One Identity Safeguard for Privileged Passwords 2.11

You can configure Safeguard for Privileged Passwords to authenticate to a managed system using an account from an external identity store such as Microsoft Active Directory. In order to use this authentication type, you must first add a directory asset to Safeguard for Privileged Passwords and add domain user accounts. For more information, see Accounts.

Table 51: Directory Account authentication type properties
Property	Description
Service Account Name	Click Select Account. Choose the service account name used for management tasks. The accounts available for selection are domain user accounts that are linked to a directory that was previously added to Safeguard for Privileged Passwords.
Service Account Password	If required, enter the password used to authenticate.
Privilege Elevation Command	If required, enter a privilege elevation command (such as sudo). This is used as a prefix for commands that require privileged access on the system and to manage accounts on Unix-based systems; that is, to check and change passwords and to discover accounts. When adding an asset, Safeguard for Privileged Passwords uses this command to perform Test Connection. For more information, see About Test Connection. To enable Safeguard for Privileged Passwords to elevate the privileges of the service account, assign the asset to the scope of a partition profile that has the privilege elevation command defined. For more information, see Creating a partition profile. The privilege elevation command must run non-interactively, that is, without prompting for a password. For more information, see Preparing Unix-based systems. Limit: 255 characters
Test Connection	Click this button to verify that Safeguard for Privileged Passwords can log in to this asset using the service account credentials you have provided. For more information, see About Test Connection.
Service Account Profile	Click Edit to add the profile or — Remove to delete the assigned profile. Available profiles are based on the partition selected on the General tab (asset discovery). To update the profile later, go to the service account and update the Profile. For more information, see General tab (account).
Use Named Pipe for service account connection	Select to use the Named Pipe when connecting to the asset. Clear this check box to use TCP/IP when connecting to the asset.
Use SSL Encryption	Select this option to enable Safeguard to encrypt communication with this asset. If you do not select this option for a MicrosoftSQL Server that is configured to force encryption, Test Connection will use untrusted encryption and succeed with valid credentials. For more information about how Safeguard database servers use SSL, see How do Safeguard for Privileged Passwords database servers use SSL.
Verify SSL Certificate	Use this option to enable or disable SSL Certificate verification on the asset. When enabled, Safeguard for Privileged Passwords compares the signing authority of the certificate presented by the asset to the certificates in the Trusted Certificates store every time Safeguard for Privileged Passwords connects to the asset. Trust must be established for Safeguard for Privileged Passwords to manage the asset. For Safeguard for Privileged Passwords to verify an SSL certificate, you must add the asset's signing authority certificate to the Trusted Certificates store. Only clear the Verify SSL Certificate option if you do not want to establish trust with the asset’s
Privilege Level Password	If required, enter the system enable password to allow access to the Cisco configuration.
Auto Accept SSH Host Key	Select this option to have Safeguard for Privileged Passwords automatically accept an SSH host key. When an asset requiring an SSH host key does not have one, Check Password will fail. For more information, see Connectivity failures.
Instance	Specify the Instance name if you have configured multiple instances of a SQL Server on this asset. If you have configured a default (unnamed) instance of the SQL Server on the host, you need to provide the IP address and port number.
Port	Enter the port number to log in to the asset. This option is not available for all operating systems.
Connection Timeout	Enter the directory connection timeout period. Default: 20 seconds.

Local System Account

You can configure Safeguard for Privileged Passwords to authenticate to a managed SQL Server using a local system account and password. The local system account is a Windows user account on the server that is hosting the SQL database.

NOTE: In order to use this authentication type, you must add both a Windows asset and a SQL Server asset to Safeguard for Privileged Passwords.

Table 52: Local System Account authentication type properties
Property	Description
Service Account	Click Select Account to choose the local system account associated with the SQL Server for Safeguard for Privileged Passwords to use for management tasks.
Test Connection	Click this button to verify that Safeguard for Privileged Passwords can log in to this asset using the local system account credentials you have provided. For more information, see About Test Connection.
Use Named Pipe for service account connection	Select to use the Named Pipe when connecting to the asset. Clear this check box to use TCP/IP when connecting to the asset.
Advanced	Open to reveal the following settings:
As Privilege	Specify the Oracle privilege level to use when connecting with the selected Oracle service account, if required. The Oracle SYS account requires the privilege level SYSDBA or SYSOPER. For details, see the Oracle document, About Administrative Accounts and Privileges and SYSDBA and SYSOPER System Privileges.
Instance (Service Name)	Specify the Instance name if you have configured multiple instances of a SQL Server on this asset. If you have configured a default (unnamed) instance of the SQL Server on the host, you need to provide the IP address and port number. Specify the Service Name if you are configuring an Oracle asset.
Port	Enter the port number to log in to the asset.
Connection Timeout	Enter the SQL server connection timeout period. Default: 20 seconds

Password (local service account)

You can configure Safeguard for Privileged Passwords to authenticate to a managed system using a local service account and password.

Note: Some options are not available for all operating systems.

Table 53: Password authentication type properties
Property	Description
Distinguished Name	For LDAP platforms, enter the fully qualified distinguished name (FQDN) for the service account. For example: cn=dev-sa,ou=people,dc=example,dc=com
Service Account Name	Browse to select the service account for Safeguard for Privileged Passwords to use for management tasks. When you add the asset, Safeguard for Privileged Passwords automatically adds the service account to Accounts. For more information, see About service accounts. Required except for LDAP platforms, which use the Distinguished Name.
Service Account Password	Enter the service account password used to authenticate to this asset. Limit: 255 character
Privilege Elevation Command	If required, enter a privilege elevation command (such as sudo). This is used as a prefix for commands that require privileged access on the system and to manage accounts on Unix-based systems; that is, to check and change passwords and to discover accounts. When adding an asset, Safeguard for Privileged Passwords uses this command to perform Test Connection. For more information, see About Test Connection. To enable Safeguard for Privileged Passwords to elevate the privileges of the service account, assign the asset to the scope of a partition profile that has the privilege elevation command defined. For more information, see Creating a partition profile. The privilege elevation command must run non-interactively, that is, without prompting for a password. For more information, see Preparing Unix-based systems. Limit: 255 characters
Privilege Level Password	Enter the Enable password to allow access to the Cisco configuration.
Test Connection	Click this button to verify that Safeguard for Privileged Passwords can log in to this asset using the service account credentials you have provided. For more information, see About Test Connection.
Service Account Profile	Click Edit to add the profile or — Remove to delete the assigned profile. Available profiles are based on the partition selected on the General tab (asset discovery). To update the profile later, go to the service account and update the Profile. For more information, see General tab (account).
Auto Accept SSH Host Key	This check box is selected by default indicating that Safeguard for Privileged Passwords automatically accepts an SSH host key. This option is not available for all platforms. Once the SSH host key is discovered, the SSH host key fingerprint is displayed. When an asset requiring an SSH host key does not have one, Check Password will fail. For more information, see Connectivity failures.
Use SSL Encryption	Select this option to enable Safeguard to encrypt communication with this asset. If you do not select this option for a MicrosoftSQL Server that is configured to force encryption, Test Connection will use untrusted encryption and succeed with valid credentials. For more information about how Safeguard database servers use SSL, see How do Safeguard for Privileged Passwords database servers use SSL
Verify SSL Certificate	Use this option to enable or disable SSL Certificate verification on the asset. When enabled, Safeguard for Privileged Passwords compares the signing authority of the certificate presented by the asset to the certificates in the Trusted Certificates store every time Safeguard for Privileged Passwords connects to the asset. Trust must be established for Safeguard for Privileged Passwords to manage the asset. For Safeguard for Privileged Passwords to verify an SSL certificate, you must add the asset's signing authority certificate to the Trusted Certificates store. Only clear the Verify SSL Certificate option if you do not want to establish trust with the asset’s
As Privilege	Specify the Oracle privilege level to use when connecting with the selected Oracle service account, if required. The Oracle SYS account requires the privilege level SYSDBA or SYSOPER. For details, see the Oracle document, About Administrative Accounts and Privileges and SYSDBA and SYSOPER System Privileges.
Instance (Service Name)	Specify the Instance name if you have configured multiple instances of a SQL Server on this asset. If you have configured a default (unnamed) instance of the SQL Server on the host, you need to provide the IP address and port number. Specify the Service Name if you are configuring an Oracle asset.
Workstation ID	Specify the configured workstation ID, if applicable. This option is for IBM i systems.
Port	Enter the port number on which the asset will be listening for connections. Default: port 22; port 1433 for SQL server; port 8443 for SonicWALL SMA or CMS appliance.
Connection Timeout	Enter the connection timeout period. Default: 20 seconds

Access Key

You can configure Safeguard for Privileged Passwords to authenticate to a managed system using an access key.

Table 54: Access Key authentication type properties
Property	Description
Service Account	Enter an account for Safeguard for Privileged Passwords to use for management tasks. For more information, see About service accounts.
Access Key ID	Enter the unique identifier that is associated with the secret key. The access key ID and secret key are used together to sign programmatic AWS requests cryptographically. Limit: 32 alphanumeric characters
Secret Key	Enter a secret access key used to cryptographically sign programmatic Amazon Web Services (AWS) requests. Limit: 40 alphanumeric characters; the + and the / characters are also allowed.
Test Connection	Click this button to verify that Safeguard for Privileged Passwords can log in to this asset using the service account credentials you have provided. For more information, see About Test Connection.
Port	Enter the port number to log in to the asset.
Connection Timeout	Enter the connection timeout period. Default: 20 seconds

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

One Identity Safeguard for Privileged Passwords 2.11 - Administration Guide

Directory Account

Local System Account

Password (local service account)

Access Key