Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 7.0.3.1 LTS - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing IPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers and operating systems The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving Using plugins Forwarding data to third-party systems Starling integration
User management and access control Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received Using UPN usernames in audited SSH connections
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

The aps table

NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.

This table contains information only about Audit Player indexers. It does not contain any information about the indexer service.

Table 14: Columns of the aps table
Column Type Description
ap_id integer [OBSOLETE] The ID of the Audit Player indexer service that is processing the audit trail.
dead boolean Set to 1 if the Audit Player indexer service on this host is considered to be unavailable.
id integer The unique ID number of the entry.
last_poll integer The timestamp of the last time when the Audit Player indexer service on this host requested an audit trail from SPS.
remote_addr text [OBSOLETE] The address of the host running the Audit Player indexer service.

The archives table

NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.

Table 15: Columns of the archives table
Column Type Description
id integer The unique ID number of the entry.
orig_filename text The original name of the file, as stored on SPS.
policy_id text The ID of the archiving policy that archived the file.
saved_filename text The name of the archive file containing the file.
server text The address of the server where the file was archived.
type text Indicates the type of the file: audit or index.

The audit_trail_downloads table

This table contains information about the downloaded audit trails.

NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.

Table 16: Columns of the audit_trail_downloads table
Column Type Description
channel_id integer This value is a reference to the ID of the channels table where the download occurred.
download_time integer Time when the download was started.
from_api boolean The value is true, if it has been downloaded through the REST API, and false if through the web user interface.
id integer The unique ID of the entry.
ip text The client IP address.
username text The username of the downloader on the web user interface. If indexer is used, then the login username.

The channels table

NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.

Table 17: Columns of the channels table
Column Type Description
application text

Application: The name of the application accessed in a seamless Citrix ICA connection.

_archive_date date

Archive date: The date when the connection was archived or cleaned up.

_archive_path text

Archive path: The path where the audit trail was archived on the remote server.

_archive_policy text
_archive_server text

Archive server: The hostname or IP address of the remote server where the audit trail was archived.

audit text

Audit-trail: Name and ID of the audit file storing the traffic of the channel. If the session has an audit trail, a icon is displayed. Note that a the following letters may appear on the download icon:

auth_method text

Authentication method: The authentication method used in the connection. For example, password

channel_policy text

Channel policy: The Channel policy applied to connection. The Channel policy lists the channels (for example, terminal session and SCP in SSH, or Drawing and Clipboard in RDP) that can be used in the connection, and also determines if the channel is audited or not. The Channel policy can also restrict access to each channel based on the IP address of the client or the server, a user list, user group, or a time policy.

channel_type text

Channel type: Type of the channel.

client_x509_subject text

Client X.509 Subject: The client's certificate in TELNET or VNC sessions. Available only if the Client-side transport security settings > Peer certificate validation option is enabled in SPS.

_close_cleanup boolean
command_extracted boolean

The value is true if the window title and the command has been extracted real-time (during alerting) so that the indexer service does not have to extract them again. It is false if they will be extracted only during indexing.

_connection_channel_id integer

Unique connection ID: The unique identifier of the connection.

connection_id text

Connection policy ID: The identifier of the connection policy.

connection text

Connection policy: The connection policy that handled the client's connection request.

device_name text

Device name: The name or ID of the shared device (redirect) used in the RDP connection.

dst_ip text

Destination IP: The IP address of the server as requested by the client.

dst_port integer

Destination port: The port number of the server as requested by the client.

dynamic_channel text

Dynamic channel: The name or ID of the dynamic channel opened in the RDP session.

exec_cmd text

Exec command: The command executed in a Session exec channel.

four_eyes_authorizer text

Four-eyes authorizer: The username of the user who authorized the session. Available only if 4-eyes authorization is required for the channel. For details on 4-eyes authorization, see Configuring four-eyes authorization.

four_eyes_description text

Four-eyes description: The description submitted by the authorizer of the session.

id integer The unique ID of the channel.
index_status integer

Channel's indexing status: Shows if the channel has been indexed. The following values are possible:

  • CHANNEL_OPEN (0): The connection of the channel is still open (indexer is waiting for the connection to close).

  • NOT_INDEXED (1): All channels of the connection have been closed which belong to the connection. The channel is ready for indexing, unless the audit trail was placed in the skipped_connections queue.

  • INDEXING_IN_PROGRESS (2): The channel is being indexed (indexing in progress). Note that SPS will return search results for the parts of the channel are already indexed.

  • INDEXED (3): Indexing the channel is complete.

  • INDEXING_NOT_REQUIRED (4): Indexing not required (indexing is not enabled for the connection).

  • INDEXING_FAILED (5): Indexing failed. The indexer service writes the corresponding error message in the error_message column of the indexer_jobs table. Note that SPS will return search results for the parts of the channel that were successfully indexed before the error occurred. For example, if the error occurred at the end of a long audit trail, you can still search for content from the first part of the audit trail.

  • NO_TRAIL (6): Auditing is not enabled for the channel.

local_ip text

Server-local IP: The IP address of SPS used in the server-side connection.

local_port integer

Server-local port: The port number of SPS used in the server-side connection.

originator_addr text

Port/X11 forward originator IP: The IP address of the host initiating the channel in Remote Forward and Local Forward channels. Note that this host is not necessarily the client or the server of the SSH connection.

originator_port integer

Port/X11 forward originator port: The number of the forwarded port in Remote Forward and Local Forward channels.

protocol text

Protocol: The protocol used in the connection (Citrix ICA, HTTP, RDP, SSH, Telnet, or VNC).

remote_username text

Username on server: The username used to log in to the remote server. This username can differ from the client-side username if usermapping is used in the connection. For details on usermapping, see Configuring usermapping policies.

rule_num text

Rule number: The number of the line in the Channel policy applied to the channel.

scp_path text

SCP path: Name and path of the file copied via SCP. Available only for SCP sessions (Session exec SCP SSH channels) if the Log file transfers to database option is enabled in the Channel Policy of the connection.

server_ip text

Server IP: The IP address of the server connected by SPS.

server_port integer

Server port: The port number of the server connected by SPS.

session_end integer

End time: Date when the channel was closed.

session_id text

Session ID:

A globally unique string that identifies the session. This session ID has the following format: svc/<unique-random-hash>/<name-of-the-connection-policy>:<session-number-since-service-started>/<protocol>, for example, svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:1/ssh.

Log messages related to the session also contain this ID. For example:

2015-03-20T14:29:15+01:00 demo.example
zorp/scb_ssh[5594]: scb.audit(4):
(svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:0/ssh):
Closing connection; connection='ssh_console',
protocol='ssh', connection_id='409829754550c1c7a27e7d',
src_ip='10.40.0.28', src_port='39183',
server_ip='10.10.20.35', server_port='22',
gateway_username='', remote_username='example-username',
verdict='ZV_ACCEPT'
session_start integer

Start time: Date when the channel was started.

src_ip text

Source IP: The IP address of the client.

src_port integer

Source port: The port number of the client.

subsystem_name text

Subsystem name: Name of the SSH subsystem used in the channel.

target_addr text

Port-forward target IP: The traffic was forwarded to this IP address in Remote Forward and Local Forward channels.

target_port integer

Port-forward target port: The traffic was forwarded to this port in Remote Forward and Local Forward channels.

username text

Username: The username used in the session.

  • If the user performed inband gateway authentication in the connection, the field contains the username from the gateway authentication (gateway username).

  • Otherwise, the field contains the username used on the remote server.

verdict text

Verdict: Indicates what SPS decided about the channel.

  • ACCEPT: Accepted.

  • ACCEPT-TERMINATED: Connection was accepted and established, but a content policy terminated the connection. For details on content policies, see Real-time content monitoring with Content Policies.

  • CONN-AUTH-FAIL: User authentication failed.

  • CONN-DENY: Connection rejected.

  • CONN-FAIL: Connection failed, that is, it was allowed to pass SPS but timed out on the server.

  • CONN-GW-AUTH-FAIL: Gatway authentication failed.

  • CONN-KEY-ERROR: Hostkey mismatch.

  • CONN-USER-MAPPING-FAIL: Usermapping failed.

  • DENY: Denied.

  • FOUR-EYES-DEFERRED: Waiting for remote username.

  • FOUR-EYES-ERROR: Internal error during four-eyes authorization.

  • FOUR-EYES-REJECT: Four-eyes authorization rejected.

  • FOUR-EYES-TIMEOUT: Four-eyes authorization timed out.

window_title_extracted boolean

The value is true if the window title and the command has been extracted real-time (during alerting) so that the indexer service does not have to extract them again. It is false if they will be extracted only during indexing.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating