Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 5.9.0 - Administration Guide

Preface Introduction The concepts of SPS The Welcome Wizard and the first login Basic settings User management and access control Managing SPS
Controlling SPS: reboot, shutdown Managing Safeguard for Privileged Sessions clusters Managing a high availability SPS cluster Upgrading SPS Managing the SPS license Accessing the SPS console Sealed mode Out-of-band management of SPS Managing the certificates used on SPS
General connection settings HTTP-specific settings ICA-specific settings RDP-specific settings SSH-specific settings Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search (classic) interface Using the Search interface Searching session data on a central node in a cluster Advanced authentication and authorization techniques Reports The SPS RPC API The SPS REST API SPS scenarios Troubleshooting SPS Configuring external devices Using SCP with agent-forwarding Security checklist for configuring SPS Jumplists for in-product help Third-party contributions About us

The structure of the web interface

NOTE:

The minimum recommended screen resolution for viewing SPS's web interface is 1366 x 768 pixels on a 14-inch widescreen (standard 16:9 ratio) laptop screen. Screen sizes and screen resolutions that are equal to or are above these values will guarantee an optimal display of the web interface.

The web interface consists of the following main sections:

Main menu: Each menu item displays its options in the main workspace on one or more tabs. Click a main menu item to display the list of tabs available under that particular menu item.

Figure 30: Structure of the web interface

User menu: Provides possibilities to upload your security passphrase and permanent or temporary keys, to change your SPS password, to log out, and disable confirmation dialogs and tooltips using the Preferences option. For details, see Preferences.

User Info: Provides information about the user currently logged in:

  • User: username

  • Host: IP address of the user's computer

  • Last login: date and IP address of the user's last login

Figure 31: User menu and User Info

System Monitor: Displays accessibility and system health information about SPS, including the following:

Figure 32: System Monitor

  • Time: System date and time.

  • Remaining time: The time remaining before the session to the web interface times out.

    NOTE:

    To change timeout settings, navigate to Basic Settings > Management > Web interface timeout and enter the timeout value in minutes.

  • Locked: Indicates that the interface is locked by another administrator (for details, see Multiple users and locking).

  • Indicators if HTTP, ICA, RDP, SSH, Telnet, and VNC traffic is permitted to the protected servers.

  • Connections: The number of active ICA, RDP, SSH, Telnet, and VNC connections. For HTTP, the number of active HTTP sessions is displayed.

  • Log ingestion: Indicates the number of log rows that have arrived on PSM within the past hour.

    The information displayed is refreshed every 60 seconds.

    NOTE:

    Log ingestion information is only displayed if Basic Settings > Local services > Log ingestion is enabled.

  • License: License information if the license is not valid, or an evaluation version license has expired.

  • The status of the RAID devices, if synchronization between the disks is in progress.

  • HA: The HA status and the ID of the active node if two SPS units are running in a High Availability cluster. If there are redundant Heartbeat interfaces configured, their status is displayed as well. If the nodes of the cluster are synchronizing data between each other, the progress and the time remaining from the synchronization process is also displayed.

  • Protected hosts or Concurrent sessions: Displays license usage, that is, the number of hosts that have been accessed through SPS in case of host-based licensing, or the number of active sessions in case of session-based licensing.

  • Average system load during the

    • Load 1: last minute

    • Load 15: last fifteen minutes

  • CPU, memory, hard disk, and swap use. Hover the mouse above the graphical bars to receive a more details in a tooltip, or navigate to Basic Settings > Dashboard for detailed reports.

The System monitor displays current information about the state of SPS. To display a history of these parameters, go to Basic Settings > Dashboard. For details, see Status history and statistics.

Elements of the main workspace

The main workspace displays the configuration settings related to the selected main menu item grouped into one or more submenus. Related parameters of a submenu are organized into labeled groups or sections, marked with blue outline .

Figure 33: Main workspace

  • CommitEach page includes one or more orange action buttons. The most common action button is Commit, which saves and activates the changes of the page.

  • / Show/Hide details: Displays or hides additional configuration settings and options.

  • Create entry: Create a new row or entry (for example an IP address or a policy).

  • Delete entry: Delete a row or an entry (for example an IP address or a policy).

  • Modify entries or upload files: Edit an entry (for example a host key, a list, and so on), or upload a file (for example a private key). These actions open a pop-up window where the actual modification can be performed.

  • , Position an item in a list: Modify the order of items in a list. The order of items in a list (for example the order of connections, permitted channels in a channel policy, and so on) is important because when SPS is looking for a policy, it evaluates the list from top to down, and selects the first item completely matching the search criteria. For example, when a client initiates a connection to a protected server, SPS selects the first connection policy matching the client's IP address, the server's IP address, and the target port (the From, To, and Port fields of the connection).

Message window: This pop-up window displays the responses of SPS to the user's actions, for example Configuration saved successfully. Error messages are also displayed here. All messages are included in the system log. For detailed system logs (including message history), see the Troubleshooting tab of the Basic Settings. To make the window appear only for failed actions, navigate to User menu > Preferences and enable the Autoclose successful commit messages option.

Figure 34: Message window

Multiple users and locking

Multiple administrators can access the SPS web interface simultaneously, but only one of them can modify the configuration. This means that the configuration of SPS is automatically locked when the first administrator who can modify the configuration opens a configuration page (for example the Basic Settings or the AAA menu). The System Monitor field displays the username and IP address of the administrator locking the configuration. Other administrators must wait until the locking administrator navigates to a SPS page that does not require locking, the administrator logs out, or the session of the administrator times out. However, it is possible to access the Search and Reporting menus, and to perform gateway authentication and 4-eyes authorization or browse the configuration with only View rights (for details, see User management and access control).

Accessing SPS using the REST or the RPC API locks the configuration similarly to accessing SPS from the web interface.

NOTE:

If an administrator logs in to SPS using the local console or a remote SSH connection, access through the web interface is completely blocked. Inactive local and SSH connections timeout just like web connections. For details, see Accessing the SPS console.

Web interface timeout

By default, SPS terminates the web session of a user after ten minutes of inactivity. To change value of this timeout, adjust the Basic Settings > Management > Web interface timeout option.

Figure 35: Basic Settings > Management > Web interface timeout — Web interface timeout

Related Documents