One Identity Safeguard for Privileged Sessions 6.4.0 - Administration Guide

Configuring date and time

To configure the date and time-related settings of SPS, navigate to Basic Settings > Date & Time.

Figure 47: Basic Settings > Date & Time — Date and time management

To explicitly set the date and time on SPS, enter the current date into respective fields of the Date & Time settings group and click Set Date & Time.

When two SPS units are operating in High Availability mode, the secondary node automatically synchronizes its time and date to the primary node. To manually synchronize the time between the nodes, click Sync Master (available only in High Availability mode).

To retrieve the date automatically from a time server, complete the following steps:

1. Select your timezone in the Timezone field.

2. Enter the IP address of an NTP time server into the Address field.

   Use an IPv4 address.

3. Click .

4. Click the and icons to add new servers or delete existing ones.

5. Optional: If the time setting of SPS is very inaccurate (that is, the difference between the system time and the actual time is great), it might take a long time to retrieve the date from the NTP server. In this case, click Sync Now or Sync Master to sync the time immediately using SNTP.

System logging, SNMP and e-mail alerts

E-mail alerts and system logging can be configured on the Basic Settings > Management page.

Topics:

Configuring system logging

One Identity Safeguard for Privileged Sessions (SPS) can send its system log messages to remote syslog servers (for example, syslog-ng Premium Edition, syslog-ng Store Box, Splunk, or HPE ArcSight Data Platform).

Figure 48: Basic Settings > Management > Syslog — Configuring system logging

To configure logging to a remote server

1. Navigate to Basic Settings > Management.

2. Click in the Syslog > Syslog receivers field to add a new syslog server.

3. Enter the IP address and port of the syslog server into the respective fields.

   Use an IPv4 address.

4. Select the network protocol used to transfer the messages in the Protocol field. The legacy- prefix corresponds to the legacy BSD-syslog protocol described in RFC3164, while the syslog- prefix corresponds to the new IETF-syslog protocol described in RFC5424. Note that not every syslog server supports the IETF protocol yet.

   Select TCP+TLS to send the log messages using a TLS-encrypted connection.

   TIP:

   Transferring the syslog messages using TCP ensures that the server receives them.

   Transferring the syslog messages using TLS encryption ensures that third parties cannot read the messages. However, not every syslog server accepts encrypted connections. The syslog-ng Premium Edition and Open Source Edition applications, and the syslog-ng Store Box (which is a log-collector appliance similar to SPS) support both encrypted connections and the new IETF-syslog protocol as well. For details on these products, see syslog-ng Premium Edition and syslog-ng Store Box.

5. To display separate hostnames for syslog messages sent by the nodes of a SPS HA cluster, select the Include node ID in hostname in boot firmware messages option. The node ID included in the hostname file of the syslog message is the MAC address of the node's HA interface. (Messages of the core firmware are always sent by the primary node.)

   The boot firmware boots up SPS, provides High Availability support, and starts the core firmware. The core firmware, in turn, handles everything else: provides the web interface, manages the connections, and so on.

6. If you have selected the TCP+TLS protocol, complete the following steps. Otherwise, click .

   2. If you want SPS to verify the certificate of the syslog server, select Only accept certificates issued by the specified CA certificate in the Check server certificate field and proceed to the next step.

      If you want SPS to simply accept any certificate shown by the server, select No certificate is required in the Check server certificate field.

      NOTE:

      Alternatively, you can use the following, less strict options to check the certificate of the server:

      • No certificate is required. If the host sends one, it must be valid and issued to the host: If the remote host sends a certificate, SPS checks if it is valid (not expired) and that the Common Name of the certificate contains the domain name or the IP address of the host. If these checks fail, SPS rejects the connection. However, SPS accepts the connection if the host does not send a certificate.

      • Certificate is required. Accept any certificate: SPS requests a certificate from the server, and rejects the connection if no certificate is received, if the certificate is not valid (expired), or if the Common Name of the certificate does not contain the domain name or the IP address of the server.

