Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 7.5.1 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home page Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms Importing objects
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

Preparing systems for management

Before you add systems to Safeguard for Privileged Passwords (Adding an asset), you must ensure they are properly configured.

Generally, to prepare an asset for Safeguard for Privileged Passwords:

  1. Create a functional account (called a "service" account in Safeguard for Privileged Passwords) on the asset and assign it a password or an SSH key, if the platform supports SSH keys.

    NOTE: To add an asset to Safeguard for Privileged Passwords, it must have a service account. For more information, see About service accounts..

  2. Grant the service account sufficient permissions.
  3. Test the service account connectivity.
  4. Configure the security protocol.

  5. For platforms that support SSL server certificate validation, add the server’s signing authority certificate to the Trusted Certificates store in Safeguard for Privileged Passwords. For more information, see Trusted CA Certificates..

The following topics can help you prepare your hosts for management by Safeguard for Privileged Passwords:

Safeguard for Privileged Passwords supports a variety of platforms. For more information, see Supported platforms..

Preparing ACF - Mainframe systems

This applies to both ACF2 - Mainframe and ACF2 - Mainframe LDAP platforms.

To prepare IBM ACF-mainframe systems for Safeguard for Privileged Passwords

  1. Create a service account on the asset and assign it a password. The service account must have the SECURITY attribute enabled for ACF2 ChangePassword to work properly.
  2. Grant the service account the privileges required to use the ALTERUSER command on other profiles.

  3. If not already installed, install a telnet server on the z/OS system. If required, secure telnet with SSL.

    NOTE: Please refer to your IBM z/OS system documentation for details on installing and configuring the telnet server (and SSL).

  4. Test the telnet server using a Windows-based 3270 emulator or on Linux, use the telnet-ssl or x3270 programs to test SSL and non-SSL connections to an z/OS system.
  5. In Safeguard for Privileged Passwords, create the asset and accounts for the z/OS system using password authentication.
About certificate support for the telnet protocol

Safeguard for Privileged Passwords automatically accepts any server certificate that the connection offers and does not verify the trust chain on the telnet certificate. In addition, Safeguard for Privileged Passwords does not support client certificate selection, so if telnet requires that the client present a certificate that is signed by a recognized authority, Safeguard for Privileged Passwords cannot support that configuration.

Preparing Amazon Web Services platforms

Safeguard for Privileged Passwords supports Amazon Web Services (AWS), a secure cloud services platform.

When adding an Amazon Web Services asset, the Network Address must contain the AWS Account ID or Alias.

To prepare Amazon Web Services platforms for Safeguard for Privileged Passwords

  1. In Safeguard for Privileged Passwords: 

    1. Ensure the latest Amazon's certificate and AWS certificate's root certificate authority (CA) are in the Trusted Certificates store in Safeguard for Privileged Passwords.

    2. Configure an Identity and Access Management (IAM) user to use as a service account.

    3. Assign the IAM service account to the AdministratorAccess security policy.

  2. In Amazon:

    1. Create an access key for the IAM service account. Amazon creates a pair of data items called a Secret Key and a public Access Key ID. Take a note of both the Access Key ID and Secret Key. You will need them when you add the Amazon Web Services asset to Safeguard for Privileged Passwords.

Preparing Cisco devices

There are 4 Cisco platforms supported in Safeguard for Privileged Passwords:

  • Cisco ISE CLI platform: Safeguard for Privileged Passwords uses a local service account to manage accounts on the ISE CLI platform using SSH.

  • Cisco IOS/ASA platform: Cisco IOS/ASA platforms can be configured in the following ways to manage local accounts using SSH:

    • Safeguard for Privileged Passwords uses a local service account to manage accounts on the Cisco device.

    • If the Cisco device is configured (using AAA) to authenticate and authorize login requests to a Cisco ISE server that will be managed by Safeguard for Privileged Passwords, then you can use a directory account in the Cisco ISE directory asset to manage the Cisco device.

    • If the Cisco device is configured (using AAA) to authenticate and authorize login requests to a Cisco ISE server that is integrated with an Active Directory domain that will be managed by Safeguard for Privileged Passwords, then you can use a directory account in the Active Directory asset to manage accounts on the Cisco device.

    • If the service account is not configured with privilege level 15, then the enable password for privilege level 15 will be required when creating the asset.

  • Cisco ISE platform: Cisco ISE is managed as a directory asset in Safeguard for Privileged Passwords. It uses REST and TACACS+ to manage local accounts. It supports account discovery and password management. It does not support directory synchronization, asset discovery, or service discovery.

  • Cisco NX-OS platform: In order to perform all required operations on users, the service account used requires at least network-admin privileges.

ClosedCisco ISE CLI platform
ClosedCisco IOS/ASA platform
ClosedCisco ISE platform
ClosedCisco NX-OS platform
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating