One Identity Safeguard for Privileged Passwords 2.4 - Administration Guide

Prepare Unix-based systems

Safeguard for Privileged Passwords uses the SSH protocol to connect to Unix-based systems.

To prepare Unix-based systems (AIX, HP-UX, Linux, Macintosh OS X, Solaris, and FreeBSD platforms)

1. Create a service account on the asset with sufficient permissions.

   You need to at least configure a password for the service account. If you want to use an SSH key generated and configured by Safeguard for Privileged Passwords, then you also need to make sure the service account’s home directory exists.

2. Ensure that the service account can run the following list of commands with root privileges non-interactively; that is, without prompting for a password.

   For example, on a Linux system add the following line in the sudoers file:

   <SerAcctName> ALL=(root) NOPASSWD: /usr/bin/passwd

   The commands a service account must run with root privileges non-interactively are:

   Linux and most Unix-based systems:

   • egrep
   • grep
   • passwd

   AIX:

   • sed
   • passwd
   • pwdadm

   Mac OS X

   • dscl
   • passwd

3. Enable and configure the SSH server to allow the service account to log in remotely. For example, on a Mac, enable Remote Login for the service account.

   Note: Different versions of Linux and Unix may require slightly different parameters for SSH configuration. Consult a Linux/Unix system administrator or the system documentation for assistance.

Prepare Windows systems

To prepare Windows systems for Safeguard for Privileged Passwords

1. Create a service account on the asset and assign it a password:
   • Directory Configuration:
     If the Windows system is joined to a domain that will be managed in Safeguard for Privileged Passwords, you can use a directory account, such as a Microsoft Active Directory account to manage the asset. Enable the Password Never Expires option; once you add the asset to Safeguard for Privileged Passwords, you can have the service account password auto-managed to keep it secure.

     -OR-

   • Local Configuration:
     If the Windows system is not joined to a domain, then use a local service account that has been granted sufficient permissions.
2. Grant the service account sufficient permissions to change account permissions to change account passwords. For more information, see Minimum required permissions for Windows assets.

3. Configure the system's firewall to allow the following predefined incoming rules:

   • Windows Management Instrumentation (DCOM-In)
   • NetLogon Service (NP-In)

   These rules allow incoming traffic on TCP port 135 and TCP SMB 445 respectively.

4. Ensure the following ports are accessible:

   • Port 389 is LDAP for connections. LDAP port 389 connections are used for Active Directory asset discovery and directory accounts discovery.

   • Port 445 SMB is used to perform password check and changes.
   • When possible, RPC ephemeral ports should also be accessible. For more information, see Service overview and network port requirements for Windows.

5. Change the local security policy:

   Before Safeguard for Privileged Passwords can reset local account passwords on Windows systems, using a service account that is a non-built-in administrator, you must change the local security policy to disable the User Account Control (UAC) Admin Approval Mode ("Run all administrators in Admin Approval Mode") option. For more information, see Change password fails.

For additional information on ports, see .

Minimum required permissions for Windows assets

The following minimum permissions are required for Windows assets to perform directory password management and sessions management tasks.

Asset password management

Using a Local account or Domain account:

• Test connection, Check connection, Password check, and Account discovery tasks require the following permissions:
  • Remote Enable permission on CIMV2 Namespace
  • Enable Account permission on CIMV2 Namespace

  • Remote Activation permission on computer

  NOTE: To set Remote Enable and Enable Account permissions Open wmimgmt. Right-click WMI Control (Local) and select Properties. Select the Security tab. Add user and select Remote Enable and Enable Account. Click OK. To set Remote Activation permissions Open dcomcnfg. Expand Component Services | Computers. Right-click My Computer and select Properties. Open the COM Security tab. Under Launch and Activation Permissions, select Edit Limits. Add user and select Allow for Remote Activation.

• Password change task requires the following permission:
  • Member of Local Administrators group

Domain password management

Using a Domain account:

• Test connection, Check connection, Password check, and Account discovery tasks require the following permissions:
  • Member of Domain Users
• Password change task requires that the Service account has the following delegated permissions:
  • Reset Password
  • Read All Properties
  • Write All Properties

Asset session access

Using a Local account:

• Member of Remote Desktop Users group
• Defined in the "Allow log on through Remote Desktop Services" policy (directly or via group membership)
• Not defined in the "Deny log on through Remote Desktop Services" policy (directly or via group membership)

Using a Domain account:

• Defined in the Remote Desktop Users group or be a member of a domain security group by a group policy update to the Remote Desktop Users group for that asset
• Defined in the "Allow log on through Remote Desktop Services" policy (directly or via group membership)
• Not defined in the "Deny log on through Remote Desktop Services" policy (directly or via group membership)

Troubleshooting

One Identity recommends the following resolutions to some of the common problems you might encounter as you deploy and use Safeguard for Privileged Passwords. For more information about how to troubleshoot Safeguard for Privileged Passwords, refer to the Appliance settings.