The following checklist is a set of recommendations and configuration best practices to ensure that your SPS is configured securely.
One Identity recommends using 2048-bit RSA keys (or stronger).
Use strong passwords: at least 8 characters that include numbers, letters, special characters, and capital letters. For local SPS users, require the use of strong passwords (set AAA > Settings > Minimal password strength to strong). For details, see "Setting password policies for local users" in the Administration Guide.
When exporting the configuration of SPS, or creating configuration backups, always use encryption. Handle the exported data with care, as it contains sensitive information, including credentials. For details on encrypting the configuration, see "Encrypting configuration backups with GPG" in the Administration Guide.
Use every keypair or certificate only for one purpose. Do not reuse cryptographic keys or certificates, for example, do not use the certificate of the SPS webserver to encrypt audit trails, or do not use the same keypair for signing and encrypting data.
Do not use the CBC block cipher mode, or the diffie-hellman-group1-sha1 key exchange algorithm.
Always encrypt your audit trails to protect sensitive data. For details, see "Encrypting audit trails" in the Administration Guide.
When configuring connection policies, always limit the source of the connection to the client network that requires access to the connection.
Always use gateway authentication to authenticate clients. Do not trust the source IP address of a connection, or the result of server authentication.
To prevent Denial of Service (DoS) attacks against SPS, set the Connection rate limit option of your connection policies. For details, see "Configuring connections" in the Administration Guide.
Configure your RDP connection policies to use strong encryption. To enable SSL-encryption for the RDP protocol, see "Enabling TLS-encryption for RDP connections" in the Administration Guide.
In RDP connections, if the client uses the Windows login screen to authenticate on the server, the password of the client is visible in the audit trail. To avoid displaying the password when replaying the audit trail, you are recommended to encrypt the upstream traffic in the audit trail using a separate certificate from the downstream traffic. For details, see "Encrypting audit trails" in the Administration Guide.
Ensure that host key verification is enabled in SSH connection policies. That is, the Server side hostkey settings > Allow plain host keys and Server side hostkey settings > Allow X.509 host certificates options do not have the No check required option selected. For details, see "Setting the SSH host keys and certificates of the connection" in the Administration Guide.
Accessing the SPS host directly using SSH is not recommended or supported, except for troubleshooting purposes. In such case, the One Identity Support Team will give you exact instructions on what to do to solve the problem.
For security reasons, disable SSH access to SPS when it is not needed. For details, see "Enabling SSH access to the SPS host" in the Administration Guide.
Permit administrative access to SPS only from trusted networks. If possible, monitored connections and administrative access to the SPS web interface should originate from separate networks.
Configure SPS to send an alert if a user fails to login to SPS. For details, see the Login failed alert in "System related traps" in the Administration Guide.
Configure Disk space fill-up prevention, and configure SPS to send an alert if the free space on the disks of SPS is low. For details, see "Preventing disk space fill-up" in the Administration Guide.
SPS stores sensitive data. Use a firewall and other appropriate controls to ensure that unauthorized connections cannot access it.
If possible, enable management access to SPS only from trusted networks.
Make sure that the HA interface of SPS is connected to a trusted network.
To find the documentation for a specific UI element, browse the following sections.
Basic Settings > Management > Syslog: For details, see Configuring system logging.
Basic Settings > Management > SNMP trap settings: For details, see Configuring SNMP alerts.
Basic Settings > Management > Mail settings: For details, see Configuring e-mail alerts.
Basic Settings > Management > Web interface timeout: For details, see Web interface timeout.
Basic Settings > Management > RPC API settings: For details, see Enabling RPC API access to SPS.
Basic Settings > Management > Change root password: For details, see Changing the root password of SPS.
Basic Settings > Management > System backup: For details, see:
Basic Settings > Management > Verbose system logs: For details, see Changing log verbosity level of SPS.
Basic Settings > Management > SSL certificates: For details, see Managing the certificates used on SPS.
Basic Settings > Management > Core files: For details, see Gathering data about system problems.
Basic Settings > Management > Disk space fill-up prevention: For details, see Preventing disk space fill-up.
Basic Settings > Management > Web gateway authentication: For details, see Configuring out-of-band gateway authentication.
Basic Settings > Management > Splunk forwarder: For details, see Using the Splunk forwarder.
Basic Settings > Local Services > SSH server: For details, see Enabling SSH access to the SPS host.
Basic Settings > Local Services > Web login (admin and user): For details, see Configuring user and administrator login addresses.
Basic Settings > Local Services > Web login (user only): For details, see Configuring user and administrator login addresses.
Basic Settings > Local Services > SNMP server settings: For details, see Querying SPS status information using agents.
Basic Settings > Local Services > Indexer service: For details, see Configuring the internal indexer.
Basic Settings > Local Services > Privileged Account Analytics: Select this option only if you are also using One Identity Safeguard for Privileged Analytics.
To enable One Identity Safeguard for Privileged Analytics and analyze the behavior of your users, SPS requires a special license. Also, depending on the number of your users and sessions, the performance and sizing of SPS must be considered. If you are interested in One Identity Safeguard for Privileged Analytics, contact our Sales Team, or your One Identity representative. For details on One Identity Safeguard for Privileged Analytics, see the One Identity One Identity Safeguard for Privileged Analytics website. For details on enabling One Identity Safeguard for Privileged Analytics, see Safeguard for Privileged Analytics Configuration Guide.
Basic Settings > Local Services > Cluster Interface: This option is related to an experimental feature that will allow you to manage and synchronize the configuration of multiple SPS appliances from a central server. If you are interested in this feature, contact our Support Team.
© 2020 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy
