Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 5.9.0 - Administration Guide

Preface Introduction The concepts of SPS The Welcome Wizard and the first login Basic settings User management and access control Managing SPS
Controlling SPS: reboot, shutdown Managing Safeguard for Privileged Sessions clusters Managing a high availability SPS cluster Upgrading SPS Managing the SPS license Accessing the SPS console Sealed mode Out-of-band management of SPS Managing the certificates used on SPS
General connection settings HTTP-specific settings ICA-specific settings RDP-specific settings SSH-specific settings Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search (classic) interface Using the Search interface Searching session data on a central node in a cluster Advanced authentication and authorization techniques Reports The SPS RPC API The SPS REST API SPS scenarios Troubleshooting SPS Configuring external devices Using SCP with agent-forwarding Security checklist for configuring SPS Jumplists for in-product help Third-party contributions About us

Configuring SPS with the Welcome Wizard

Purpose:

The Welcome Wizard guides you through the basic configuration steps of SPS. All parameters can be modified before the last step by using the Back button of the wizard, or later via the web interface of SPS.

Steps:
  1. Open the https://<IP-address-of-SPS-interface> page in your browser and accept the displayed certificate. The Welcome Wizard of SPS appears.

    TIP:

    The SPS console displays the IP address the interface is listening on. SPS either receives an IP address automatically via DHCP, or if a DHCP server is not available, listens on the 192.168.1.1 IP address.

  2. When configuring SPS for the first time, click Next.

    Figure 18: The Welcome Wizard

    You can import an existing configuration from a backup file. Use this feature to restore a backup configuration after a recovery, or to migrate an existing SPS configuration to a new device.

    Caution:

    Do not export or import configuration between a physical SPS deployment and a virtual one. Because of the differences and limitations between physical and virtual appliances, configure the virtual appliance from scratch to ensure proper functionality. When you migrate a virtual SPS to another one, you can export and import the configuration.

    1. Click Browse and select the configuration file to import.

      NOTE:

      It is not possible to directly import a GPG-encrypted configuration into SPS, it has to be decrypted locally first.

    2. Enter the passphrase used when the configuration was exported into the Encryption passphrase field.

      For details on restoring configuration from a configuration backup, see Restoring SPS configuration and data

    3. Click Import.

      Caution:

      If you use the Import function to copy a configuration from one SPS to another, do not forget to configure the IP addresses of the second SPS. Having two devices with identical IP addresses on the same network leads to errors.

  3. Accept the End User License Agreement and install the SPS license.

    Figure 19: The EULA and the license key

    1. Read the End User License Agreement and select I have read and agree with the terms and conditions. The License Agreement covers both the traditional license, and subscription-based licensing as well. Clicking I have read and agree with the terms and conditions means that you accept the agreement that corresponds to the license you purchased. After the installation is complete, you can read the End User License Agreement at Basic Settings > System > License.

    2. Click Browse, select the SPS license file received with SPS, then click Upload.

      NOTE:

      It is not required to manually decompress the license file. Compressed licenses (for example .zip archives) can also be uploaded.

    3. Click Next.

  4. Configure networking. All settings can be modified later using the web interface of SPS.

    Figure 20: Initial networking configuration

    1. Physical interface EXT or 1 \xe2\x80\x94 IP address: The IP address of interface 1 (or EXT, for older hardware) of SPS (for example, 192.168.1.1). The IP address can be chosen from the range of the corresponding physical subnet. Clients will connect to this interface, therefore it must be accessible to them.

      Use an IPv4 address.

      NOTE:

      Do not use IP addresses that fall into the following ranges:

      • 1.2.0.0/16 (reserved for communication between SPS cluster nodes)

      • 127.0.0.0/8 (localhost IP addresses)

    2. Physical interface EXT or 1 — Prefix: The IP prefix of the given range. For example, general class C networks have the /24 prefix.

    3. Physical interface EXT or 1 — VLAN ID: The VLAN ID of interface 1 (or EXT). Optional.

      Caution:

      Do not set the VLAN ID unless your network environment is already configured to use this VLAN. Otherwise, your SPS appliance will be unavailable using this interface.

    4. Default GW: IP address of the default gateway.

      Use an IPv4 address.

    5. Hostname: Name of the machine running SPS (for example, SPS).

    6. Domainname: Name of the domain used on the network.

    7. DNS server: The IP address of the name server used for domain name resolution.

      Use an IPv4 address.

    8. NTP server: The IP address or the hostname of the NTP server.

      Use an IPv4 address.

    9. Syslog server: The IP address or the hostname of the syslog server.

      Use an IPv4 address.

    10. SMTP server: The IP address or the hostname of the SMTP server used to deliver e-mails.

      Use an IPv4 address.

    11. Administrator's email: E-mail address of the SPS administrator.

    12. Timezone: The timezone where the SPS is located.

    13. HA address: The IP address of the high availability (HA) interface. Leave this field on auto unless specifically requested by the support team.

    14. Click Next.

  5. Enter the passwords used to access SPS.

    Figure 21: Passwords

    NOTE:

    SPS accepts passwords that are not longer than 150 characters. The following special characters can be used: !"#$%&'()*+,-./:;<=>?@[\]^-`{|}

    1. Admin password: The password of the admin user who can access the web interface of SPS.

    2. Root password: The password of the root user, required to access SPS via SSH or from the local console.

      NOTE:

      Accessing SPS using SSH is rarely needed, and recommended only for advanced users for troubleshooting situations.

    3. If you want to prevent users from accessing SPS remotely via SSH or changing the root password of SPS, select the Seal the box checkbox. Sealed mode can be activated later from the web interface as well. For details, see "Sealed mode" in the Administration Guide.

    4. Click Next.

  6. Upload or create a certificate for the SPS web interface. This SSL certificate will be displayed by SPS to authenticate HTTPS connections to the web and the REST interface.

    Figure 22: Creating a certificate for SPS

    To create a self-signed certificate, fill the fields of the Generate new self-signed certificate section and click Generate certificate. The certificate will be self-signed by the SPS appliance. The hostname of SPS will be used as the issuer and common name.

    1. Country: Select the country where SPS is located (for example, HU-Hungary).

    2. Locality name: The city where SPS is located (for example, Budapest).

    3. Organization name: The company who owns SPS (for example, Example Inc.).

    4. Organizational unit name: The division of the company who owns SPS (for example, IT Security Department).

    5. State or Province name: The state or province where SPS is located.

    6. Click Generate certificate.

    If you want to use a certificate that is signed by an external Certificate Authority, in the Server X.509 certificate field, click to upload the certificate.

    Figure 23: Uploading a certificate for SPS

    Then in the Server private key field click , upload the private key, and enter the password protecting the private key.

    Figure 24: Uploading a private key

    NOTE:

    SPS accepts private keys in PEM (RSA and DSA), and PUTTY format. Password-protected private keys are also supported.

    One Identity recommends using 2048-bit RSA keys (or stronger).

    NOTE:

    SPS accepts passwords that are not longer than 150 characters. The following special characters can be used: !"#$%&'()*+,-./:;<=>?@[\]^-`{|}

  7. Review the data entered in the previous steps. This page also displays the certificate generated in the last step, the SSH RSA key of SPS, and information about the license file.

    Figure 25: Review configuration data

    If all information is correct, click Finish.

    Caution:

    The configuration takes effect immediately after clicking Finish. Incorrect network configuration data can render SPS unaccessible.

    SPS is now accessible from the regular web interface via the IP address of interface 1 (or EXT).

  8. Your browser is automatically redirected to the IP address set for interface 1 (or EXT) of SPS, where you can login to the web interface of SPS using the admin username and the password you set for this user in the Welcome Wizard.

Logging in to SPS and configuring the first connection

Purpose:

After finishing the initial configuration of SPS using the Welcome Wizard, connections must be configured between the clients and the servers. SPS inspects only the connections that are configured from the web interface, all other connections are forwarded without any inspection. The procedure below describes how to enable a simple SSH terminal or a Remote Desktop session over a transparent and a non-transparent connection.

Steps:
  1. Login to SPS's web interface.

    Figure 26: The first login

    1. Open the https://IP-address-of-interface-1/ page from your browser to access the web interface of SPS. Replace the IP-address-of-the-interface-1 string with the IP set for interface 1 in the Networking settings section of the Welcome Wizard (see Configuring interface 1) (for example, 192.168.1.1).

    2. The certificate created in the Certificate section of the Welcome Wizard (see Creating the web interface certificate) is displayed. Accept it.

    3. Log in to the SPS web interface using the displayed login screen.

      • Enter admin into the Login field.

      • Enter the password set in the Users section of the Welcome Wizard (see Setting the administrator password) for the admin user into the Password field.

      • Click Login. The main page of the SPS administration interface is displayed.

  2. Configure a new transparent connection.

      • To configure an SSH connection, select SSH Control > Connections from the Main Menu. Only terminal sessions will be permitted.

      • To configure an RDP connection, click on the RDP Control > Connections from the Main Menu. Only basic Remote Desktop sessions will be permitted (no file-sharing).

    1. Click the icon on the right to create a new connection.

    2. Enter a name into the Name field that will identify the connection (for example, admin-server-transparent).

      TIP:

      It is recommended to use descriptive names that give information about the connection: refer to the name of the accessible server, the allowed users, and so on.

    3. Enter the IP addresses defining the connection:

      Figure 27: <Protocol name> Control > Connections — Configuring an SSH connection in transparent mode

      • Enter the IP address of the client that will be permitted to access the server into the From field.

        You can use an IPv4 or an IPv6 address. To limit the IP range to the specified address, set the prefix to 32 (IPv4) or 128 (IPv6).

      • Enter the IP address of the server into the To field.

        You can use an IPv4 or an IPv6 address. To limit the IP range to the specified address, set the prefix to 32 (IPv4) or 128 (IPv6).

      • Enter the port number where the server is accepting connections into the Port field.

    4. Select Enable indexing.

    5. Click Commit.

      This connection allows any user from the client machine to connect to the specified server, but permits only terminal sessions — other SSH channels like TCP forwarding are disabled.

  3. Configure a new non-transparent connection.

      • To configure an SSH connection, select SSH Control > Connections from the Main Menu. Only terminal sessions will be permitted.

      • To configure an RDP connection, click on the RDP Control > Connections from the Main Menu. Only basic Remote Desktop sessions will be permitted (that is, no clipboard or file-sharing).

    1. Click the icon on the right to create a new connection.

    2. Enter a name into the Name field that will identify the connection (for example, admin-server-nontransparent).

      TIP:

      It is recommended to use descriptive names that give information about the connection: refer to the name of the accessible server, the allowed users, and so on.

    3. Enter the IP addresses defining the connection:

      Figure 28: <Protocol name> Control > Connections — Configuring an SSH connection in non-transparent mode

      • Enter the IP address of the client that will be permitted to access the server into the From field.

        You can use an IPv4 or an IPv6 address. To limit the IP range to the specified address, set the prefix to 32 (IPv4) or 128 (IPv6).

      • Enter the IP address of SPS's physical interface 1 into the To field.

        You can use an IPv4 or an IPv6 address. To limit the IP range to the specified address, set the prefix to 32 (IPv4) or 128 (IPv6).

      • Enter a port number into the Port field.

      • Enter the IP address of the server into the Use fixed address field of the Target section.

        You can use an IPv4 or an IPv6 address.

      • Enter the port number where the server is accepting connections into the Port field of the Target section.

    4. Select Enable indexing.

    5. Click Commit.

      This connection allows any user from the client machine to connect to the specified server, but permits only terminal sessions — other SSH channels like TCP forwarding are disabled.

  4. Test the new configuration: try to initiate an SSH or and RDP connection from the client to the server.

  5. After successfully connecting to the server, do something in the connection, for example, execute a simple command in SSH (for example, ls /tmp), or launch an application in RDP (for example, the Windows Explorer), then disconnect from the server.

  6. Navigate to Search > Search on the SPS web interface. Your sessions are displayed in the list of connections. Note that for the transparent connection, the client addresses the target server, while the non-transparent connection addresses SPS.

  7. Click the icon. A summary will be displayed about the connection. Enter a text that was displayed in the connection into the search box, for example, the command you executed in SSH, or a menu item or other text you have seen in RDP (for example, Start). SPS will automatically generate a screenshot showing when the text was displayed in the connection.

  8. Click to generate a video file from the audit trail that you can replay. Depending on the load of the indexer and the length and type of the audit trail, this can take several minutes (to cancel processing the audit trail, click ). The Video status field shows the progress of the this process.

    When the video is available, changes to .

    Figure 29: Audit trail details

  9. To replay the video, click . The Player window opens.

  10. Play the audit trail, and review your actions.

Basic settings

SPS is configured through the web interface. Configuration changes take effect automatically after clicking Commit. Only the modifications of the current page or tab are activated — each page and tab must be committed separately.

Supported web browsers and operating systems

Supported browsers: the current version of Mozilla Firefox and Google Chrome, Microsoft Edge, and Microsoft Internet Explorer 11 or newer. The browser must support TLS-encrypted HTTPS connections, JavaScript, and cookies. Make sure that both JavaScript and cookies are enabled.

Caution:

Since the official support of Internet Explorer 9 and 10 ended in January, 2016, they are not supported in SPS version 4 F3 and later.

Caution:

Even though the SPS web interface supports Internet Explorer and Microsoft Edge in general, to replay audit trails you need to use Internet Explorer 11, and install the Google WebM Video for Microsoft Internet Explorer plugin. If you cannot install Internet Explorer 11 or another supported browser on your computer, use the the Safeguard Desktop Player application. For details, see Replaying audit trails in your browser in Search (classic) and Safeguard Desktop Player User Guide.

NOTE:

SPS displays a warning message if your browser is not supported or JavaScript is disabled.

NOTE:

The minimum recommended screen resolution for viewing SPS's web interface is 1366 x 768 pixels on a 14-inch widescreen (standard 16:9 ratio) laptop screen. Screen sizes and screen resolutions that are equal to or are above these values will guarantee an optimal display of the web interface.

Supported operating systems: Windows 2008 Server, Windows 7, Windows 2012 Server, Windows 2012 R2 Server, Windows 8, Windows 8.1, Windows 10, Windows 2016, and Linux.

The SPS web interface can be accessed only using TLS encryption and strong cipher algorithms.

Opening the web interface in multiple browser windows or tabs is not supported.

Related Documents