Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 8.0 LTS - Administration Guide

Introduction System requirements Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home page Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms Importing objects
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Vaults Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

Google Cloud Platform deployment

IMPORTANT: Before deploying, make sure you have read Cloud deployment considerations.

Safeguard for Privileged Passwords (SPP) can be run in the cloud using Google Cloud Platform (GCP).

Disk size considerations

CAUTION: Before making any changes to the disk size, shut down the VM (stopped and deallocated).

Safeguard for Privileged Passwords deploys with a minimal OS disk size. You should increase the size of the OS disk based on your estimated usage and budget. SPP on hardware comes with 1 TB of disk. You can use more or less than this depending on how many assets, accounts, and daily users you expect to have. 500 GB is a minimal production disk size and 2 TB is the maximum.

  1. Deploy SPP.

  2. Verify you can log in.

  3. Shut down the VM (stopped and deallocated).

  4. For more information on increasing the disk size, see Storage options in the Google Cloud documentation.

NOTE: When you start up the VM, Safeguard for Privileged Passwords automatically resizes the OS disk volume to use the available space.

Security considerations

Running Safeguard for Privileged Passwords in Google Cloud Platform comes with some security considerations that do not apply to the hardware appliance. One Identity recommends the following:

  • Do not give SPP a public IP address.

  • Limit access within Google Cloud Platform to the SPP virtual machine. SPP in Google Cloud Platform cannot protect against rogue Administrators in the same way the hardware appliance can.

Deployment steps

Safeguard for Privileged Passwords is shared privately via Google Cloud Platform.

Larger deployments warrant larger sizing choices. Safeguard for Privileged Passwords hardware appliances have 32 GB of RAM and 4 processors with at least 1 TB of disk space.

To deploy SPP

  1. Go to https://console.cloud.google.com/ and navigate to Storage > Images.

  2. Click on the SPP image, and click Create instance. For more information, see Create and start a Compute Engine instance in the Google Cloud documentation.

  3. Configure your SPP instance. One Identity recommends using the following settings:

    1. Under Machine Configuration, click General purpose and select series E2.

    2. Under Machine type, select the preset Shared-core > e2-medium.

    3. Under Identity & API Access, for the Service account, select no service account.

    4. Under Advanced Options > Networking > Network Interfaces, set your Network and Subnetwork.

  4. After the instance has finished launching, log into the SPP web client using your IP address. Use the default username (admin) and password (Admin123). Change the admin password immediately. For more information, see Setting a local user's password. For details, see the Safeguard for Privileged Passwords Administration Guide, Setting a local user's password.

View or change the cloud virtual appliance setup

You can view or change the virtual appliance setup.

You can use the Safeguard for Privileged Passwords web management kiosk on port 9337 for diagnostics and troubleshooting.

OCI deployment

IMPORTANT: Before deploying, make sure you have read Cloud deployment considerations.

Safeguard for Privileged Passwords (SPP) can be run in the cloud using Oracle Cloud Infrastructure (OCI).

Disk size considerations

CAUTION: Before making any changes to the disk size, shut down the VM (stopped and deallocated).

Safeguard for Privileged Passwords deploys with a minimal OS disk size. You should increase the size of the OS disk based on your estimated usage and budget. SPP on hardware comes with 1 TB of disk. You can use more or less than this depending on how many assets, accounts, and daily users you expect to have. 500 GB is a minimal production disk size and 2 TB is the maximum.

  1. Deploy SPP.

  2. Verify you can log in.

  3. Shut down the VM (stopped and deallocated).

  4. For more information on increasing the boot volume, see Resizing a Volume in the Oracle documentation.

NOTE: When you start up the VM, Safeguard for Privileged Passwords automatically resizes the OS disk volume to use the available space.

OCI security considerations

Running Safeguard for Privileged Passwords in OCI comes with some security considerations that do not apply to the hardware appliance. We recommend:

  • Do not give SPP a public IP address.

  • Use the OCI key vault to encrypt the disk.

  • Limit access within OCI to the SPP virtual machine. Safeguard for Privileged Passwords in OCI cannot protect against rogue Administrators in the same way the hardware appliance can.

Deployment steps

Safeguard for Privileged Passwords is deployed using a custom image which you can download from the One Identity Support Portal. OCI automatically licenses the operating system during the deployment with an OCI KMS.

Larger deployments warrant larger sizing choices. Safeguard for Privileged Passwords hardware appliances have 32 GB of RAM and 4 processors with at least 1 TB of disk space.

To deploy SPP

  1. Go to the One Identity Support Portal for Safeguard for Privileged Passwords.

  2. On the One Identity Safeguard for Privileged Passwords page, on the side panel, under Self Service Tools, click Software Downloads.

  3. To download the OCI image, click next to the image.

  4. After you have downloaded the image, import it.

    For instructions, see Importing Custom Windows Images.

  5. After the instance has finished launching, log into the web client using your static IP address. You will need to use the default username (admin) and password (<instance id>). You should change the admin password immediately. For more information, see Setting a local user's password.For details, see the Safeguard for Privileged Passwords Administration Guide, Setting a local user's password.

    NOTE: The password is unique for each deployment and the initial password will always be the instance ID of the deployed SPP server.

View or change the cloud virtual appliance setup

You can view or change the virtual appliance setup.

You can use the Safeguard for Privileged Passwords web management kiosk on port 9337 for diagnostics and troubleshooting. To access the kiosk on an OCI appliance, an administrator must create a policy to allow cloud shell access. You can the access the kiosk by connecting to the Cloud Shell. Once connected, to display the kiosk, press Ctrl+r. For more information on Cloud Shell, see Cloud Shell in the Oracle Cloud Infrastructure Documentation.

You can check the system logs on the Logging Audit page in OCI.

To patch to a new version, use the API.

Virtual appliance backup and recovery

Use the following information to back up and recover a Safeguard for Privileged Passwords virtual appliance. Factory reset is not an option for virtual appliances. To factory reset a virtual appliance, just redeploy the appliance.

Backing up the virtual appliance

To ensure security of the hardware appliance, backups taken from a virtual appliance cannot be restored on a hardware appliance.

For more information, see Backup and Retention.Backup and Retention settings in the Safeguard for Privileged Passwords Administration Guide.

Recovery of the virtual appliance

A Safeguard for Privileged Passwords virtual appliance is reset by using the following recovery steps.

On-prem virtual appliance (for example, Hyper-V or VMware)

  1. Redeploy the virtual appliance and run Initial Setup. For more information, see Setting up the virtual appliance.Setting up the virtual appliance in the Safeguard for Privileged Passwords Administration Guide.

  2. Restore the backup. For more information, see Backup and Retention.Backup and Retention settings in the Safeguard for Privileged Passwords Administration Guide.

Cloud virtual appliance (for example, AWS or Azure)

  1. Redeploy using the deployment steps:

Setting up Safeguard for Privileged Passwords for the first time

Before One Identity Safeguard for Privileged Passwords can manage your privileged account passwords and privileged sessions, you must first add all the objects you need to write access request policies, such as users, accounts, and assets. By following these procedures, you will set up a hierarchy of administrators that ensures your company follows role-based access control. For more information, see Administrator permissions..

The setup steps in this section assume you have completed the appliance initial installation and configuration steps in the One Identity Safeguard for Privileged Passwords Appliance Setup Guide.

Before Safeguard for Privileged Passwords can reset local account passwords on Windows systems, you must change the local security policy to disable User Account Control: Run all administrators in Admin Approval Mode. For more information, see Change password or SSH key fails..

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating