Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 7.5 - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing IPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving Cleaning up audit data Using plugins Forwarding data to third-party systems Starling integration
User management and access control
Login settings Managing One Identity Safeguard for Privileged Sessions (SPS) users locally Setting password policies for local users Managing local user groups Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database Authenticating users to a RADIUS server Authenticating users with X.509 certificates Authenticating users with SAML2 Managing user rights and usergroups Creating rules for restricting access to search audit data Displaying the privileges of users and user groups Listing and searching configuration changes
Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received Using UPN usernames in audited SSH connections
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Naming

Figure 51: Basic Settings > Network > Naming

  • Hostname: Name of the machine running SPS.

  • Nick name: The nickname of SPS. Use it to distinguish the devices. It is displayed in the core and boot login shells.

  • DNS search domain: Name of the domain used on the network. When resolving the domain names of the audited connections, SPS will use this domain to resolve the target hostname if the appended domain entry of a target address is empty.

  • Primary DNS server: IP address of the name server used for domain name resolution.

  • Secondary DNS server: IP address of the name server used for domain name resolution if the primary server is unaccessible.

HTTPS proxy

The HTTPS proxy settings must be configured if your company policies do not allow devices to connect directly to the web. Once configured, SPS uses the configured proxy server for outbound web requests to external integrated services, such as Join to Starling or SPS plugins.

Figure 52: Basic Settings > Network > HTTPS proxy

  • Proxy server: The IP address or DNS name of the proxy server.

  • Port: The IP address or DNS name of the proxy server.

    NOTE:

    If different ports are specified in the Proxy server and the Port field, the Port field takes precedence.

  • Username: The user name used to connect to the proxy server.

    NOTE:

    The username and password are only required if your proxy server requires them to be specified.

  • Password: The password required to connect to the proxy server.

    NOTE:

    The username and password are only required if your proxy server requires them to be specified.

Configuring user and administrator login addresses

You can configure two separate login addresses for accessing the web interface of One Identity Safeguard for Privileged Sessions (SPS):

  • Web login (admin): On this address, users can, depending on their access privileges, modify the configuration of SPS, and perform authentication-related activities (gateway authentication, 4-eyes authorization).

  • Web login (user): The configuration of SPS cannot be viewed or altered from this address. Users (even ones with administrator privileges) can only perform gateway authentication and 4-eyes authorization.

NOTE: For more information on gateway authentication and 4-eyes authorization, see Advanced authentication and authorization techniques.

Both login addresses can be configured to restrict connections to a configured set of IP addresses only.

NOTE:

When configuring HTTP or SSH connections, avoid using the IP address configured for administrator or user login on SPS.

To configure two separate login addresses for accessing the web interface of SPS

  1. Navigate to Basic Settings > Local Services > Web login.

    Figure 53: Basic Settings > Local Services > Web login — Configuring web login address

  2. Choose in the Listening addresses field.

  3. Enter the IP address to use for connecting to SPS's user interface into the Address field.

    The available addresses correspond to the interface addresses configured in Basic Settings > Network > Interfaces. Only IPv4 addresses can be selected.

  4. Enter the port number for HTTP connections into the HTTP field.

  5. Enter the port number for HTTPS connections into the HTTPS field.

  6. (Optional) To permit access to the SPS web interface only from selected subnets or IP addresses, select Restrict clients, click and enter the IP address and netmask of the allowed clients. Note that these settings do not affect the SSH access to SPS.

    		 Caution:

    Permit administrative access to SPS only from trusted networks. If possible, monitored connections and administrative access to the SPS web interface should originate from separate networks.

    After comitting the changes, the web interface will be available only from the configured subnets or IP addresses.

    Use an IPv4 address.

  7. Recommended: configure a separate login address for user connections in Web login (user). The configuration settings of SPS cannot be viewed or modified from this address.

  8. Click Commit.

Managing logical interfaces

You can assign logical interfaces to a physical interface. Each logical interface must have its own VLAN ID, and can have its own set of (alias) IP addresses and prefixes. The configured name for each logical interface is visible on One Identity Safeguard for Privileged Sessions (SPS)'s user interface only.

You can configure IPv4 and IPv6 addresses as well. IPv6 is intended for configuring monitored connections. Local services (including the web login) require IPv4 addresses. An interface can have multiple IP addresses, including a mix of IPv4 and IPv6 addresses.

NOTE: SPS does not support scenarios with two hosts using the same IP address on different VLAN groups.

To manage logical interfaces

  1. Navigate to Basic Settings > Network > Interfaces.

    Figure 54: Basic Settings > Network > Interfaces — Managing the logical interfaces

  2. If necessary, use the label on the SPS hardware to identify the physical interface to which you want to assign a logical interface.

  3. Choose to add a new logical interface. Provide the following:

    • VLAN: The VLAN ID of the logical interface. Optional.

      		 Caution:

      Do not set the VLAN ID unless your network environment is already configured to use this VLAN. Otherwise, your SPS appliance will be unavailable using this interface.

    • Address: The IP address of the logical interface.

      Alternatively, you can enter a hostname instead. SPS automatically resolves the hostname to an IP address.

      NOTE: Note the following limitations:

      • To resolve the hostnames, SPS uses the Domain Name Servers set in the Basic Settings > Network > Naming > Primary DNS server and Secondary DNS server fields.

      • If the Domain Name Server returns multiple IP addresses, SPS randomly selects from the list.

      NOTE: Do not use IP addresses that fall into the following ranges:

      • 1.2.0.0/16 (reserved for communication between SPS cluster nodes)

      • 127.0.0.0/8 (localhost IP addresses)

    • Prefix: The IP range of the logical interface.

    • Optional: To add additional (alias) IP addresses and prefixes to a logical interface, click . To remove an alias IP address, click the corresponding .

    • MTU: Maximum Transmission Unit (MTU) to set per network interface (VLAN or network interface card). The default value is 1500.

    • Name: The name of the logical interface. This name is visible on SPS's user interface only.

    To remove a logical interface, choose the on the right side.

  4. Click .

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating