Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 7.3 - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing IPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving Cleaning up audit data Using plugins Forwarding data to third-party systems Starling integration
User management and access control
Login settings Managing One Identity Safeguard for Privileged Sessions (SPS) users locally Setting password policies for local users Managing local user groups Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database Authenticating users to a RADIUS server Authenticating users with X.509 certificates Authenticating users with SAML2 Managing user rights and usergroups Creating rules for restricting access to search audit data Displaying the privileges of users and user groups Listing and searching configuration changes
Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received Using UPN usernames in audited SSH connections
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Configuring advanced routing on Sophos UTM (formerly Astaro Security Gateway) firewalls

The following describes how to configure a Sophos UTM firewall to redirect selected traffic to One Identity Safeguard for Privileged Sessions (SPS) instead of its original destination. Interface 1 will be referred to as 'Internal' and Interface 2 will be referred to as 'ServerFarm'.

To configure a Sophos UTM firewall to redirect selected traffic to SPS instead of its original destination

  1. On the Policy Routes tab of the Sophos UTM firewall, click New Policy Route.

  2. Figure 395: New Policy Route

    In the dialog box, enter the following settings:

    • Position: Set the position number, defining the priority of the policy route. Lower numbers have higher priority. Routes are matched in ascending order. Once a route has been matched, routes with a higher number will not be evaluated anymore.

    • Route Type: Select Gateway route. Packets will be sent to a particular host (gateway).

    • Source Interface: Select Internal. This is the interface where the data packet to be routed arrives from.

    • Source Network: Select Internal (Network). This is the source network of the data packets to be routed.

    • Service: Select Microsoft Remote Desktop Protocol. This is the service definition that matches the data packet to be routed.

    • Destination Network: Select ServerFarm (Network). This is the destination network of the data packets to be routed.

    • Gateway: Select the IP address of SPS. This is the router where the gateway will forward data packets to.

    • Comment: Optionally, enter a description or other information.

  3. Click Save.

  4. Click the status icon to activate the route.

  5. Navigate to Definitions & Users > Service Definitions and click New Service Definition.

  6. Figure 396: New Service Definition

    In the dialog box, enter the following settings. It will ensure that the policy will apply to all TCP/3389:

    • Name: Enter a descriptive name for the definition (for example Microsoft Remote Desktop Protocol).

    • Type of Definition: Select TCP. This is the service type.

      NOTE: The definition type cannot be changed after saving the definition. To change the definition type, delete the service definition and create a new one with the desired settings.

    • Destination port: Enter 3389. This is the destination port that can either be entered as a single port number (for example 80), or as a port range, using a colon as delimiter (for example 1024:64000).

    • Source port: Enter 1:65535. This is the source port that can either be entered as a single port number (for example 80), or as a port range, using a colon as delimiter (for example 1024:64000).

    • Comment: Optionally, enter a description or other information.

  7. Click Save. The new definition appears in the service definition list.

    With this step, the client-server routing is configured.

  8. To configure the server-client routing, create another policy route, and In the dialog box, enter the following settings:

    • Position: Set the position number, defining the priority of the policy route. Lower numbers have higher priority. Routes are matched in ascending order. Once a route has been matched, routes with a higher number will not be evaluated anymore.

    • Route Type: Select Gateway route. Packets will be sent to a particular host (gateway).

    • Source Interface: Select ServerFarm. This is the interface where the data packet to be routed arrives from.

    • Source Network: Select ServerFarm (Network). This is the source network of the data packets to be routed.

    • Service: Select 3389. This is the service definition that matches the data packet to be routed.

    • Destination Network: Select Internal (Network). This is the destination network of the data packets to be routed.

    • Gateway: Select the IP address of SPS. This is the router where the gateway will forward data packets to.

    • Comment: Optionally, enter a description or other information.

Using SCP with agent-forwarding

When the client uses SSH to access a target server via One Identity Safeguard for Privileged Sessions (SPS) and authenticates with the public keys, the SPS Authentication Policy has Public key > Agent configured on the server-side. If the client supports agent-forwarding, this works well. However, scp does not: it always adds the -a option to the command-line to disable agent-forwarding. Explicitly allowing agent-forwarding with the -A or the -oForwardAgent yes command-line option, or writing ForwardAgent yes into the configuration has no effect, because the implicit -a at the end of the command-line takes precedence.

Solution 1: Use a wrapper script

The scp application can be started with the -S option to use an external application to create the encrypted connection. On Linux and UNIX platforms, this external application can be, for example, the following script that removes the unnecessary option from the scp command line.

#!/usr/bin/perl
exec '/usr/bin/ssh', '-A', map {$_ eq '-oForwardAgent=no' ? ( ) : $_} @ARGV

If you want your clients to use this script transparently, you can create an alias for it with the following command:

alias scp='scp -S <path-to-the-script-on-the-client>'
Solution 2: Use ssh master-channels

This solution relies on sending scp through an SSH master-control channel. In this case, scp does not need agent-forwarding, because it is already performed during the ControlMaster setup. The advantage of this solution is that the scp connection is setup quickly, because no authentication is needed, since the connection is already open. The disadvantage is that first a ControlMaster connection must be opened to the target host using the following command:

ssh -M -S /tmp/<address-of-the-target-server> <address-of-the-target-server>

When staring scp, reference the control path created with the previous command:

scp -oControlPath=/tmp/<address-of-the-target-server> [[user@]host1:]file1 ... [[user@]host2:]file2
Solution 3: Patch the scp source

You can simply patch the scp source to overcome the problem, but then you need to recompile and re-install scp on every platform you use in your environment. The following is a sample patch for openssh-5.6p1:

--- scp-org.c    2010-07-02 05:37:33.000000000 +0200
+++ scp-new.c    2010-09-08 17:56:33.000000000 +0200
@@ -339,7 +339,6 @@
     args.list = NULL;
     addargs(&args, "%s", ssh_program);
     addargs(&args, "-x");
-    addargs(&args, "-oForwardAgent no");
     addargs(&args, "-oPermitLocalCommand no");
     addargs(&args, "-oClearAllForwardings yes");
Solution 4: Use fix or mapped keys on server-side

This is not agent-forwarding anymore, but scp still can use keys. Instead of passing the user-keys to the target server, SPS can authenticate on the server using a fix key, or a separate key for every user. Setting the server-side keys on SPS (or fetching them from LDAP), has the following advantages:

  • The user cannot bypass SPS and directly connect to the target server

  • Key-handling in the server environment becomes much simpler, because you do not have to import the user-keys to every host (if this is done locally, without a central identity management system)

For details on configuring server-side keys on SPS, see Relayed authentication methods.

Solution 5: WinSCP and agent-forwarding

WinSCP is a common tool for Windows to transfer files using SFTP/SCP. To use agent-forwarding in WinSCP, enable it in the SSH > Authentication options and load your keys.

Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS)

The following checklist is a set of recommendations and configuration best practices to ensure that your One Identity Safeguard for Privileged Sessions (SPS) is configured securely.

Topics:

Encryption-related settings

  • TIP: One Identity recommends using 2048-bit RSA keys (or stronger).

  • Use strong passwords: at least 8 characters that include numbers, letters, special characters, and capital letters. For local One Identity Safeguard for Privileged Sessions (SPS) users, require the use of strong passwords (set Users & Access Control > Login options > Minimal password strength to strong). For more information, see "Setting password policies for local users" in the Administration Guide.

  • When exporting the configuration of SPS, or creating configuration backups, always use encryption. Handle the exported data with care, as it contains sensitive information, including credentials. For details on encrypting the configuration, see "Encrypting configuration backups with GPG" in the Administration Guide.

  • Use every keypair or certificate only for one purpose. Do not reuse cryptographic keys or certificates (for example, do not use the certificate of the One Identity Safeguard for Privileged Sessions (SPS) webserver to encrypt audit trails, or the same keypair for signing and encrypting data).

  • Do not use the CBC block cipher mode, or the diffie-hellman-group1-sha1 key exchange algorithm. For details, see "Supported encryption algorithms" in the Administration Guide.

  • Always encrypt your audit trails to protect sensitive data. For details, see "Encrypting audit trails" in the Administration Guide.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating