Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 7.5 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home page Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms Importing objects
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

Preparing Amazon Web Services platforms

SPP supports Amazon Web Services (AWS), a secure cloud services platform.

When adding an Amazon Web Services asset, the Network Address must contain the AWS Account ID or Alias.

To prepare Amazon Web Services platforms for SPP

  1. In SPP: 

    1. Ensure the latest Amazon's certificate and AWS certificate's root certificate authority (CA) are in the Trusted Certificates store in SPP.

    2. Configure an Identity and Access Management (IAM) user to use as a service account.

    3. Assign the IAM service account to the AdministratorAccess security policy.

  2. In Amazon:

    1. Create an access key for the IAM service account. Amazon creates a pair of data items called a Secret Key and a public Access Key ID. Take a note of both the Access Key ID and Secret Key. You will need them when you add the Amazon Web Services asset to SPP.

Preparing Cisco devices

There are 4 Cisco platforms supported in SPP:

  • Cisco ISE CLI platform: SPP uses a local service account to manage accounts on the ISE CLI platform using SSH.

  • Cisco IOS/ASA platform: Cisco IOS/ASA platforms can be configured in the following ways to manage local accounts using SSH:

    • SPP uses a local service account to manage accounts on the Cisco device.

    • If the Cisco device is configured (using AAA) to authenticate and authorize login requests to a Cisco ISE server that will be managed by SPP, then you can use a directory account in the Cisco ISE directory asset to manage the Cisco device.

    • If the Cisco device is configured (using AAA) to authenticate and authorize login requests to a Cisco ISE server that is integrated with an Active Directory domain that will be managed by SPP, then you can use a directory account in the Active Directory asset to manage accounts on the Cisco device.

    • If the service account is not configured with privilege level 15, then the enable password for privilege level 15 will be required when creating the asset.

  • Cisco ISE platform: Cisco ISE is managed as a directory asset in SPP. It uses REST and TACACS+ to manage local accounts. It supports account discovery and password management. It does not support directory synchronization, asset discovery, or service discovery.

  • Cisco NX-OS platform: In order to perform all required operations on users, the service account used requires at least network-admin privileges.

ClosedCisco ISE CLI platform
ClosedCisco IOS/ASA platform
ClosedCisco ISE platform
ClosedCisco NX-OS platform

Preparing Dell iDRAC devices

SPPsupports the Dell Remote Access Controller that is integrated with Dell PowerEdge servers. SPP uses the SSH protocol to connect to iDRAC devices.

To prepare an iDRAC device for SPP

  1. Use iDRAC to create a service account with administrator privileges and assign it a password.

    The service account must have login privileges and must be able to configure users.

  2. Verify that SSH is enabled in the iDRAC Network settings.
  3. In SPP, create the asset and accounts for the iDRAC device using password authentication. Accounts can also be discovered.

Preparing VMware ESXi hosts

SPP supports VMware ESXi hosts.

IMPORTANT: SPP can only manage local users on a VMware host.

To prepare a VMware ESXi host for SPP

  1. Use an existing account or create a new account as the service account on the asset and assign it a password.

    The default administrator account is suitable.

  2. Grant the service account the privileges required to set user passwords using the web management API.
  3. When adding a VMware ESXi host to SPP:
    1. Specify the network address.
    2. Specify port 443 as the HTTPS port.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating