Supported platforms
Safeguard for Privileged Passwords supports a variety of platforms, including custom platforms.
Safeguard for Privileged Passwords tested platforms
The following table lists the platforms and versions that have been tested for Safeguard for Privileged Passwords (SPP). Additional assets may be added to Safeguard for Privileged Passwords. If you do not see a particular platform listed when adding an asset, use the Other, Other Managed, or Other Linux selection on the Management tab of the Asset dialog.
SPP joined to SPS: Sessions platforms
When Safeguard for Privileged Passwords (SPP) is joined with a Safeguard for Privileged Sessions (SPS) appliance, platforms are supported that use one of these protocols:
• SPP 2.8 or lower: RDP, SSH
• SPP 2.9 or higher: RDP, SSH, or Telnet
Some platforms may support more than one protocol. For example, a Linux (or Linux variation) platform supports both SSH and Telnet protocols.
Supported platform updates
For all supported platforms, it is assumed that the latest updates are applied.
Table 5: Supported platforms: Assets that can be managed
|
ACF2 - Mainframe |
r14, r15 |
zSeries |
True |
True |
|
ACF2 - Mainframe LDAP |
r14, r15 |
zSeries |
True |
False |
|
Active Directory |
|
|
True |
False |
|
AIX |
6.1, 7.1, 7.2 |
PPC |
True |
True |
|
Amazon Linux |
2 |
x86_64 |
True |
True |
|
Amazon Web Services (AWS) |
1 |
|
True |
False |
| CentOS Linux |
6
7 |
(ver 6) x86, x86_64
(ver 7) x86_64 |
True |
True |
|
Cisco ASA |
7.x, 8.x |
|
True |
True |
| Cisco IOS |
12.X, 15.X |
|
True |
True |
|
Debian GNU/Linux |
6, 7, 8, 9 |
x86, x86_64, MIPS, PPC, zSeries |
True |
True |
|
Dell iDRAC |
7, 8 |
|
True |
True |
|
ESXi (VSphere) |
5.5, 6.0, 6.5, 6.7 |
|
True |
False |
|
F5 Big-IP |
12.1.2, 13.0, 14.0 |
|
True |
True |
|
Fedora |
21, 22, 23, 24, 25, 26, 27, 28, 29, 30 |
x86, x86_64 |
True |
True |
|
Fortinet FortiOS |
5.2, 5.6 |
|
True |
True |
|
FreeBSD |
10.4, 11.1, 11.2 |
x86, x86_64 |
True |
True |
|
HP iLO |
2, 3, 4 |
x86 |
True |
True |
|
HP iLO MP |
2, 3 |
IA-64 |
True |
True |
|
HP-UX |
11iv2 (B.11.23),
11iv3 (B.11.31) |
PA-RISC, IA-64 |
True |
True |
|
IBM i |
7.1, 7.2, 7.3 |
PPC |
True |
True |
|
Junos - Juniper Networks |
12, 13, 14, 15 |
|
True |
True |
|
macOS |
10.9, 10.10, 10.11, 10.12, 10.13 |
x86_64 |
True |
True |
|
MongoDB |
3.4, 3.6, 4.0 |
|
True |
False |
|
MySQL |
5.6, 5.7 |
|
True |
False |
|
OpenLDAP |
2.4 |
|
True |
False |
|
Oracle |
11g Release 2,
12c Release 1 |
|
True |
False |
|
Oracle Linux (OEL) |
6
7 |
(ver 6) x86, x86_64
(ver 7) x86_64 |
True |
True |
|
Other |
|
|
False |
False |
|
Other Linux |
|
|
True |
True |
|
Other Managed |
|
|
True |
False |
|
PAN-OS |
6.0, 7.0, 8.0, 8.1 |
|
True |
True |
|
PostgreSQL |
9.6, 10.2, 10.3, 10.4, 10.5 |
|
True |
False |
|
RACF - Mainframe |
z/OS V2.1 Security Server,
z/OS V2.2 Security Server |
zSeries |
True |
True |
|
RACF - Mainframe LDAP |
z/OS V2.1 Security Server,
z/OS V2.2 Security Server |
zSeries |
True |
False |
|
Red Hat Enterprise Linux (RHEL) |
6, 7, 8 |
(ver 6) x86, x86_64, PPC, zSeries
(ver 7 and 8) x86, x86_64, PPC, zSeries |
True |
True |
|
SAP HANA |
2.0 |
Other |
True |
False |
|
SAP Netweaver Application Server |
7.3, 7.4, 7.5 |
|
True |
False |
|
Solaris |
10, 11 |
(ver 10) SPARC, x86, x86_64
(ver 11) SPARC, x86_64 |
True |
True |
|
SonicOS |
5.9, 6.2 |
|
True |
False |
|
SonicWALL SMA or CMS |
11.3.0 |
|
True |
False |
|
SQL Server |
2012, 2014, 2016 |
|
True |
False |
|
SUSE Linux Enterprise Server (SLES) |
11
12 |
(ver 11) x86, x86_64, PPC, zSeries, IA-64
(ver 12) x86_64, PPC, zSeries |
True |
True |
|
Sybase (Adaptive Server Enterprise) |
15.7, 16 |
|
True |
False |
|
Top Secret - Mainframe |
r14, r15 |
zSeries |
True |
True |
|
Top Secret - Mainframe LDAP |
r14, r15 |
zSeries |
True |
False |
|
Ubuntu |
14.04 LTS, 15.04, 15.10, 16.04 LTS, 16.10, 17.04, 17.10, 18.04 LTS, 18.10, 19.04 |
x86, x86_64 |
True |
True |
|
Windows |
Vista, 7, 8, 8.1, 10 Enterprise (including LTSC and loT). |
|
True |
True |
|
Windows Server |
2008, 2008 R2, 2012, 2012 R2, 2016, 2019 |
|
True |
True |
|
Windows SSH |
7, 8, 8.1, 10
Server 2008 R2, 2012, 2012 R2, 2016, 2019
Windows SSH Other |
|
True |
True |
Table 6: Supported platforms: Directories that can be searched
|
Microsoft Active Directory |
Windows 2008+ DFL/FFL |
|
OpenLDAP |
2.4 |
For all supported platforms, it is assume that you are applying the latest updates. For unpatched versions of supported platforms, Support will investigate and assist on a case by case basis but it may be necessary for you to upgrade the platform or use SPP's custom platform feature.
Custom platforms
The following example platform scripts are available:
- Custom HTTP
- Linux SSH
- Telnet
- TN3270 transports are available
For more information, see the Safeguard for Privileged Passwords Administration Guide, Custom Platforms and Creating a custom platform script.
|
|
CAUTION: Facebook and Twitter functionality has been deprecated. Refer to the custom platform open source script provided on GitHub. Facebook and Twitter platforms will be remove in a future release. |
Sample custom platform scripts and command details are available at the following links available from the Safeguard Custom Platform Home wiki on GitHub:
|
|
CAUTION: Example scripts are provided for information only. Updates, error checking, and testing are required before using them in production. Safeguard for Privileged Passwords checks to ensure the values match the type of the property that include a string, boolean, integer, or password (which is called secret in the API scripts). Safeguard for Privileged Passwords cannot check the validity or system impact of values entered for custom platforms. |
License: hardware, virtual, expiration
Safeguard for Privileged Passwords is made up of a core set of features, such as the UI and Web Services layers, and a number of modules.
Hardware appliance
The Safeguard for Privileged Passwords 3000 Appliance and 2000 Appliance ship with the following module which requires a valid license to enable functionality:
You must install a valid license for each Safeguard for Privileged Passwords module to operate. More specifically, if any module is installed, Safeguard for Privileged Passwords will show a license state of Licensed and is operational. However, depending on which models are licensed, you will see limited functionality. That is, even though you will be able to configure access requests:
- If a Privileged Passwords module license is not installed, you will not be able to request a password release.
Virtual appliance licensing
You must license the virtual appliance with a Microsoft Windows license. We recommend using either the MAK or KMS method. Specific questions about licensing should be directed to your Sales Representative.
Privileged sessions is available via a join to Safeguard for Privileged Sessions.
The virtual appliance will not function unless the operating system is properly licensed.
As a Safeguard for Privileged Passwords user, if you get an "appliance is unlicensed" notification, contact your Appliance Administrator.
Long Term Support (LTS) and Feature Releases
Releases use the following version designations:
- Long Term Support (LTS) Releases: The first digit identifies the release and the second is a zero (for example, 6.0 LTS).
- Maintenance LTS Releases: A third digit is added followed by LTS (for example, 6.0.6 LTS).
- Feature Releases: The Feature Releases are two digits (for example, 6.6).
Customers choose between two lanes for receiving releases: Long Term Support (LTS) Release or Feature Release. See the following table for details.
Table 7: Comparison of Long Term Support (LTS) Release and Feature Release
| |
Long Term Support (LTS) Release |
Feature Release |
| Release frequency |
Frequency: Typically, every 2 years
Scope: Includes new features, resolved issues and security updates
Versioning: The first digit identifies the LTS and the second digit is a 0 (for example, 6.0 LTS, 7.0 LTS, and so on). |
Frequency: Typically, every 3 months
Scope: Includes the latest features, resolved issues, and other updates, such as security patches for the OS
Versioning: The first digit identifies the LTS and the second digit is a number identifying the Feature Release (for example, 6.6, 6.7, and so on). |
| Maintenance Release |
Frequency:Typically, every 3 months during full support
Scope: Includes critical resolved issues
Versioning: A third digit designates the maintenance LTS Release (for example, 6.0.6 LTS). |
Frequency:Only for highly critical issues
Scope: Includes highly critical resolved issues
Versioning: A third digit designates the maintenance Feature Release (for example, 6.6.1). |
|
Support |
Typically 3 years after the original publication date or until the next LTS is published (whichever date is later) |
Typically 6 months after the original publication date or until the next feature or LTS Release is published (whichever date is later) |
Release details can be found at Product Life Cycle.
|
|
CAUTION: Downgrading from the latest Feature Release, even to an LTS release, voids support for SPP. |
One Identity strongly recommends always installing the latest revision of the release path you use (Long Term Support path or Feature Release path).
Moving between LTS and Feature Release versions
You can move from an LTS version (for example, 6.0.7 LTS) to the same feature version (6.7) and then patch to a later feature version. After that, you can patch from the minimum version for the patch, typically N-3. If you move from an LTS version to a feature version, you will receive a warning like the following which informs you that you will only be able to apply a Feature Release until the next LTS Release:
Warning: You are patching to a Feature Release from an LTS Release. If you apply this update, you will not be able to upgrade to a non-Feature Release until the next LTS major release version is available. See the Administration Guide for details.
You cannot move from a Feature Release to LTS Release. For example, you cannot move from 6.7 to 6.0.7 LTS. You have to keep upgrading with each new Feature Release until the next LTS Release version is published. For this example, you would wait until 7.0 LTS is available.
Patching
You can only patch from a major version. For example, if you have version 6.6 and want to patch to 7.7, you must patch to 7.0 LTS and then apply 7.7.
An LTS major version of Safeguard for Privileged Passwords (SPP) will work with the same LTS major version of Safeguard for Privileged Sessions (SPS). For the best experience, it is recommended you keep both their SPP and SPS in sync on the latest and supported version.
Appliance specifications
Appliance specifications
The Safeguard for Privileged Passwords Appliance is built specifically for use only with the Safeguard for Privileged Passwords privileged management software that is already installed and ready for immediate use. It comes hardened to ensure the system is secure at the hardware, operating system, and software levels.
The following two tables list the Safeguard for Privileged Passwords 3000 Appliance and 2000 Appliance specifications and power requirements.
Table 8: 3000 Appliance: Feature specifications
| Processor |
Intel Xeon E3-1275v6 3.8 GHz |
| # of Processors |
1 |
| # of Cores per Processor |
4 cores (8 threads) |
| L2/L3 Cache |
8MB L3 Cache |
| Chipset |
Intel C236 Chipset |
| DIMMs |
Unbuffered ECC UDIMM DDR4 2400MHz |
| RAM |
32 GB |
| Internal HD Controller |
LSI MegaRAID SAS 9361-4i Single |
| Disk Hard Drive |
4 x Seagate 7E2000 2TB SAS 512E |
| Availability |
TPM 2.0, EEC Memory, Redundant PSU |
| I/O Slots |
x16 PCIe 3.0, x8 PCIe 3.0 |
| RAID |
RAID10 |
| NIC/LOM |
4 port - dual GbE LAN with Intel i210-AT |
| Power Supplies |
Redundant, 700W, Auto Ranging (100v~240V), ACPI compatible |
| Fans |
1 Supermicro SNK-P0046P and 2 Micron 16GB 2666MHz 2R ECC Unb Z01B Dual Label |
| Chassis |
1U Rack |
|
Dimensions
(HxWxD) |
43 x 437.0 x 597.0 (mm)
1.7 x 17.2 x 23.5 (in) |
| Weight |
Max: 37 lbs (16.78 Kg) |
Table 9: 2000 Appliance: Feature specifications
| Processor |
Intel Xeon E3-1275v5 3.60 GHz |
| # of Processors |
1 |
| # of Cores per Processor |
4 |
| L2/L3 Cache |
4 x 256KB L2, 8MB L3 SmartCache |
| Chipset |
Intel C236 Chipset |
| DIMMs |
DDR4-2400 ECC Unbuffered DIMMs |
| RAM |
32GB |
| Internal HD Controller |
LSI MegaRAID SAS 9391-4i 12Gbps SAS3 |
| Disk |
4 x Seagate EC2.5 1TB SAS 512e |
| Availability |
TPM 2.0, EEC Memory, Redundant PSU |
| I/O Slots |
x16 PCIe 3.0, x8 PCIe 3.0 |
| RAID |
RAID10 |
| NIC/LOM |
3 x Intel i210-AT GbE |
| Power Supplies |
Redundant, 700W, Auto Ranging (100v~240V), ACPI compatible |
| Fans |
4 x 40mm Counter-rotating, Non-hot-swappable |
| Chassis |
1U Rack |
|
Dimensions
(HxWxD) |
43 x 437.0 x 597.0 (mm)
1.7 x 17.2 x 23.5 (in) |
| Weight |
Max: 46 lbs (20.9 Kg) |
| Miscellaneous |
FIPS Compliant Chassis |
Table 10: 3000 Appliance and 2000 Appliance: Power requirements
| Input Voltage |
100-240 Vac |
| Frequency |
50-60Hz |
| Power Consumption (Watts) |
170.9 |
| BTU |
583 |
Safeguard for Privileged Passwords is also available as a virtual appliance and from the cloud. For details see:
- Using the virtual appliance and web management console
- Using the cloud
