Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 6.4.0 - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS) The Welcome Wizard and the first login Basic settings
Supported web browsers and operating systems The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving and cleanup Forwarding data to third-party systems Joining to One Identity Starling
User management and access control Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) RPC API The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS) Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Multiple users and locking

Multiple administrators can access the One Identity Safeguard for Privileged Sessions (SPS) web interface simultaneously, but only one of them can modify the configuration. This means that the configuration of SPS is automatically locked when the first administrator who can modify the configuration opens a configuration page (for example the Basic Settings or the AAA menu).

The warning message displays the username of the administrator locking the configuration as shown in the image below:

Figure 35: Configuration lock by remote administrator

Other administrators can continue as read-only but must wait until the locking administrator navigates to an SPS page that does not require locking, the administrator logs out, or the session of the administrator times out. However, it is possible to access the Search and Reporting menus, and to perform gateway authentication and 4-eyes authorization or browse the configuration with only View rights (for details, see Managing user rights and usergroups).

NOTE:

Accessing SPS using the RPC API or starting a transaction in the REST API locks the configuration similarly to accessing SPS from the web interface.

However, there can be multiple transactions through REST API, simultaneously.

NOTE:

If an administrator logs in to SPS using the local console or a remote SSH connection, the configuration is also locked. Inactive local and SSH connections timeout just like web connections. For details, see Accessing the One Identity Safeguard for Privileged Sessions (SPS) console.

Web interface timeout

By default, One Identity Safeguard for Privileged Sessions (SPS) terminates the web session of a user after ten minutes of inactivity. To change value of this timeout, adjust the Basic Settings > Management > Web interface timeout option.

Figure 36: Basic Settings > Management > Web interface timeout — Web interface timeout

Preferences

To configure your preferences about the web interface, navigate to User Menu > Preferences.

Figure 37: User Menu > Preferences

  • Show tooltips: Display tooltips for user interface elements to help using the product.

  • Confirmation before deleting policies: Display a pop-up window when you attempt to delete policies to prevent deleting policies accidentally.

  • Confirmation before deleting entries: Display a pop-up window when you attempt to delete entries to prevent deleting entries accidentally.

  • Warn when unsaved changes may be lost: Display a pop-up window to warn when you navigate to another window without committing your changes to prevent losing unsaved changes.

  • Autoclose successful commit messages: General confirmation windows will not appear. (For example, Configuration saved successfully that appears after successfully committing a change). As a result, pop-up windows appear only for failed actions or errors.

  • Mousewheel scrolling of search results: When there are several pages of displayable search results on the Search page, navigate between search result pages with the mousewheel. When turned off, using the mousewheel on the Search page scrolls the whole page.

  • Audit trail filename template:

    To change the filename of the audit trails, navigate to User menu > Preferences and change the Audit trail filename template. The default template is {protocol}-{starttime}-{gw-username}-{remote-username}-{dst-ip}.zat. The template can include anything, the keys (inside {} brackets) are replaced with their actual values. These keys are the following:

    • connection-policy: The connection policy

    • dst-ip: Destination IP address

    • dst-port: Destination port

    • gw-username: Gateway username

    • protocol: Protocol

    • remote-username: Remote username

    • session-id: Session ID

    • src-ip: Source IP address

    • starttime: Start time of the session

Network settings

The Basic Settings > Network tab contains the network interface and naming settings of One Identity Safeguard for Privileged Sessions (SPS).

Interfaces

Figure 38: Basic Settings > Network > Interfaces

Lists all of the logical interfaces (VLAN IDs, IP addresses, netmasks, and names) assigned to the three physical interfaces of SPS. For more information on managing logical interfaces, see Managing logical interfaces.

In addition, it is also possible to set the Maximum Transmission Unit (MTU) for each network interface (VLAN or network interface card) individually. The default value is 1500.

Speed is displayed for every physical interface. To explicitly set the speed of the interface, select the new value from the Speed field. Modifying the speed of an interface is recommended only for advanced users.

You can add interface-specific network routes using the Advanced routing option of each interface. Otherwise, use the Routing table option to manage networking routes.

Routing table

Figure 39: Basic Settings > Network > Routing table

When sending a packet to a remote network, SPS consults the routing table to determine the path it should be sent. If there is no information in the routing table then the packet is sent to the default gateway. Use the routing table to define static routes to specific hosts or networks. You have to use the routing table if SPS interfaces are connected to multiple subnets.

Click the and icons to add new routes or delete existing ones. A route means that messages sent to the Address/Netmask network should be delivered to Gateway.

For detailed examples, see Configuring the routing table.

IP forwarding

Figure 40: Basic Settings > Network > IP forwarding

You can enable routing between logical interfaces, which allows you to direct uncontrolled traffic through SPS. For more information, see Routing uncontrolled traffic between logical interfaces.

To mimic the functionality of the deprecated Router mode, configure a logical interface for each physical interface you want to connect, and enable IP forwarding between them.

Naming

Figure 41: Basic Settings > Network > Naming

  • Hostname: Name of the machine running SPS.

  • Nick name: The nickname of SPS. Use it to distinguish the devices. It is displayed in the core and boot login shells.

  • DNS search domain: Name of the domain used on the network. When resolving the domain names of the audited connections, SPS will use this domain to resolve the target hostname if the appended domain entry of a target address is empty.

  • Primary DNS server: IP address of the name server used for domain name resolution.

  • Secondary DNS server: IP address of the name server used for domain name resolution if the primary server is unaccessible.

HTTPS proxy

The HTTPS proxy settings must be configured if your company policies do not allow devices to connect directly to the web. Once configured, SPS uses the configured proxy server for outbound web requests to external integrated services, such as Join to Starling or SPS plugins.

Figure 42: Basic Settings > Network > HTTPS proxy

  • Proxy server: The IP address or DNS name of the proxy server.

  • Port: The IP address or DNS name of the proxy server.

    NOTE:

    If different ports are specified in the Proxy server and the Port field, the Port field takes precedence.

  • Username: The user name used to connect to the proxy server.

    NOTE:

    The username and password are only required if your proxy server requires them to be specified.

  • Password: The password required to connect to the proxy server.

    NOTE:

    The username and password are only required if your proxy server requires them to be specified.

Related Documents