   3. Click the icon in the CA X.509 certificate field. A pop-up window is displayed.

      You can choose to upload a single certificate or a certificate chain (where one member of the chain is the CA that will sign the certificates). To upload a certificate chain, copy the certificates one after the other in a single file, and upload the file using Browse, and then Upload. Alternatively, you can copy and paste the certificates one after the other into the Certificate Chain field, and click Set. The certificates do not have to be in order, SPS will order them and validate the chain: if a member of the chain is missing, an error message is displayed.

      SPS will use this CA certificate to verify the certificate of the server, and reject the connections if the verification fails.

      To download previously uploaded certificates, click on the certificate and either download the certificate (or certificate chain) in one single PEM or DER file, or you can download single certificate files separately (if it is a certificate chain).

   4. If the syslog server requires mutual authentication, that is, it expects a certificate from SPS, generate and sign a certificate for SPS, then click the icon in the Client X.509 certificate field to upload the certificate. After that, click the icon in the Client key field and upload the private key corresponding to the certificate.

   5. Click .

7. Click the and icons to add new servers or delete existing ones.

   NOTE:

   To reduce the risk of the syslog server not receiving log messages from SPS because of a network outage or other problem with the syslog server, SPS buffers up to 10 Megabytes of log messages to its hard disk in case the syslog server becomes unaccessible.

Configuring e-mail alerts

The following describes how to configure e-mail alerts.

To configure e-mail alerts

1. Navigate to Basic Settings > Management > Mail settings.

2. If you want to encrypt the communication between SPS and the SMTP server, in Encryption, select the STARTTLS option and complete the following steps:

   • If you want SPS to verify the certificate of the server, select Only accept certificates issued by the specified CA certificate and click the icon in the CA X.509 certificate field. A pop-up window is displayed.

     Click Browse, select the certificate of the Certificate Authority (CA) that issued the certificate of the SMTP server, then click Upload. Alternatively, you can paste the certificate into the Copy-paste field and click Set.

     SPS will use this CA certificate to verify the certificate of the server, and reject the connections if the verification fails.

   • If the SMTP server requires mutual authentication, that is, it expects a certificate from SPS, enable Authenticate as client. Generate and sign a certificate for SPS, then click in the Client X.509 certificate field to upload the certificate. After that, click in the Client key field and upload the private key corresponding to the certificate.

   One Identity recommends using 2048-bit RSA keys (or stronger).

3. If you want SPS to authenticate to the SMTP server, in Authentication, select the Enabled option. Enter the Username to authenticate with.

   To configure or change the password to use to authenticate to the SMTP server, click Change and enter the password. Click Update. Click .

   NOTE:

   One Identity Safeguard for Privileged Sessions (SPS) accepts passwords that are not longer than 150 characters. Unicode characters as well as the following special characters can be used: !"#$%&'()*+,-./:;<=>?@[\]^-`{|}

4. Enter the IP address or the hostname of the mail server into the SMTP server address field.

   Use an IPv4 address.

   Figure 49: Basic Settings > Management > Mail settings — Configuring e-mail sending

   

5. Enter the e-mail address where you want to receive e-mails from into the Send e-mails as field. This can be useful for e-mail filtering purposes. SPS sends e-mails from the address provided here. If no e-mail address is entered, e-mails will be sent from the default e-mail address.

6. Enter the e-mail address of the administrator into the Administrator's e-mail address field. SPS sends notifications related to system-events (but not alerts and reports) to this address.

7. Enter the e-mail address of the administrator into the Send e-mail alerts to field. SPS sends monitoring alerts to this address.

8. Enter the e-mail address the person who should receive traffic reports from SPS into the Send reports to field. For details on reports, see Reports.

9. Click .

10. Click Test to send a test message.

    If the test message does not arrive to the server, check if SPS can access the server. For details, see Troubleshooting One Identity Safeguard for Privileged Sessions (SPS).

11. Navigate to Basic Settings > Alerting & Monitoring and select in which situations should SPS send an e-mail alert. For details, see Configuring system monitoring on SPS.

12. Click .