. In AWS, all ports are denied unless explicitly allowed. To deny access to port 9337, the port should be left out of the firewall rules. If the port is used, firewall rules should allow access to targeted users.

Azure: Block port 9337

Use the following steps to block access to port 9337 in Azure.

  1. Navigate to the virtual machine running Safeguard for Privileged Passwords.
  2. In the left hand navigation menu select Networking.
  3. Click Add inbound port rule.
  4. Configure the inbound security rule as follows:
    Source: Any
    Source port ranges: *
    Destination: Any
    Destination port ranges: 9337
    Protocol: Any
    Action: Deny
    Priority: 100 (use the lowest priority for this rule)
    Name: DenyPort9337
  5. Click Add.

AWS: Block port 9337

Use the following steps to block access to port 9337 in AWS.

  1. From the EC2 Dashboard, navigate to the EC2 Instance running Safeguard for Privileged Passwords.
  2. Select the instance.
  3. In the Description tab, locate the Security groups field then click the name of the security group.
  4. Select the Inbound tab.
  5. Click Edit.
  6. Remove any existing rules and add the following rules:
    • Type: Custom UDP Rule
      Protocol: UDP
      Port Range: 655
      Source: Anywhere
      Description: Cluster VPN
    • Type: HTTPS
      Protocol: TCP
      Port range: 443
      Source: Anywhere
      Description: Web API
    • Type: Custom TCP Rule
      Protocol: TCP
      Port Range: 8649
      Source: Anywhere
      Description: SPS Cluster
  7. Click Save.

AWS deployment

IMPORTANT: Before deploying, make sure you have read Cloud deployment considerations

Safeguard for Privileged Passwords (SPP) can be run in the cloud using Amazon Web Services (AWS).

To deploy the Amazon Machine Image (AMI) of Safeguard for Privileged Passwords from AWS, visit the AWS marketplace listing for Safeguard for Privileged Passwords (here) and follow the Deployment steps.

Disk size considerations

CAUTION: Before making any changes to the disk size, shut down the VM (stopped and deallocated).

Safeguard for Privileged Passwords (SPP) deploys with a minimal OS disk size. You should increase the size of the OS disk based on your estimated usage and budget. SPP on hardware comes with 1TB of disk. You can use more or less than this depending on how many assets, accounts, and daily users you expect to have. 500GB is a minimal production disk size and 2TB is the maximum.

Disk size can be handled through Amazon Elastic Compute Cloud (Amazon EC2). For more information, see Getting Started with Amazon EC2. When you start up the VM, SPP automatically resizes the OS disk volume to use the available space.

AWS security considerations

Running Safeguard for Privileged Passwords (SPP) in AWS comes with some security considerations that do not apply to the hardware appliance. We recommend:

  • Do not give Safeguard a public IP address.
  • Use the AWS key vault to encrypt the disk.

  • Limit access within AWS to the Safeguard virtual machine. SPP in AWS cannot protect against rogue Administrators in the same way the hardware appliance can.

Static IP address required

Configure the SPP VM with a static IP address in AWS. In AWS, the IP address must not change after the VM is deployed. If you need to change the IP address, take a backup, deploy again, and restore the backup. You can script the VM deploy to pick up an existing virtual NIC with the IP address configuration. For details, see the Amazon Virtual Private Cloud (VPC) documentation.

Deployment steps

AWS automatically licenses the operating system during the deployment with an AWS KMS.

Larger deployments warrant larger sizing choices. Safeguard for Privileged Passwords hardware appliances have 32GB of RAM and 4 processors with at least 1TB of disk space.

AWS Marketplace steps

  1. Go to the AWS marketplace listing for Safeguard for Privileged Passwords (here).
  2. On the One Identity Safeguard for Privileged Passwords page, click Continue to Subscribe.

  3. Advance through the resource creation screens to configure your instance. In addition to the Disk size considerations, AWS security considerations, and Static IP address required; One Identity recommends you select the m4.2xlarge instance type.

  4. Once you have finished configuring the instance, select to launch the instance.

    NOTE: The instance launch process may take a while to complete.

  5. Once the instance has finished launching, log into the web client using your static IP address. You will need to use the default username (admin) and password (<instance id>). You should change the admin password immediately. For details, see the Safeguard for Privileged Passwords Administration Guide, Setting a local user's password.

    NOTE: The password is unique for each deployment and the initial password will always be the instance ID of the deployed safeguard server.

View or change the cloud virtual appliance setup

You can view or change the virtual appliance setup.

You can use the Safeguard for Privileged Passwords web management kiosk on port 9337 for diagnostics and troubleshooting.

You can also check the system logs via AWS:

  1. To view the system log from AWS, select Actions, then Instance Settings, and then Get System Log.
  2. Log in via https://<your IP>:9337

To patch to a new version, use the API.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating