Safeguard for Privileged Passwords uses the SSH protocol to connect to Unix-based systems.
To prepare Unix-based systems (AIX, HP-UX, Linux, Macintosh OS X, Solaris, and FreeBSD platforms)
Create a service account on the asset with sufficient permissions.
You need to at least configure a password for the service account. If you want to use an SSH key generated and configured by Safeguard for Privileged Passwords, then you also need to make sure the service account’s home directory exists.
Ensure that the service account can run the following list of commands with root privileges non-interactively; that is, without prompting for a password.
For example, on a Linux system add the following line in the sudoers file:
<SerAcctName> ALL=(root) NOPASSWD: /usr/bin/passwd
The commands a service account must run with root privileges non-interactively are:
Linux and most Unix-based systems:
AIX:
Mac OS X
Enable and configure the SSH server to allow the service account to log in remotely. For example, on a Mac, enable Remote Login for the service account.
|
Note: Different versions of Linux and Unix may require slightly different parameters for SSH configuration. Consult a Linux/Unix system administrator or the system documentation for assistance. |
To prepare Windows systems for Safeguard for Privileged Passwords
-OR-
Configure the system's firewall to allow the following predefined incoming rules:
These rules allow incoming traffic on TCP port 135 and TCP SMB 445 respectively.
Port 389 is LDAP for connections. LDAP port 389 connections are used for Active Directory asset discovery and directory accounts discovery.
Change the local security policy:
Before Safeguard for Privileged Passwords can reset local account passwords on Windows systems, using a service account that is a non-built-in administrator, you must change the local security policy to disable the User Account Control (UAC) Admin Approval Mode ("Run all administrators in Admin Approval Mode") option. For more information, see Change password fails.
For additional information on ports, see .
The following minimum permissions are required for Windows assets to perform directory password management and sessions management tasks.
Using a Local account or Domain account:
Remote Activation permission on computer
|
NOTE: To set Remote Enable and Enable Account permissions
To set Remote Activation permissions
|
Using a Domain account:
Using a Local account:
Using a Domain account:
One Identity recommends the following resolutions to some of the common problems you might encounter as you deploy and use Safeguard for Privileged Passwords. For more information about how to troubleshoot Safeguard for Privileged Passwords, refer to the Appliance settings.
Anti Cross-Site Request Forgery token error
Incorrect authentication credentials
Missing or incorrect SSH host key
Service account has insufficient privileges
Cannot connect to remote machine through SSH or RDP
Domain user denied access to Safeguard for Privileged Passwords
My Mac keychain password was lost
System services did not update or restart after password change
SPP to SPS join error resolution
Test Connection failures on archive server
Windows WMI connection failure
© 2019 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy