One Identity Safeguard for Privileged Sessions 5.7.0 - Azure Reference Guide

Deploying One Identity Safeguard for Privileged Sessions from the Azure Marketplace

This guide provides detailed descriptions for deploying One Identity Safeguard for Privileged Sessions (Safeguard for Privileged Sessions) from the Microsoft Azure Marketplace.

Before you start:

Before you start evaluating Safeguard for Privileged Sessions, make sure you understand what Safeguard for Privileged Sessions is and how it works. This information can greatly help you get Safeguard for Privileged Sessions operational. Read the following:

• "Introduction" in the Administration Guide

• "The concepts of Safeguard for Privileged Sessions" in the Administration Guide

Prerequisites

The following prerequisites must be met to deploy Safeguard for Privileged Sessions in Microsoft Azure:

• You have a valid One Identity Safeguard for Privileged Sessions license. When deployed from the Microsoft Azure Marketplace, the One Identity Safeguard for Privileged Sessions uses the "Bring your own license" model. Note that to deploy two active Safeguard for Privileged Sessions nodes as an availability set, you must purchase two standalone Safeguard for Privileged Sessions licenses. To purchase a license, contact our Sales Team.

• Microsoft recommends to use the Azure Resource Manager (ARM) deployment model. When you install Safeguard for Privileged Sessions from the Azure Marketplace, Safeguard for Privileged Sessions supports only this deployment method. If you need to deploy Safeguard for Privileged Sessions into and infrastructure that uses the Classic deployment model, contact your One Identity sales representative.

• You have a Microsoft Azure account.

Limitations

The following limitations apply to Safeguard for Privileged Sessions when you deploy it from the Microsoft Azure Marketplace.

• Root login is not available on the console.

• SSH access is only available after you have completed the Welcome Wizard.

• Currently, the data that is entered during the provisioning phase (for example username, IP address) of creating the virtual machine in Azure is not transferred to Safeguard for Privileged Sessions. Therefore, only the data entered in the Welcome Wizard will be used.

• By default, you can only use Physical interface 1 (eth0) of Safeguard for Privileged Sessions, with a single IP address. Aside from changing the IP address of Safeguard for Privileged Sessions, do not modify other interface-related settings (additional logical interfaces, IP forwarding, and so on) on the Basic Settings > Network page of Safeguard for Privileged Sessions.

  The number of interfaces you can use depends on the size of your Azure VM. If your VM allows you to use multiple interfaces, you can configure multiple interfaces in Safeguard for Privileged Sessions. For details, see VM with multiple NICs.

• The Seal the box functionality is not available.

• The High Availability support of Safeguard for Privileged Sessions was designed to work between two physical Safeguard for Privileged Sessions appliances. This feature is not available in Azure environments. For further details, see the High Availability and redundancy in Microsoft Azure.

• Due to Azure requirements, an additional 5-minute delay has been added to the boot process. This ensures that the root device appears in the system.

• The size of the hard disk in Azure is 100 Gb. You cannot extend this virtual disk size later, nor can you write to Samba or other disks. In case you run out of disk space, either configure a Backup policy and an Archive policy if you have a server for this purpose, or configure a Cleanup policy that deletes the audit trails at certain time intervals. For details, see "Data and configuration backups" in the Administration Guide and "Archiving or cleaning up the collected data" in the Administration Guide.

• Safeguard for Privileged Sessions currently cannot receive its IP address using DHCP. Make sure that:

  • The IP address you have configured in Azure and the IP address that you configure for Safeguard for Privileged Sessions for the Physical interface 1 on the Networking settings part of the Welcome Wizard are the same. Otherwise, you will not be able to access Safeguard for Privileged Sessions.

  • You set the internal IP static on the Network Interfaces tab of the Virtual Machine.

  • Do not assign a public IP address to Safeguard for Privileged Sessions, use Safeguard for Privileged Sessions as a component of your internal infrastructure. If you absolutely must configure Welcome Wizard from a publicly accessible IP address, note that Safeguard for Privileged Sessions will be publicly accessible. If you assign a public IP to the web management interface, consider the following:

    • Select a complex passphrase.

    • Limit access to the management interface based on the source IP address, and make sure that brute-force protection for the administrator web login is enabled (they are enabled by default). For details, see "Configuring user and administrator login addresses" in the Administration Guide.

    • Configure an email alert or SNMP trap for administrator logon events. For details, see "Configuring e-mail alerts" in the Administration Guide and "Configuring SNMP alerts" in the Administration Guide.

    • Forward the logs of Safeguard for Privileged Sessions to a log server (for example, to a syslog-ng server, or an syslog-ng Store Box appliance) so that if the local logs are compromised, you still have an authentic copy of the original logs.

    • For security reasons, disable SSH access to Safeguard for Privileged Sessions when it is not needed. Accessing the Safeguard for Privileged Sessions host directly using SSH is not recommended or supported, except for troubleshooting purposes. If you enable SSH access, restrict the clients that can access Safeguard for Privileged Sessions based on their source IP address, and make sure that brute-force protection is enabled (they are enabled by default). For details, see "Enabling SSH access to the Safeguard for Privileged Sessions host" in the Administration Guide.

    • To prevent unauthorized access to the audit trail files recorded on Safeguard for Privileged Sessions, configure proper access control rules for the user groups and encrypt every audit trail. If you use encryption, store your keys in the personal or in the temporary key store. For details, see "Encrypting audit trails" in the Administration Guide,

• Upgrading Safeguard for Privileged Sessions in Azure is the same as upgrading a physical appliance: you have to upload the firmware on the Safeguard for Privileged Sessions web interface. For detailed instructions, see Upgrade Guide.

Deploy One Identity Safeguard for Privileged Sessions from the Microsoft Azure Marketplace

Purpose:

To have a One Identity Safeguard for Privileged Sessions running in Microsoft Azure, complete the following steps.

Steps:

1. Deploy One Identity Safeguard for Privileged Sessions from the Microsoft Azure Marketplace

   Create and configure a One Identity Safeguard for Privileged Sessions virtual machine (VM) in the Azure portal. For details, see the Microsoft Azure documentation, here we just describe the Safeguard for Privileged Sessions-specific settings.

   1. Login to the Azure portal, select One Identity Safeguard for Privileged Sessions from the Azure Marketplace, then click Create.

   2. Fill the required fields of the Basics blade. Note that you must fill the User name and Authentication Password/SSH public key fields, but Safeguard for Privileged Sessions will not actually use these settings (Safeguard for Privileged Sessions will use the parameters you configure in the Safeguard for Privileged Sessions Welcome Wizard).

   3. Choose a size for the VM. If you want to use this machine in production and need help about sizing or architecture design, contact your One Identity sales representative.

      The number of interfaces you can use depends on the size of your Azure VM. If your VM allows you to use multiple interfaces, you can configure multiple interfaces in Safeguard for Privileged Sessions. For details, see VM with multiple NICs.

   4. On the Settings blade, disable monitoring.

   5. When the deployment is finished, navigate to the network settings of the new VM in the Azure portal. Change the IP address of the Safeguard for Privileged Sessions network interface to Static, and note down the IP address and the hostname (you will need it in the Safeguard for Privileged Sessions Welcome Wizard).

   6. If you want to backup or archive data from Safeguard for Privileged Sessions into Azure, create an Azure File Share. Note down the following information of the file share, because you will need it to configure Safeguard for Privileged Sessions backups and archiving: URL, Username, Password.

      Caution: If you have multiple Safeguard for Privileged Sessions VMs, make sure to use a separate file share for each Safeguard for Privileged Sessions.

2. Complete the Safeguard for Privileged Sessions Welcome Wizard

   Complete the Safeguard for Privileged Sessions Welcome Wizard (for details, see "Configuring Safeguard for Privileged Sessions with the Welcome Wizard" in the Administration Guide). Note the following points specific for Azure deployments. When configuring the network settings of Safeguard for Privileged Sessions note the following points.

   Caution: Do not export or import configuration between a physical Safeguard for Privileged Sessions deployment and a virtual one. Because of the differences and limitations between physical and virtual appliances, configure the virtual appliance from scratch to ensure proper functionality. When you migrate a virtual Safeguard for Privileged Sessions to another one, you can export and import the configuration.

   1. Into the Physical interface EXT or 1 — IP address field, enter the static IP address of the Safeguard for Privileged Sessions VM that you set on the Azure portal.

   2. Default GW: The default gateway is usually the first address in a subnet (for example, if your subnet is 10.7.0.0/24, then the gateway will be 10.7.0.1).

   3. Hostname: Use the hostname you have configured for the Safeguard for Privileged Sessions VM on the Azure portal.

   4. DNS server: You can use any DNS server that the Safeguard for Privileged Sessions VM can access, even public ones.

3. Configure Safeguard for Privileged Sessions

   Login to Safeguard for Privileged Sessions and configure it.

   1. Configure backups for Safeguard for Privileged Sessions. For backup and archiving purposes One Identity recommends the built-in file shares of Azure. For details on configuring backups, see "Data and configuration backups" in the Administration Guide.

   2. Configure archiving for Safeguard for Privileged Sessions. For backup and archiving purposes One Identity recommends the built-in file shares of Azure. For details on configuring backups, see "Archiving or cleaning up the collected data" in the Administration Guide. Configuring Archiving policy is highly recommended: because if the disk of the VM fills up, Safeguard for Privileged Sessions stops working.

   3. Configure a server: set up a host that is on the same subnet as Safeguard for Privileged Sessions, and enable Remote Desktop (RDP) or Secure Shell (SSH) access to it.

   4. Configure a connection on Safeguard for Privileged Sessions to forward the incoming RDP or Secure Shell (SSH) connection to the host and establish a connection to the host. See "Logging in to Safeguard for Privileged Sessions and configuring the first connection" in the Administration Guide for details.

   5. Replay your session in the browser. See "Replaying audit trails in your browser in Search (classic)" in the Administration Guide for details.

      In case you have questions about Safeguard for Privileged Sessions, or need assistance, contact your One Identity representative.