Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 6.7 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Getting started with the desktop client Using the desktop client Search box Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Discovery Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificates settings Cluster settings Enable or Disable Services settings External Integration settings Messaging settings (desktop client) Password Management settings Safeguard Access settings SSH Key Management settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 or later migration guidance Appendix C: SPP and SPS join guidance Appendix D: Regular Expressions SPP Glossary About us

Restarting the appliance

You can restart an appliance from the desktop client, web client, or directly from the appliance itself.

desktop client: To restart the appliance

  1. Navigate to Administrative Tools | Settings | Appliance | Appliance Information.

  2. On the General tab, under Power, type an explanation for restarting the appliance in the Reason box and click Restart.
  3. To confirm your action, enter the word Restart in the box and click OK.
  4. The One Identity Safeguard for Privileged Passwords Appliance LCD screens display the run level status of the appliance as it is starting up. For more information, see LCD status messages.

(web client): To restart an appliance

You can restart your appliance from the web client via  Settings| Appliance| Power. For more information, see Power.

Appliance: Restart from the appliance

After the appliance powers off, you will need physical access to start it. Press the Green check mark button on the front panel of the appliance for NO MORE than one second to power on the appliance.

Caution: Once the Safeguard appliance is booted, DO NOT press and hold the Green check mark button. Holding this button for four or more seconds will cold reset the power of the appliance and may result in damage.

Setting the appliance name

Safeguard for Privileged Passwords automatically assigns a name to the appliance; however, you can change the name from the desktop client, Appliance Information page.

To set the appliance name

  1. Go to the page:
    • web client: Navigate to  Settings | Appliance | Appliance Information.
    • desktop client: Navigate to Administrative Tools | Settings | Appliance | Appliance Information.
  2. Right of the Appliance Name, click Edit to enable the Appliance Name text box.
  3. Enter a new appliance name and click Save.

Debug

web client only

For each Safeguard for Privileged Passwords internal service, you can specify the level of logging and the external syslog server for storing debug logs. This allows for debugging in real time.

Debug logging is appliance specific. The data sent to the syslog server can include but is not limited to Support Bundle debug data. Cluster wide TLS audit event can be logged to a syslog server (see Syslog Events).

Debug logging is off by default but you can turn it on or off. Because debug logs can be sizable, you may want to turn it on for debugging a specific scenario or testing and turn it off for daily operations.

Using the API to control TLS log connection messages

Using the API, you can control if TLS log connection messages are generated to the debug logs when the TLS connection to an external server is closed. If the log level is set (see below), the event is also sent to the syslog server.

To log TLS connection information, set the NetworkDebugEnabled property from the https://<network address>/service/appliance/v3/Service/Debug endpoint to true. For more information, see Using the API.

To configure debug logs to send to a syslog server

  1. You will need a configured syslog server. If you have not configured a syslog server, you will see a message like this: To configure additional debut logging options, you need to configure a syslog server. Click Configure a syslog server. For more information, see Configuring and verifying a syslog server.
  2. If you have a syslog server configured, navigate to Settings | Appliance | Debug.
  3. Select a Syslog Server to which you want to send debug logs. The default is Do not log to syslog.
  4. In Facility, select which syslog facility to which you want to use: Kernel, User, Mail, Daemons, Authorization, or Syslog.
  5. Set the log level.

    • To set all log levels, click Set All then choose to Set All at one of the levels. This is useful to set the most common level of logging you want for most services.
    • To set an individual Service Name's log level, select next to the service to change the log level for that service.

    When you select from either the set all levels or the individual service name level, the log includes the log level selected as well as those listed below the level you selected. The information is immediately sent to the server. For example:

    • Debug (includes Debug, Information, Warning, and Error)
    • Information (includes Information, Warning, and Error)
    • Warning (includes Warning and Error)
    • Error (includes only Error)
    • None (Disabled): No logs are sent
  6. The grid displays each Service Name (enum name) that supports debug logging and the current Log Level.
    • Cick Refresh at any time to display the latest information.
    • Click Search to locate a specific service.

Enable or disable A2A and audit log stream

desktop client only. The web client includes the Audit Log Stream Service setting but not A2A; see Enable or Disable Services settings.

The Appliance Administrator can enable or disable Application to Application (A2) and Audit Log Stream services from the desktop client. The toggle appears blue with the switch to the right ( toggle on) when the service is enabled, and gray with the switch to the left when the service is disabled ( toggle off).

Navigate to Administrative Tools | Settings | Appliance | Enable or Disable Services.

  • Application to Application Enabled toggle:
    Use this toggle to enable or disable Application to Application service. It is the responsibility of the Appliance Administrator to manage the Application to Application service. The Application to Application service is disabled by default. For more information, see Application to Application .
  • Audit Log Stream Service toggle:

    Use this toggle to send Safeguard for Privileged Passwords data to Safeguard for Privileged Sessions (SPS) to audit the Safeguard privileged management software suite. The feature is disabled by default.

    To accept SPP data, the SPS Appliance Administrator must turn on audit log syncing. For information, see the Safeguard for Privileged Sessions Administration Guide.

    SPP and SPS must be joined to use this feature. For more information, see SPP and SPS sessions appliance join guidance.

    While the synchronization of SPP and SPS is ongoing, SPS is not guaranteed to have all of the audit data at any given point due to some latency.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating