One Identity Safeguard for Privileged Sessions 6.0.3 - Administration Guide

Configuring e-mail alerts

The following describes how to configure e-mail alerts.

To configure e-mail alerts

1. Navigate to Basic Settings > Management > Mail settings.

2. If you want to encrypt the communication between SPS and the SMTP server, in Encryption, select the STARTTLS option and complete the following steps:

   • If you want SPS to verify the certificate of the server, select Only accept certificates issued by the specified CA certificate and click the icon in the CA X.509 certificate field. A pop-up window is displayed.

     Click Browse, select the certificate of the Certificate Authority (CA) that issued the certificate of the SMTP server, then click Upload. Alternatively, you can paste the certificate into the Copy-paste field and click Set.

     SPS will use this CA certificate to verify the certificate of the server, and reject the connections if the verification fails.

   • If the SMTP server requires mutual authentication, that is, it expects a certificate from SPS, enable Authenticate as client. Generate and sign a certificate for SPS, then click in the Client X.509 certificate field to upload the certificate. After that, click in the Client key field and upload the private key corresponding to the certificate.

   One Identity recommends using 2048-bit RSA keys (or stronger).

3. If you want SPS to authenticate to the SMTP server, in Authentication, select the Enabled option. Enter the Username to authenticate with.

   To configure or change the password to use to authenticate to the SMTP server, click Change and enter the password. Click Update. Click .

   NOTE: One Identity Safeguard for Privileged Sessions (SPS) accepts passwords that are not longer than 150 characters. The following special characters can be used: !"#$%&'()*+,-./:;<=>?@[\]^-`{|}

4. Enter the IP address or the hostname of the mail server into the SMTP server address field.

   Use an IPv4 address.

   Figure 49: Basic Settings > Management > Mail settings — Configuring e-mail sending

   

5. Enter the e-mail address where you want to receive e-mails from into the Send e-mails as field. This can be useful for e-mail filtering purposes. SPS sends e-mails from the address provided here. If no e-mail address is entered, e-mails will be sent from the default e-mail address.

6. Enter the e-mail address of the administrator into the Administrator's e-mail address field. SPS sends notifications related to system-events (but not alerts and reports) to this address.

7. Enter the e-mail address of the administrator into the Send e-mail alerts to field. SPS sends monitoring alerts to this address.

8. Enter the e-mail address the person who should receive traffic reports from SPS into the Send reports to field. For details on reports, see Reports.

9. Click .

10. Click Test to send a test message.

    If the test message does not arrive to the server, check if SPS can access the server. For details, see Troubleshooting One Identity Safeguard for Privileged Sessions (SPS).

11. Navigate to Basic Settings > Alerting & Monitoring and select in which situations should SPS send an e-mail alert. For details, see Configuring system monitoring on SPS.

12. Click .

Configuring SNMP alerts

SPS can send alerts to a central monitoring server through SNMP (Simple Network Management Protocol).

To configure SNMP alerts

1. Navigate to Basic Settings > Management > SNMP trap settings.

2. Enter the IP address or the hostname of the SNMP server into the SNMP server address field.

   Use an IPv4 address.

   Figure 50: Basic Settings > Management > SNMP trap settings — Configuring SNMP alerts

   

3. Select the SNMP protocol to use.

   (Optional) To use the SNMP v2c protocol for SNMP queries, select SNMP v2c, and enter the community to use into the Community field. Otherwise, skip these steps.

   (Optional) To use the SNMP v3 protocol, select SNMP v3 and complete the following steps. Otherwise, skip these steps.

   1. Enter the username to use into the Username field.

   2. Enter the engine ID to use into the Engine ID field. The engine ID is a hexadecimal number at least 10 digits long, starting with 0x. For example, 0xABABABABAB.

   3. Select the authentication method (MD5 or SHA1) to use from the options under the Authentication method: field.

   4. Enter the password to use into the Authentication password field.

   5. Select the encryption method (Disabled, DES or AES) to use from the options under the Encryption method: field .

   6. Enter the encryption password to use into the Encryption password: field.

   Figure 51: Basic Settings > Management > SNMP trap settings — Configuring SNMP alerts using SNMPv3

   

   NOTE: One Identity Safeguard for Privileged Sessions (SPS) accepts passwords that are not longer than 150 characters. The following special characters can be used: !"#$%&'()*+,-./:;<=>?@[\]^-`{|}

4. Click .

5. Navigate to Basic Settings > Alerting & Monitoring and select in which situations SPS should send an SNMP alert. For details, see Configuring system monitoring on SPS.

6. Click .

Querying SPS status information using agents

External SNMP agents can query the basic status information of SPS.

To configure which clients can query status information

1. Navigate to Basic Settings > Local Services > SNMP server settings.

   Figure 52: Basic Settings > Local Services > SNMP server settings — Configuring SNMP agent access

   

   

2. Enable the SNMP server.

3. Optionally, you can enter the details of the SNMP server into the System location, System contact, and System description fields.

4. To use the SNMP v2c protocol for SNMP queries, enable SNMP v2c agent, and enter the community to use into the Community field.

5. To use the SNMP v3 protocol, select SNMP v3 agent and complete the following steps:

   1. Click

   2. Enter the username used by the SNMP agent into the Username field.

   3. Select the authentication method (MD5 or SHA1) to use from the options under the Auth. method field.

   4. Enter the password used by the SNMP agent into the Auth. password field.

   5. Select the encryption method (Disabled, DES or AES) to use from the options under the Encryption method field.

   6. Enter the encryption password to use into the Encryption password field.

   7. To add other agents, click .

   NOTE: One Identity Safeguard for Privileged Sessions (SPS) accepts passwords that are not longer than 150 characters. The following special characters can be used: !"#$%&'()*+,-./:;<=>?@[\]^-`{|}

6. In the Listening addresses field, choose and select the IP address and port for the SNMP server.

   The available addresses correspond to the interface addresses configured in Basic Settings > Network > Interfaces. Only IPv4 addresses can be selected.

   Repeat this step to add multiple addresses.

7. (Optional) To permit access to the SNMP server only from selected subnets or IP addresses, select Restrict clients, click and enter the IP address and netmask of the allowed clients.

   Use an IPv4 address.

   Repeat this step to add multiple addresses.

8. Click .

Customize system logging in One Identity Safeguard for Privileged Sessions (SPS)

One Identity Safeguard for Privileged Sessions (SPS) uses the syslog-ng Open Source Edition application (version 3.16) for system logging. Starting with SPS 5 LTS, you can customize its configuration to better integrate SPS into your logging infrastructure. If you are not familiar with syslog-ng Open Source Edition, read how syslog-ng OSE works. Customizing the configuration of syslog-ng Open Source Edition allows you to better integrate the log messages of SPS into your environment, for example, to:

• change the message format or rename message fields,

• send the messages to multiple logservers or SIEMs, or to

• select (filter) which messages to send to your logserver.

Limitations

Note that not every feature described in the syslog-ng Open Source Edition documentation is available on SPS. Typically, features that are only rarely used on logging clients are not available (for example, Java-based destinations like HDFS and Elasticsearch). For a detailed list of available modules, execute the syslog-ng --module-registry command.

Customize the syslog-ng configuration

Do not change the syslog configuration of SPS unless you know exactly what you are doing. Incorrect changes can decrease the performance of SPS, deactivate system logging, or cause message loss.

While customizing the syslog-ng configuration, note the following points in particular:

1. Create a SPS configuration snippet in a file. Make sure that the filename ends with .conf. Note that syslog-ng OSE uses the configuration objects defined in these files only if they are used in a log path as well, so make sure to include a log path.

   Do not loop messages. That is, make sure that the destination does not send a message back to the original source of the message (doing so would cause an infinite loop).

2. Copy it to the /etc/syslog-ng/conf.d/ directory of the core firmware. (If you are using a high-availability SPS cluster, SPS automatically copies the file to the secondary node as well.)

   Files located in this directory do not taint the SPS configuration and SPS automatically includes them in the configuration of syslog-ng Open Source Edition.

   Do not modify the original configuration files (for example, /etc/syslog-ng/syslog-ng.conf or /etc/syslog-ng/conf.d/message-queue-client.conf).

3. Verify that the resulting syslog-ng OSE configuration file is syntactically valid. The configuration is valid if executing the following command does not show any syntax errors: syslog-ng --syntax-only --no-caps

4. Your changes will take effect only after you reload the configuration of syslog-ng Open Source Edition using the following command: syslog-ng-ctl reload

   If there are any errors in the configuration, SPS keeps on using the earlier configuration. In this case, correct the configuration, because if SPS reboots while the syslog-ng OSE configuration is invalid, SPS will not be able to log messages.

Available sources

You can use the following sources in your custom configuration. These sources are defined in the stock configuration file of syslog-ng OSE, and are in regular syslog message format (except for s_message_queue_client).

• s_core_journal: Logs of the SPS host, including log messages about the audited sessions.

• s_message_queue_client: Logs about the audited sessions in JSON format.

• s_slave_boot: Logs from the boot firmware of the secondary node in a high-availability SPS cluster.

• src: Logs messages of local SPS services.

• src-internal: The internal logs of syslog-ng OSE running on SPS.

Certificates and encrypted connections

If you are using a custom destination that requires a certificate (either to authenticate SPS, or to verify the identity of the logserver). In this case, copy the certificates to SPS into the /etc/syslog-ng/conf.d/ directory. In the custom syslog configuration you cannot use the certificates uploaded to SPS using the web interface.

SIEM integration

Customizing the syslog configuration of SPS allows you to send log messages directly to your SIEM (for example, Splunk) in a format that your SIEM can understand.

One Identity can provide you the configuration files needed to send the log messages of SPS to Splunk in the Splunk Common Information Model (CIM) format. If you are interested, contact our Support Team.

If you need assistance to use another SIEM format, contact professionalservices@balabit.com.

Examples

The following configuration snippet reads the messages from the built-in s_message_queue_client source, parses the JSON message, and sends the messages to a remote destination using the RFC5424 message format (the body of the message remains in JSON).

parser json {
    json-parser(
        prefix(".scb.")
        template("$MSG")
    );
};

destination d_custom_remote {
    syslog(
        "192.168.1.1"
        transport(tcp)
        port(6514)
        template("$(format-json --key .scb.*)\n")
    );
};

log {
    source(s_message_queue_client);
    parser(json);
    destination(d_custom_remote);
};

A sample log message using the above configuration is the following (line-breaks added for clarity):

{"_scb":
  {
    "username":"frobert",
        "timestamp":"1499673286.380022",
        "session_id":"svc/hm4soFrNYeAmkyzLVkzi1o/ssh_demo:4",
        "server_port":"22",
        "server_ip":"10.30.255.70",
        "protocol":"ssh",
        "event_type":"server_authentication_success",
        "connection_name":"ssh_demo",
        "client_port":"50830",
        "client_ip":"10.30.255.70"
    }
}

To use this configuration snippet on your SPS, copy it to a file (make sure that the filename ends with .conf), change the IP address and port number to match your environment, copy it to the core firmware of your SPS into the /etc/syslog-ng/conf.d directory, then reload the syslog-ng configuration using syslog-ng-ctl reload.