Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 7.5 - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing IPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving Cleaning up audit data Using plugins Forwarding data to third-party systems Starling integration
User management and access control
Login settings Managing One Identity Safeguard for Privileged Sessions (SPS) users locally Setting password policies for local users Managing local user groups Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database Authenticating users to a RADIUS server Authenticating users with X.509 certificates Authenticating users with SAML2 Managing user rights and usergroups Creating rules for restricting access to search audit data Displaying the privileges of users and user groups Listing and searching configuration changes
Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received Using UPN usernames in audited SSH connections
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Preventing disk space fill-up

The following describes how to prevent disk space from filling up.

NOTE: One Identity highly recommends this if One Identity Safeguard for Privileged Sessions (SPS) is hosted in a virtual environment.

To prevent disk space from filling up

  1. Navigate to Basic Settings > Management > Disk space fill-up prevention.

    Figure 64: Basic Settings > Management > Disk space fill-up prevention — Preventing disk space fill-up

  2. Enter the limit of maximum disk utilization in percents in the Disconnect clients when disks are: x percent used field. Make sure to enter a value between 50-98 percent. When disk space is used above the configured limit, SPS disconnects all clients. The default value is 80.

  3. (Optional) To automatically start all configured archiving/cleanup jobs when disk usage goes over the limit, select the Automatically start archiving option.

    For more information on configuring an archiving policy, see Archiving.

    NOTE: If there is no archiving policy configured, selecting this option will not trigger automatic archiving.

  4. Click .

  5. Navigate to Basic Settings > Alerting & Monitoring > Health monitoring and enable alert Disk utilization maximum.

  6. Click .

System related traps

SPS can send the following system related alerts in e-mail or as SNMP trap. To configure these alerts, see Configuring e-mail alerts and Configuring SNMP alerts.

NOTE:

Configure Disk space fill-up prevention, and configure SPS to send an alert if the free space on the disks of SPS is low. For details, see Preventing disk space fill-up in the Administration Guide.

Configure SPS to send an alert if a user fails to login to SPS. For details, see the Login failed alert in System related traps in the Administration Guide.

Figure 65: Basic Settings > Alerting & Monitoring — health monitoring

Table 1: System related traps
Name SNMP alert ID Description
Login failed xcbLoginFailure Failed login attempts from SPS web interface.
Successful login xcbLogin Successful login attempts into SPS web interface.
Logout from the management interface xcbLogout Logouts from SPS web interface.
Configuration changed xcbConfigChange Any modification of SPS's configuration.
General alert xcbAlert

General alerts and error messages occurring on SPS.

Note that alerts on general alerts and errors are sent whenever there is an alert or error level message in the SPS system log. These messages are very verbose and mainly useful only for debugging purposes.

Enabling these alerts may result in multiple e-mails or SNMP traps sent about the same event.

 

General error xcbError
Data and configuration backup failed xcbBackupFailed Alerts if the backup procedure is unsuccessful.
Data archiving failed xcbArchiveFailed Alerts if the archiving procedure is unsuccessful.
Database error occurred xcbDBError An error occurred in the database where SPS stores the connection metadata. For assistance, contact our Support Team.
License limit reached xcbLimitReached The number of protected servers (or concurrent sessions) reached the limit set in the SPS license. Clients cannot connect to new servers using SPS.
HA node state changed xcbHaNodeChanged A node of the SPS cluster changed its state (for example, a takeover occurred).
Timestamping error occurred xcbTimestampError An error occurred during the timestaming process (for example, the timestamping server did not respond).
Time sync lost xcbTimeSyncLost The system time became out of sync.
Raid status changed xcbRaidStatus The status of the node's RAID device changed its state.
Hardware error occurred xcbHWError SPS detected a hardware error.
Firmware error occured xcbFirmwareError

SPS detected a firmware error, which can be as follows:

  • Corrupted: The firmware integrity check failed. If a firmware is shown as corrupted, contact our Support Team.
  • Tainted: It indicates that you have modified a file of the firmware locally. If you have modified a local file unintentionally, contact our Support Team.
Too many login attempts xcbBruteforceAttempt SPS has detected a possible brute-force attack.
License expires soon xcbLicenseAlmostExpired Your SPS license will expire within 60 days.
A system service failed xcbInitSystemUnitFailed

A system service has failed.

Note that one alert is sent for each failed service.

Random generator error occurred xcbRandomGeneratorError

The random generator repeatedly created the same byte sequence. To fix this issue, you can restart your SPS. If the error persists, contact our Support Team.

Traffic related traps

SPS can send the following traffic related alerts in e-mail or as SNMP trap. To configure these alerts, see Configuring e-mail alerts and Configuring SNMP alerts.

Figure 66: Basic Settings > Alerting & Monitoring — health monitoring

Table 2: Traffic related traps
Name SNMP alert ID Description
Channel opening denied scbChannelDenied A user attempted to open a channel not permitted by the channel policy.
Connection denied scbConnectionDenied A user attempted to connect a server not permitted in the connection policies.
User successfully authenticated scbAuthSuccess A user successfully authenticated on a protected server.
User authentication failed scbAuthFailure A user failed to complete the authentication on a protected server.
SSH host key mismatch scbSshHostKeyMismatch The SSH host key of a server did not match the key stored on SPS.
New SSH host key learned scbHostKeyLearned SPS learned a new SSH host key.
Connection timed out scbConnectionTimedout A connection to a protected server timed out.
Protocol violation scbProtocolViolation A connection violated the protocol as specified in the RFC or protocol documentation. This may have been caused by an incompatible application or a deliberate attack.
Connection to the server failed scbConnectionFailed A connection to a protected server failed.
User successfully authenticated on the gateway scbGWAuthSuccess A user has successfully authenticated a connection on SPS as part of a gateway-authentication process.
User authentication failed on the gateway scbGWAuthFailure The gateway-authentication of a connection has failed.
User mapping failed on the gateway scbUserMappingFailure A usermapping policy did not find a suitable mapping for the connection.
Decryption of a credential store failed scbCredStoreDecrpytError SPS could not unlock a password-protected Credential Store. Navigate to User menu > Unlock Credential Store and enter the password(s) to open the Credential Store.
The requested credential store is closed scbCredStoreClosed A user attempted to access a connection policy that uses a password-protected Credential Store, and the Credential Store has not been unlocked. Navigate to User menu > Unlock Credential Store and enter the password(s) to open the Credential Store.
Failed to unlock credential store scbCredStoreUnlockFailure A user attempted to unlock a password-protected Credential Store with an incorrect password. Navigate to User menu > Unlock Credential Store and enter the correct password(s) to open the Credential Store.
Real time audit event detected scbRealTimeAlert A real-time audit event has occurred.
AMQP error occurred scbAMQPError An error occurred in the event queue where SPS forwards session data. contact our Support Team.

Data and configuration backups

Backups create a snapshot of the configuration of One Identity Safeguard for Privileged Sessions (SPS) or the data which can be used for recovery in case of errors. SPS can create automatic backups of its configuration and the stored audit-trails to a remote server.

Configuring backups is a two-step process:

  1. Create a backup policy.

  2. Assign that policy to the system or a connection — depending on what it is that you wish to back up, SPS's configuration or a connection.

Creating a backup policy

Backup policies define the address of the backup server, which protocol to use to access it, and other parameters. SPS can be configured to use the Rsync, SMB/CIFS, and NFS protocols to access the backup server:

The different backup protocols assign different file ownerships to the files saved on the backup server. The owners of the backup files created using the different protocols are the following:

  • Rsync: The user provided on the web interface.

  • SMB/CIFS: The user provided on the web interface.

  • NFS: root with no-root-squash, nobody otherwise.

 Caution:

SPS cannot modify the ownership of a file that already exists on the remote server. If you change the backup protocol but you use the same directory of the remote server to store the backups, make sure to adjust the ownership of the existing files according to the new protocol. Otherwise SPS cannot overwrite the files and the backup procedure fails.

Assigning a backup policy

Once you have configured a backup policy, set it as a system backup policy (for configuration backups) or data backup policy (for connections backups):

NOTE: Backup deletes all other data from the target directory. Restoring a backup deletes all other data from SPS. For details on restoring configuration and data from backup, see Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data to the same SPS appliance.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating