Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 7.4 - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing IPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving Cleaning up audit data Using plugins Forwarding data to third-party systems Starling integration
User management and access control
Login settings Managing One Identity Safeguard for Privileged Sessions (SPS) users locally Setting password policies for local users Managing local user groups Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database Authenticating users to a RADIUS server Authenticating users with X.509 certificates Authenticating users with SAML2 Managing user rights and usergroups Creating rules for restricting access to search audit data Displaying the privileges of users and user groups Listing and searching configuration changes
Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received Using UPN usernames in audited SSH connections
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Accessing the One Identity Safeguard for Privileged Sessions (SPS) console

The following topics describe how to use the console menu of One Identity Safeguard for Privileged Sessions (SPS), how to enable remote SSH access to SPS, and how to change the root password from the web interface.

Topics:

Using the console menu of One Identity Safeguard for Privileged Sessions (SPS)

Connecting to One Identity Safeguard for Privileged Sessions (SPS) locally or remotely using Secure Shell (SSH) allows you to access the console menu of SPS. The console menu provides access to the most basic configuration and management settings of SPS. It is mainly used for troubleshooting purposes, the primary interface of SPS is the web interface.

The console menu is accessible to the root user using the password set during completing the Welcome Wizard.

Figure 141: The console menu

The console menu provides allows you to perform the following actions.

Access the local core and boot shells.

This is usually not recommended and only required in certain troubleshooting situations. Select the boot/core shell's keyboard layout for the local console. This will not affect the keyboard layout if you have accessed the shell via SSH.

The boot firmware boots up SPS, provides High Availability support, and starts the core firmware. The core firmware, in turn, handles everything else: provides the web interface, manages the connections, and so on.

Select the active firmware, and delete unneeded firmwares.

Accessing the firmware management is useful if after an update the new firmware does not operate properly and the web interface is not available to activate the previous firmware.

Start backup processes.

For more information about backup processes, see Data and configuration backups.

Change the passwords of the root and admin users.

For details, see Changing the root password of One Identity Safeguard for Privileged Sessions (SPS).

Access the network-troubleshooting functions and display the available log files.

If the web interface is inaccessible, it can be the result of an internal locking error. To resolve this issue, delete the lock files. After deletion, they are archived, and included in the support bundle if they are not older than 30 days. To create a support bundle, if the web interface is inaccessible, select Create support bundle.

NOTE: If deleting the lock files did not resolve the issue, contact our Support Team.

Reboot and shutdown the system.

For details, see Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown.

Enable and disable sealed mode.

For details, see Sealed mode.

Set the IP address of the HA interface.

For more information about assigning an IP address to the HA interface of a node, see Resolving an IP conflict between cluster nodes.

NOTE: Note that logging in to the console menu automatically locks the SPS interface, meaning that users cannot access the web interface while the console menu is used. The console menu can be accessed only if there are no users accessing the web interface. The connection of web-interface users can be terminated to force access to the console menu.

Enabling SSH access to the One Identity Safeguard for Privileged Sessions (SPS) host

Exclusively for troubleshooting purposes, you can access the One Identity Safeguard for Privileged Sessions (SPS) host using SSH.

Completing the Welcome Wizard automatically disables SSH access to SPS. Re-enabling it allows you to connect remotely to the SPS host and login using the root user. The password of the root user is the one you provided in the Welcome Wizard. For details on how to change the root password from the web interface, see Changing the root password of One Identity Safeguard for Privileged Sessions (SPS).

 Caution:

Accessing the One Identity Safeguard for Privileged Sessions (SPS) host directly using SSH is not recommended or supported, except for troubleshooting purposes. In such case, the One Identity Support Team will give you exact instructions on what to do to solve the problem.

For security reasons, disable SSH access to SPS when it is not needed. For details, see .

The following encryption algorithms are configured on the local SSH service of SPS:

  • Key exchange (KEX) algorithms:

    diffie-hellman-group-exchange-sha256

  • Ciphers:

    aes256-ctr,aes128-ctr

  • Message authentication codes:

    hmac-sha2-512,hmac-sha2-256

NOTE: From SPS version 7.4, the local SSH console of SPS does not support signature algorithms based on SHA-1. The stronger RFC8332 RSA/SHA-256/512 algorithms are transparently used instead if client support is present (like in OpenSSH versions since 7.2 and in PuTTY versions since 0.75).

SSH access is, by default, protected against brute-force attacks: after 20 unsuccessful login attempts, the offending IP is blocked from accessing the SSH service for ten minutes.

You can turn off brute force protection by unselecting the Protect against brute-force attacks option for the SSH server.

To enable SSH access to the SPS host

  1. Navigate to Basic Settings > Local Services > SSH server.

    Figure 142: Basic Settings > Local Services > SSH server — Enabling remote SSH access to SPS

  2. Select the Enable option.

    NOTE: Remote SSH access is automatically disabled if Sealed mode is enabled. For details, see Sealed mode.

  3. Choose the authentication method for the remote SSH connections.

    • To enable password-based authentication, select the Enable password authentication option.

    • To enable public-key authentication, click in the Authorized keys field, click and upload the public keys of the users who can access and manage SPS remotely via SSH.

      SPS allows you to use the following SSH host keys:

      • RSA (ssh-rsa), which is the most widely used public-key algorithm for the SSH key. In SPS, uploading RSA SSH host keys are supported in PKCS #1 PEM, PKCS #8 PEM, OpenSSH (openssh-key-v1), and PuTTY private key formats.

        TIP: One Identity recommends using 2048-bit RSA keys (or stronger).

      • Ed25519 (ssh-ed25519), which offers a better security and faster performance compared to RSA.

        In SPS, uploading Ed25519 SSH host keys are supported in PKCS #8 PEM, OpenSSH (openssh-key-v1), and PuTTY private key formats.

      You can have multiple SSH server host keys on SPS for the same server, however, you cannot set more than one key for each type. For example, you can keep your old RSA SSH key and generate a new Ed25519 key but you cannot set two RSA keys.

  4. Choose an address and a port for the SSH server in the Listening addresses section.

    The available addresses correspond to the interface addresses configured in Basic Settings > Network > Interfaces. Only IPv4 addresses can be selected.

    To add multiple addresses, click .

  5. (Optional) To permit SSH acces only from selected subnets or IP addresses, select Restrict clients, click and enter the IP address and netmask of the allowed clients.

    Use an IPv4 address.

    To add multiple addresses, click .

  6. Click .

Changing the root password of One Identity Safeguard for Privileged Sessions (SPS)

The root password is required to access One Identity Safeguard for Privileged Sessions (SPS) locally, or remotely via an SSH connection. Note that the password of the root user can be changed from the console menu as well. For details, see Accessing the One Identity Safeguard for Privileged Sessions (SPS) console.

To change the root password of SPS

  1. Navigate to Basic Settings > Management > Change root password.

    Figure 143: Basic Settings > Management > Change root password — Changing the root password of SPS

  2. Enter the new password into the New root password and Confirm password fields.

    NOTE: SPS accepts passwords that are not longer than 150 characters and supports the following characters:

    • Letters A-Z, a-z

    • Numbers 0-9

    • The space character

    • Special characters: !"#$%&'()*+,-./:;<>=?@[]\^-`{}_|

  3. Click .

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating