Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 7.5.1 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home page Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms Importing objects
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

Connection tab (add asset)

On the Connection tab, select a platform, an Authentication Type, and specify the account credentials. If the asset has a custom platform, the Custom Properties elements are displayed (for more information, see Custom platforms). When you create a directory asset, accounts created display as discovered accounts in the Discovered Accounts properties grid. For more information, see Discovered Accounts..

The settings for an asset are shown below.

Table 109: Asset: Connection properties
Property Description
Platform

Select an operating system or directory service, for this asset.

A custom platform can be selected. For more information, see Custom platforms..

Generic operating system selections:

Safeguard for Privileged Passwords allows you to select a generic operating system of Other, Other Managed, Other Directory, or Linux. This allows you to add an asset to Safeguard for Privileged Passwords without designating a specific platform.

  • Other: An asset with an Other operating system cannot be managed. You can manually change passwords on accounts associated with an asset with an Other operating system. Safeguard for Privileged Passwords cannot connect to the asset so there is no automatic password or SSH key check and change, test connection, or other activity requiring a connection.
  • Other Managed: Safeguard for Privileged Passwords stores the password or SSH key and can automatically check and change it per the profile configuration. There is no active connection or service account. The passwords are rotated internally and event notifications are sent when the rotation is complete. Another component or piece of automation can change the password or SSH key or make use of the password or SSH key in configuration files. For example, a listener can pick up the change event via the Safeguard for Privileged Passwords Application to Application (A2A) service and perform actions, as required.

  • Other Directory: Other Directory supports the addition of directory properties at the asset and account levels. This allows for the accounts stored on them to be used in session policy via linked accounts or directory account using the access configuration settings. Since an Other Directory is not actually connected to a directory, it is unable to discover accounts or assets that belong to the actual directory that the Other Directory represents. Therefore, all accounts, assets, and credentials will have to be manually entered in Safeguard for Privileged Passwords.

    CAUTION: Since an Other Directory is not actually connected to a directory, you are responsible for making sure that the Other Directory assets and accounts stay in sync with the actual directory that the Other Directory represents.

    For example, if you change the password in Safeguard for Privileged Passwords the password will not be set in the actual directory. This will cause the account in Safeguard for Privileged Passwords to be out of sync with the account in the actual directory. Until manually corrected, you will be unable to use the password.

    IMPORTANT: Other Directory requires a one to one relationship between the directory and the domain. If your license is per system, this may result in a large number of licenses being required to fully support your assets.

  • Linux: Safeguard for Privileged Passwords manages an asset with "Linux" on a best effort basis.

Other platform details: Any Other platform type can be changed to a different platform type. Conversely, any platform type can be changed to Other; however, any property values specific to the current platform type will be lost. For example, you may want to change a Linux operating system to any type of Linux, such as AIX, HP-UX, or Solaris. Then, the specific platform type can be changed back to Other, if needed.

Version

(Optional) Select the operating system version. When adding a Linux or Macintosh OS X system, Safeguard for Privileged Passwords allows you to choose an Other version. Custom platforms do not allow for a version to be selected.

Safeguard for Privileged Passwords does not manage passwords for accounts on domain controllers. Manage accounts on domain controllers through the directory asset that hosts the domain controller. For more information, see Adding an account to an asset..

Architecture

(Optional) The product's system architecture. Custom platforms do not allow for an architecture to be set.

Network Address

If applicable, enter a network DNS name or the IP address used to connect to the managed system over the network.

For Amazon Web Services assets, enter the Amazon AWS Account ID or Alias.

For SPS assets, if you're using both REST and SSH as part of your management protocol they will need to be hosted on the same IP.

Starling Agent ID (only available for Connect for Safeguard Assets platforms)

This is required for all assets that are using the Connect for Safeguard Assets service in Starling. Use the Browse button to select an agent registered in the Starling subscription. For more information on installing an agent, see the Connect for Safeguard Assets User Guide.

Authentication Type

Select the authentication method to use for the asset.

Domain Name (directory)

The domain for the asset (Name on the General tab). A domain can be identified for more than one directory asset so that multiple directory assets can be governed the same domain.

NetBios Name (Other Directory only)

The NetBios name of the asset.

Domain Unique Id (Other Directory only)

The unique domain identifier for the asset.

Naming Context (Other Directory only)

The naming context for the asset.

Manage Forest (Only available for some types of directory accounts)

Select if you want to manage the whole forest. Do not select if you want to manage just one domain.

Domain Controllers

(Only available for some types of directory accounts)

This value is set for a directory (such as Active Directory). To manage tasks and services on a Windows Domain Controller, you need to add a Windows Asset for the Domain Controller.

For Active Directory, instead of having Safeguard for Privileged Passwords automatically find domain controllers from a DNS and CLDAP ping, you can specify domain controllers.

RDP Session Port

If applicable, specify the access port on the target server to be used for RDP session requests.

Default: Port 3389

SSH Session Port

If applicable, specify the access port on the target server to be used for SSH session requests.

Default: Port 22

Telnet Session Port

If connecting to TN3270 or TN5250, the port for connection. By default, a telnet server typically listens on port 23.

Sync additions every [number] minutes

(directory)

Sync additions (incremental sync) syncs all changes except deletions. This is the faster type of sync.

For directory assets, enter or select how often you want to synchronize additions (in minutes). This updates Safeguard for Privileged Passwords with any additions or modifications that have been made to the objects, including group membership and user account attributes mapped to Safeguard for Privileged Passwords.

The default is 15 minutes and the range is between 1 and 2147483647 minutes.

Directory Sync is enabled by default and can be disabled. For more information, see Global Services.

Sync deletions every [number] minutes

(directory)

Sync deletions (full sync) syncs all changes and deletions. This sync takes longer (perhaps hours), especially the first time it is run based on your directory setup.

For directory assets, enter or select how often you want Safeguard for Privileged Passwords to synchronize deletions (in minutes).

This updates Safeguard for Privileged Passwords with any additions, changes, and deletions that have been made to the objects, including group membership and user account attributes mapped to Safeguard for Privileged Passwords.

The default is 15 minutes and the range is between 1 and 1440 minutes.

Directory Sync is enabled by default and can be disabled. For more information, see Global Services.

You can run the deletion (full) sync on demand using the API Assets/Synchronize and IdentityProviders/Synchronize.

Privileged Account Name (read-only)

When configuring Cisco IOS, Cisco ASA, or Check Point GAiA assets, this read-only field displays enable (Cisco IOS and Cisco ASA) or expert (Check Point GAiA).

Account Name

For SPS assets, enter the name of the service account to be managed. Use the Reset button to remove a previously configured account.

Hide Alter User command from verbose log_statement logging

This option to hide Alter User commands is enabled by default for new PostgreSQL assets with log_statement configured starting with Safeguard for Privileged Passwords 7.1. Customers upgrading to 7.1 that want to enable the option will need to reconfigure any existing PostgreSQL assets with log_statement configured to have a service account with superuser permissions and enable the option.

Table 110: Connection tab: Asset authentication types
Authentication Type Description
SSH Key To authenticate to the asset using an SSH authentication key.
Directory Account

To authenticate to the asset using a directory account from an external identity store such as Microsoft Active Directory.

NOTE: In order to use this authentication type, you must first add a directory asset and add domain user accounts. For more information, see Accounts..

Starling Connect

To authenticate to the asset using a connector configured in Starling Connect.

NOTE: In order to use this authentication type, you must first register a Starling Connect connector. For more information, see Registered Connectors.

Local System Account

For SQL Server assets, to authenticate to the asset using a local system account, which is a Windows user account on the server that is hosting the SQL database.

Password (local service account)

To authenticate to the asset using a local service account and password.

Account Password

When the function account credentials are not in the custom script, for example, Amazon Web Services. For more information, see Adding a cloud platform account..

Access Key

For Amazon Web Services assets, to authenticate to the asset using an access key. For more information, see Adding a cloud platform account..

Custom

No authentication information is taken because the custom parameters or parameters in a customer platform script are used. No accounts associated with the asset are stored. For more information, see Custom platforms..

None

No authentication information is taken and check/change functions are disabled. No accounts associated with the asset are stored.

Safeguard for Privileged Passwords discovers the SSH host key of discovered assets even if you selected None as the service account credential type.

Test Connection

Verify that Safeguard can log in to the asset using the service account credentials that you have provided.

Timeout

Enter how long to wait (in seconds) for both the connect and command timeout.

Client ID: For SAP assets, enter the client ID.

Custom Properties

If the Platform field on the Connection tab identified a custom platform, complete the dialog based on the custom properties of the custom platform script. Safeguard for Privileged Passwords checks to ensure the values match the type of the property that include a string, boolean, integer, or password (which is called secret in the API scripts). Safeguard for Privileged Passwords cannot check the validity or system impact of values entered for custom platforms.For more information, see Creating a custom platform script..

About service accounts

Safeguard for Privileged Passwords uses a service account to connect to an asset to securely manage accounts and passwords on that asset. Therefore, a service account needs sufficient permissions to edit the passwords of other accounts.

When you add an asset, Safeguard for Privileged Passwords adds its service account to the list of Accounts. By default, Safeguard for Privileged Passwords automatically manages the service account password and SSH keys according to the check and change schedules in the profile that governs its asset. See: Creating a password profile and Creating an SSH key profile.

When adding a service account, Safeguard for Privileged Passwords automatically disables it from access requests. If you want the password or SSH key to be available for release, click Access Requests and select Enable Password Request or Enable SSH Key Request. If you want to enable session access, select Enable Session Request.

TIP: As a best practice, if you do not want Safeguard for Privileged Passwords to manage a service account password or SSH key, add the account to a profile that is set to never change passwords or SSH keys.

If you delete a service account, Safeguard for Privileged Passwords changes the asset's authentication type to None, which disables automatic password or SSH key management for all accounts that are associated with this asset. A user can continue to check out the passwords or SSH keys, however, if the policy that governs the account requires that it change the password or SSH key after release, the password or SSH key can get stuck in a pending password reset state. For more information, see Password or SSH key is pending a reset..

Test connectivity

The most common causes of failure in Safeguard for Privileged Passwords are either connectivity issues between the appliance and the managed system, or problems with service accounts. If you experience issues, first verify that you can access the managed system from another system (independent of Safeguard for Privileged Passwords), using the service account. For more information about troubleshooting connectivity issues, see Test Connection failures and Connectivity failures.

About Test Connection

When adding an asset, Test Connection verifies that Safeguard for Privileged Passwords can log in to the asset using the service account credentials that you have provided.

When adding an asset that requires an SSH host key, Test Connection first discovers the key and presents it to you for acceptance. When you accept it, Test Connection then verifies that Safeguard for Privileged Passwords can log in to the asset using the service account credentials that you have provided.

Once you save the new asset, Safeguard for Privileged Passwords saves the service account credentials. Safeguard for Privileged Passwords uses these credentials to connect to an asset to securely manage accounts and passwords on that asset. For more information, see About service accounts..

If you want to verify an existing asset's connectivity, use the Test Connection button in the web client. For more information, see Checking an asset's connectivity..

If you have entered values for Specify Domain Controllers and if SPP does not find a domain controller in the list, the test connection fails and an error is returned.

Related Topics

Test Connection failures

SSH Key

On the Connection tab, you can configure Safeguard for Privileged Passwords to authenticate to a managed system using an SSH authentication key. To rotate SSH keys, you must select the Manage SSH Key option in the asset's profile change schedule. For more information, see Adding SSH key change settings..

NOTE: This option is not available for all operating systems. But if a Safeguard for Privileged Passwords asset requires an SSH host key and does not have one, Check SSH Key, Change SSH Key, and Test Connection will fail. For more information, see Connectivity failures..

The information that displays depends on whether you choose to automatically generate the SSH key or import and manually deploy the SSH key.

Table 111: SSH Key authentication type properties
Property Description

SSH Key Generation and Deployment

Select one of the following options:

  • Automatically generate and deploy a new SSH Key

    • In the Password field, enter the password for the SSH Key.

  • Automatically generate a new SSH Key that I will deploy myself

  • Import an SSH Key that I will deploy myself

    NOTE:Safeguard for Privileged Passwords does not currently manage the options for an authorized key. If an imported key has any options configured in the authorized keys file on the asset, these options will not be preserved when the key is rotated by Safeguard for Privileged Passwords.

    1. Click Browse. On the Import an SSH Key dialog, click Browse then select the Private Key File.

    2. Enter a Password, if desired. A password is required if the private key is encrypted.

    3. Click Import.

Key Comment

(Optional) Enter a description of this SSH key. Maximum length of 225 characters.

Account Name

Enter the service account name that Safeguard for Privileged Passwords is to use for management tasks. This is the account Safeguard for Privileged Passwords uses to install the SSH authentication key on the asset. For more information, see About service accounts..

Privilege Elevation Command

If required, enter a privilege elevation command (such as sudo). This is used as a prefix for commands that require privileged access on the system and to manage accounts on Unix-based systems; that is, to check and change SSH keys and to discover accounts.

Sudo commands follow.

  • AuthorizedKeyCommand
Specify a program to look up the user's public keys
  • cat
  • chmod
  • chown
  • cp
  • echo
  • egrep
  • find
  • grep
  • host
  • ls
  • mkdir
  • mv
  • rm
  • sed
  • sshd
  • ssh-keygen
  • tee
  • test
  • touch
  • usermod

When adding an asset, this command is used to perform Test Connection. For more information, see About Test Connection..

The privilege elevation command must run non-interactively, that is, without prompting for a password. For more information, see Preparing Unix-based systems.

The limit is 255 characters.

Auto Accept SSH Host Key

Select this option to have Safeguard for Privileged Passwords automatically accept the SSH host key when it creates the Safeguard for Privileged Passwords asset.

When this option is selected, Safeguard for Privileged Passwords displays the thumbprint of the SSH host key that was discovered. When a managed system requiring an SSH host key does not have one, Check SSH Key will fail. For more information, see Connectivity failures..

Test Connection

Click this button to verify that Safeguard for Privileged Passwords can log in to this asset using the service account credentials you have provided. For more information, see About Test Connection..

Port

Enter the port number used by SSH to log in to the managed system.

Required

Connection Timeout

Enter how long to wait (in seconds) for both the connect and command timeout.

Default: 20 seconds

(Custom platform operation

e.g Check System Properties)

If there is a custom parameter in the custom platform script, enter the custom parameter here. The list of system parameters are here: Writing a custom platform script. Any parameter not in the list is a custom parameter.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating