Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 7.0.3 LTS - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Enable or Disable Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions About us

Preparing Amazon Web Services platforms

Safeguard for Privileged Passwords supports Amazon Web Services (AWS), a secure cloud services platform.

When adding an Amazon Web Services asset, the Network Address must contain the AWS Account ID or Alias.

To prepare Amazon Web Services platforms for Safeguard for Privileged Passwords

  1. In Safeguard for Privileged Passwords:

    1. Add Amazon's certificate and AWS certificate's root certificate authority (CA) to the Trusted Certificates store in Safeguard for Privileged Passwords.

    2. Configure an Identity and Access Management (IAM) user to use as a service account.
    3. Assign the IAM service account to the AdministratorAccess security policy.

  2. In Amazon:

    1. Create an access key for the IAM service account. Amazon creates a pair of data items called a Secret Key and a public Access Key ID. Take a note of both the Access Key ID and Secret Key. You will need them when you add the Amazon Web Services asset to Safeguard for Privileged Passwords.

Preparing Cisco devices

There are 4 Cisco platforms supported in Safeguard for Privileged Passwords:

  • Cisco ISE CLI platform: Safeguard for Privileged Passwords uses a local service account to manage accounts on the ISE CLI platform using SSH.

  • Cisco IOS/ASA platform: Cisco IOS/ASA platforms can be configured in the following ways to manage local accounts using SSH:

    • Safeguard for Privileged Passwords uses a local service account to manage accounts on the Cisco device.

    • If the Cisco device is configured (using AAA) to authenticate and authorize login requests to a Cisco ISE server that will be managed by Safeguard for Privileged Passwords, then you can use a directory account in the Cisco ISE directory asset to manage the Cisco device.

    • If the Cisco device is configured (using AAA) to authenticate and authorize login requests to a Cisco ISE server that is integrated with an Active Directory domain that will be managed by Safeguard for Privileged Passwords, then you can use a directory account in the Active Directory asset to manage accounts on the Cisco device.

  • Cisco ISE platform: Cisco ISE is managed as a directory asset in Safeguard for Privileged Passwords. It uses REST and TACACS+ to manage local accounts. It supports account discovery and password management. It does not support directory synchronization, asset discovery, or service discovery.

  • Cisco NX-OS platform: In order to perform all required operations on users, the service account used requires at least network-admin privileges.

ClosedCisco ISE CLI platform
ClosedCisco IOS/ASA platform
ClosedCisco ISE platform
ClosedCisco NX-OS platform

Preparing Dell iDRAC devices

Safeguard for Privileged Passwordssupports the Dell Remote Access Controller that is integrated with Dell PowerEdge servers. Safeguard for Privileged Passwords uses the SSH protocol to connect to iDRAC devices.

To prepare an iDRAC device for Safeguard for Privileged Passwords

  1. Use iDRAC to create a service account with administrator privileges and assign it a password.

    The service account must have login privileges and must be able to configure users.

  2. Verify that SSH is enabled in the iDRAC Network settings.
  3. In Safeguard for Privileged Passwords, create the asset and accounts for the iDRAC device using password authentication.

Preparing VMware ESXi hosts

Safeguard for Privileged Passwords supports VMware ESXi hosts.

IMPORTANT: Safeguard for Privileged Passwords can only manage local users on a VMware host.

To prepare a VMware ESXi host for Safeguard for Privileged Passwords

  1. Use an existing account or create a new account as the service account on the asset and assign it a password.

    The default administrator account is suitable.

  2. Grant the service account the privileges required to set user passwords using the web management API.
  3. When adding a VMware ESXi host to Safeguard for Privileged Passwords:
    1. Specify the network address.
    2. Specify port 443 as the HTTPS port.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating