Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 7.5.x - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home page Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms Importing objects
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

Connectivity failures

The most common causes of failure in SPP are either connectivity issues between the appliance and the managed system, or problems with service accounts.

Always verify network connectivity and asset power before troubleshooting.

The following topics explain some possible reasons that Check Password, Change Password, and Set Password may fail, and gives you some corrective steps you can take.

Change password or SSH key fails

A local account password or SSH key change can fail when you are using a Windows asset that is configured with a service account with Administrative privileges, other than the built-in Administrator.

NOTE: Before SPP can change local account passwords on Windows systems, using a member of an administrators group other than built-in Administrator, you must change the local security policy to disable User Account Control (UAC) Admin Approval Mode (Run all administrators in Admin Approval Mode) option.

To configure Windows assets to change account passwords

  1. Run secpol.msc from the Run dialog,

    -OR-

    From the Windows Start menu, open Local Security Policy.

  2. Navigate to Local Policies > Security Options.
  3. Disable the User Account Control: Run all administrators in Admin Approval Mode option.
  4. Restart your computer.

For more information, see Preparing Windows systems..

Incorrect authentication credentials

You must have the correct user name and password or SSH key to authenticate to an asset.

To resolve incorrect service account credentials

  1. Verify the service account credentials match the credentials in SPP asset information (Asset Management > Assets > General Tab, Connection). For more information, see About service accounts..
  2. Perform Test Connection to verify connection. For more information, see About Test Connection..
  3. Attempt to check, change, and set password or SSH keys again. See:

Missing or incorrect SSH host key

If a SPP asset requires an SSH host key and does not have one, SPP will not be able to communicate with the asset. For more information, see Certificate issue..

To resolve missing SSH host keys

To verify that an asset has an SSH host key, select the asset and look under Connection on the General view. If there is no SSH Host Key Fingerprint displayed, you need to add one.

To add an SSH host key

  1. Open the asset's Connection tab.

  2. Choose any authentication type (except None) and enter required information.

    NOTE: You must enter the service account password or SSH key again.

  3. Click Test Connection.

    Test Connection verifies that the appliance can communicate with the asset.

  4. Confirm that you accept the SSH host key.

    NOTE: To bypass the SSH host key verification and automatically accept the key, click the Auto Accept SSH Host Key option.

  5. Click OK to save asset.

To resolve incorrect SSH host keys

SPPuses the following host key algorithms for key exchange:

  • DSA
  • ECDSA
  • RSA

Investigate the cause of the mismatch and then use Test Connection to resolve the mismatch.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating