Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 7.4 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home page Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms Importing objects
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

Preparing Top Secret mainframe systems

SPP can manage authorized Top Secret users who have a valid accessor ID (ACID) with the facility TSO who can log on to the TSO interface.

This applies to both Top Secret mainframe and Top Secret mainframe LDAP platforms.

To prepare CA Top Secret mainframe systems for SPP

  1. Create a service account on the asset, assign it a password, and grant it the ‘TSO’ facility.
  2. Grant the service account the following authority for ACIDs within its scope:
    1. Permission to list security record information for an ACID.
    2. MISC1(SUSPEND) authority, to remove the PSUSPEND attribute from ACIDs.
    3. Either ACID(MAINTAIN) or MISC8(PWMAINT) authority, to update the password of another ACID.

  3. If not already installed, install a telnet server on the z/OS system. If required, secure telnet with SSL.

    NOTE: Please refer to your IBM z/OS system documentation for details on installing and configuring the telnet server (and SSL).

  4. Test the telnet server using a Windows-based 3270 emulator or on Linux, use the telnet-ssl or x3270 programs to test SSL and non-SSL connections to an z/OS system.
  5. In SPP, create the asset and accounts for the z/OS system using password authentication.
About certificate support for the telnet protocol

SPP automatically accepts any server certificate that the connection offers and does not verify the trust chain on the telnet certificate. In addition, SPP does not support client certificate selection, so if telnet requires that the client present a certificate that is signed by a recognized authority, SPP cannot support that configuration.

Preparing Unix-based systems

SPP uses the SSH protocol to connect to Unix-based systems.

To prepare Unix-based systems (AIX, HP-UX, Linux, Macintosh OS X, Solaris, and FreeBSD platforms)

  1. Create a service account on the asset with sufficient permissions.

    You need to at least configure a password or SSH key for the service account. If you want to use an SSH key generated and configured by SPP, then you also need to make sure the service account’s home directory exists.

  2. Ensure that the service account can run the following list of commands with root privileges non-interactively; that is, without prompting for a password.

    For example, on a Linux system add the following line in the sudoers file:

    <SerAcctName> ALL=(root) NOPASSWD: /usr/bin/passwd

    The commands a service account must run with root privileges non-interactively are:

    Linux and most Unix-based systems:

    • egrep
    • grep
    • modprpw (hpux only)

    • passwd

      NOTE: Additional sudo commands may be required for Unix-based systems. For example, see SSH Key for a list of commands required for configuring SSH authentication keys on a managed system.

    AIX:

    • chuser
    • sed
    • grep
    • passwd
    • pwdadm

    Mac OS X

    • dscacheutil
    • dscl
    • passwd

  3. Enable and configure the SSH server to allow the service account to log in remotely. For example, on a Mac, enable Remote Login for the service account.

    NOTE: Different versions of Linux and Unix may require slightly different parameters for SSH configuration. Consult a Linux/Unix system administrator or the system documentation for assistance.

Preparing Windows systems

SPP supports Windows systems. For more information, see How to: Configure Windows Assets in Safeguard.

NOTE: Microsoft has started hardening DCOM servers which may change your configuration decisions. For more information, see https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26414 and https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c.

To prepare Windows systems for SPP

  1. Create a service account on the asset and assign it a password:

    • Directory Configuration

      If the Windows system is joined to a domain that will be managed in SPP, you can use a directory account, such as a Microsoft Active Directory account to manage the asset. Enable the Password Never Expires option; once you add the asset to SPP, you can have the service account password auto-managed to keep it secure.

      -OR-

    • Local Configuration

      If the Windows system is not joined to a domain, then use a local service account that has been granted sufficient permissions.

  2. Grant the service account sufficient permissions to change account permissions to allow changing account passwords. For more information, see Minimum required permissions for Windows assets.

  3. Configure the system's firewall to allow the following predefined incoming rules:

    • Windows Management Instrumentation (DCOM-In)

    • Windows Management Instrumentation (WMI-In)

    • NetLogon Service (NP-In)

    These rules allow incoming traffic on TCP port 135 and TCP SMB 445, respectively.

  4. Ensure the following ports are accessible:

    • Port 389 is LDAP for connections. LDAP port 389 connections are used for Active Directory Asset Discovery and Directory Account Discovery.

    • Port 445 SMB is used to perform password check and changes.
    • In some cases, RPC ephemeral ports are required to be accessible for SPP to perform Service Discovery on the Windows platform (for example, Windows Server 2019 requires the ports, however Windows Server 2012 does not). For more information, see Service overview and network port requirements for Windows.

  5. Change the local security policy:

    Before SPP can reset local account passwords on Windows systems, using a service account that is a non-built-in administrator, you must change the local security policy to disable the User Account Control (UAC) Admin Approval Mode (Run all administrators in Admin Approval Mode) option. For more information, see Change password or SSH key fails.

For additional information on ports, see Safeguard ports.

Preparing WinRM systems

Safeguard for Privileged Passwords supports Windows Remote Management (WinRM) systems.

To prepare Windows Remote Management (WinRM) systems for SPP

  1. The initial configuration requirements for WinRM depend on whether or not you are using SSL.

    • For SSL (this is when USE SSL Encryption and Verify SSL Certificate are enabled for the asset):

      1. You need to manually add a CA signed certificate to the asset:

        IMPORTANT: You will need to upload the CA certificate to Safeguard.

        On the asset, the certificate should be installed in the LocalMachine\My store and the CA should be in the LocalMachine\TrustedRoots store. If you use an intermediate that should be in the LocalMachine\Intermediate store.

        Ensure the following requirements are met for the certificate:

        • CN must match the hostname of the asset.

        • CRL must be present and resolvable.

        • Server Authentication enhanced key usage is required.

        1. The HTTPS listener needs to be registered in WinRM using the following command: winrm create winrm/config/Listener?Address=*+transport=HTTPS '@{Hostname="<hostname>";CertificateThumbprint="<thumbprint>"}'

        2. Use the following command to set the certificate: winrm set winrm/config/service '@{CertificateThumbprint="<TUMBPRINT"}'

        3. Open port 5986 in the firewall.

        4. Restart the Windows Remoting service.

    • For non-SSL:

      1. On the asset, run the following command: Enable-PSRemoting -Force.

  2. Create a service account on the asset and assign it a password:

    • Directory Configuration

      If the Windows system is joined to a domain that will be managed in SPP, you can use a directory account, such as a Microsoft Active Directory account to manage the asset. Enable the Password Never Expires option; once you add the asset to SPP, you can have the service account password auto-managed to keep it secure.

      -OR-

    • Local Configuration

      If the Windows system is not joined to a domain, then use a local service account that has been granted sufficient permissions.

  3. Grant the service account sufficient permissions to change account permissions to allow changing account passwords. For more information, see Minimum required permissions for Windows assets.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating