Chat now with support
Chat with Support

The Quest and One Identity Support Portals will be unavailable on Friday July 10, 2020 from 5:30 PM to 6:30 PM for website maintenance.

One Identity Safeguard for Privileged Passwords 2.5 - Administration Guide

Introduction System requirements Installing the One Identity Safeguard for Privileged Passwords desktop client Setting up Safeguard for Privileged Passwords for the first time Getting acquainted with the console Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Directories Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificate settings Cluster settings External Integration settings Messaging settings Profile settings Access settings Sessions settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions
How do I access the API How do I audit transaction activity How do I configure external federation authentication How do I manage accounts on unsupported platforms How do I modify the appliance configuration settings How do I prevent Safeguard for Privileged Passwords messages when making RDP connections How do I see which assets and/or accounts are governed by a profile How do I set the appliance system time How do I setup discovery jobs How do Safeguard for Privileged Passwords database servers use SSL What are the access request states What do I do when an appliance goes into quarantine What is required for One Identity Safeguard for Privileged Passwords, embedded sessions module What is required to integrate with Starling Identity Analytics & Risk Intelligence What needs to be set up to use Application to Application What role-based email notifications are generated by default When does the rules engine run for dynamic grouping and tagging Why did the password change during an open request Why join Safeguard for Privileged Passwords to One Identity Starling
Safeguard Desktop Player Appendix: Safeguard ports

Archive backup

Safeguard for Privileged Passwords allows you to store backup files on an external archive server.

To archive a backup file

  1. Navigate to Administrative Tools | Settings | Backup and Retention | Safeguard Backup and Restore.
  2. Select the backup to be archived.
  3. Click  Archive and select Archive Backup.

  4. In the Archive Servers selection dialog, choose an archive server.

    NOTE: You can add an archive server from the Archive Servers selection dialog by clicking the Add Archive Server toolbar button.

Safeguard for Privileged Passwords copies the backup file to the archive server.

Backup retention

It is the responsibility of the Appliance Administrator to configure the maximum number of backup files you want Safeguard for Privileged Passwords to store on the appliance.

To configure the appliance backup retention settings

  1. Navigate to Administrative Tools | Settings | Backup and Retention | Safeguard for Privileged Passwords Backup Retention.
  2. Select the Enable Backup Retention check box.
  3. Enter the maximum number of backup files you want to store on the appliance.
  4. Click OK.

Once Safeguard for Privileged Passwords saves the maximum number of backup files, next time it performs a backup, it deletes the backup file with the oldest date.

Certificate settings

Use the Certificate settings to manage the certificates used to secure One Identity Safeguard for Privileged Passwords. The panes on this page display default certificates that can be replaced or user-supplied certificates that have been added to Safeguard for Privileged Passwords.

It is the responsibility of the Appliance Administrator to manage the certificates used by Safeguard for Privileged Passwords.

Navigate to Administrative Tools | Settings | Certificates.

Table 169: Certificates settings
Setting Description

Audit Log Signing Certificate

Where you manage the audit log signing certificate used to validate audit logs stored on an archive server.

Certificate Signing Request Where you can view and manage certificate signing requests (CSRs)
Sessions Certificates Where you manage session certificates, including installing session certificates or creating CSRs to enroll a sessions certificate. If a Safeguard Sessions Appliance is joined to Safeguard for Privileged Passwords, assigning the certificate is handled via Safeguard for Privileged Sessions.
SSL Certificates Where you manage SSL certificates, including installing SSL certificates or creating CSRs to enroll a public SSL certificate.
Trusted Certificates Where you add and manage certificates trusted by Safeguard for Privileged Passwords, for example your company's root Certificate Authority (CA) certificate.

About certificates

The certificate infrastructure in One Identity Safeguard for Privileged Passwords consists of the following:

Replaceable certificates

One Identity Safeguard for Privileged Passwords ships with the following default certificates which are meant to be replaced:

  • A self-signed SSL certificate for HTTPS.

    The name of the SSL certificate matches the hostname of the Safeguard for Privileged Passwords Appliance and uses the appliance's default IP addresses as the Subject Alternative Name (SAN).

  • A self-signed Certificate Authority (CA) certificate used by the Privileged Sessions module that generates server SSL certificates on-the-fly to secure RDP connections when an RDP session is initiated using Safeguard for Privileged Passwords. The "requester" must accept the certificate in order to launch a remote desktop session.

  • A signing certificate used to validate that archived audit logs were created by and came from Safeguard for Privileged Passwords.
User-supplied certificates

Safeguard for Privileged Passwords allows you to specify the security certificates to be used. When replacing or adding certificates, keep the following considerations in mind:

  • Safeguard for Privileged Passwords supports Certificate Signing Requests (CSRs) to enroll any type of certificate. CSRs use the Public-Key Cryptography Standard (PKCS) #10 format.
  • For uploading certificates with private keys, Safeguard for Privileged Passwords supports .pfx ( or .p12) files which follow the PKCS #12 standard.
  • For SSL certificates, Safeguard for Privileged Passwords allows you to upload or use a CSR to enroll multiple certificates that can then be applied to different appliances.
  • Safeguard for Privileged Passwords provides an SSL certificate store that allows you to assign any uploaded or enrolled SSL certificate to any appliance.
  • Prior to adding an asset that uses SSL server certificate validation, you must add the server's signing authority certificate to the Trusted Certificates store in Safeguard for Privileged Passwords
  • For sessions certificates, uploading a new certificate or using a CSR to enroll a new certificate will replace the default certificate supplied with Safeguard for Privileged Passwords.
Related Documents