Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 8.0 LTS - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing IPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving Cleaning up audit data Using plugins Forwarding data to third-party systems Starling integration
User management and access control
Login settings Managing One Identity Safeguard for Privileged Sessions (SPS) users locally Setting password policies for local users Managing local user groups Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database Handling user names in User Principal Name (UPN) format Authenticating users to a RADIUS server Authenticating users with X.509 certificates Authenticating users with SAML2 Managing user rights and user groups Creating rules for restricting access to search audit data Displaying the privileges of users and user groups Listing and searching configuration changes
Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Sessions interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)

One Identity Safeguard for Privileged Sessions (SPS) has a web interface and is configured from a browser. The users of SPS can be authenticated using local, LDAP, or RADIUS databases. The privileges of users are determined by group memberships that can be managed either locally on SPS, or centrally in an LDAP database. Assigning privileges to groups is based on Access Control Lists (ACLs). It is also possible to match groups existing in the LDAP database to a set of SPS privileges. Access control in SPS is very granular, therefore it is possible to define exactly who can access which parts of the interface and of the stored data.

Figure 17: Authenticating the users of SPS

Configuration lock on the SPS web interface

When there is another user logged in to SPS, making configuration changes on legacy pages of the web interface, the configuration lock feature is automatically switched on. During this time, you cannot edit configuration parameters and commit changes on these legacy pages of the web interface. For example, you cannot edit the Type of your ACL objects, and certain UI elements will be grayed out or do not respond the same way as they do while the configuration lock is not activated. This state will stay active until the configuration lock is released by the user making configuration changes or until the user logs out of SPS.

TIP: If UI elements do not respond the way they usually do in SPS, check if there is a similar banner near the top of the web interface:

Cloud deployment considerations

One Identity Safeguard for Privileged Sessions (SPS) can be run from the cloud.

Before you start: platforms and resources

When setting up a virtual environment, carefully consider the configuration aspects such as CPU, memory availability, I/O subsystem, and network infrastructure to ensure the virtual layer has the necessary resources available. For more information on environment virtualization, see One Identity's Product Support Policies.

Platforms that have been tested with the cloud deployments are:

AWS deployment

One Identity Safeguard for Privileged Sessions (SPS) can be run in the cloud using Amazon Web Services (AWS).

To deploy the Amazon Machine Image (AMI) of SPS from AWS, visit the AWS marketplace listing for SPS (here) and follow the Deployment steps .

Limitations

  • If High Availability (HA) operation mode is required in a virtual environment, use the HA function provided by the virtual environment.

  • When running SPS in a virtual environment, use a single network interface.

  • During AWS installation, connecting directly to the Internet using a public IP address is not supported. Instead, you must access the Internet via a Virtual Private Network or a jump host.

  • Factory reset is not an option for virtual appliances. To factory reset a virtual appliance, just redeploy the appliance.

Disk size considerations

CAUTION: Before making any changes to the disk size, shut down the VM (stopped and deallocated).

SPS deploys with a minimal OS disk size. You should increase the size of the OS disk based on your estimated usage and budget.

To have your appliance set with the correct disk size, you must resize the OS disk right after creating the VM (after the Welcome Wizard finishes).

  1. Log in via SSH or Amazon Elastic Compute Cloud (Amazon EC2) serial console. For more information, see Getting Started with Amazon EC2.

  2. To resize the disk volume, select Troubleshooting > Extend core partition. For more information, see Modifying the disk size of an SPS virtual appliance in the Installation Guide.

  3. Repeat steps 1 and 2 if you want to resize SPS again later.

AWS security considerations

Running SPS in AWS comes with some security considerations that do not apply to the hardware appliance. One Identity recommends:

  • Do not give Safeguard a public IP address.
  • Use the AWS key vault to encrypt the disk.

  • Limit access within AWS to the Safeguard virtual machine. SPS in AWS cannot protect against rogue Administrators in the same way the hardware appliance can.

Static IP address required

Configure the SPS VM with a static IP address in AWS. In AWS, the IP address must not change after the VM is deployed. If you need to change the IP address, take a backup, deploy again, and restore the backup. You can script the VM deploy to pick up an existing virtual NIC with the IP address configuration. For details, see the Amazon Virtual Private Cloud (VPC) documentation.

Deployment steps

AWS automatically licenses the operating system during the deployment with an AWS KMS.

To deploy SPS in AWS

  1. Open the AWS marketplace listing for SPS.

  2. On the One Identity Safeguard for Privileged Sessions page, click Continue to Subscribe.

  3. To configure your instance, advance through the resource creation screens. In addition to the Disk size considerations, AWS security considerations , and Static IP address required , One Identity recommends you select the instance type according to the intended usage:

    • m5.xlarge for standard usage.

    • m5.2xlarge or m5.4xlarge for heavy usage.

    • c5.2xlarge, c5.4xlarge or c6.8xlarge compute-optimized instances, if your traffic consists of heavy audit trails (for example, RDP or ICA).

    • r5.large or r5.2xlarge memory-optimized instances, if you need better performance with large Search databases, or when deploying search masters. Alternatively, consider using instances with similar specifications from the r5a, r5b, r5n, r6i classes, and so on.

    NOTE: SPS supports enhanced networking capabilities through the Elastic Network Adapter (ENA) on AWS.

    For the list of instance types that support ENA, see table Summary of networking and storage features in chapter Instance types of the Amazon EC2 documentation.

    For more information on ENA, see Enhanced networking: ENA in the Amazon EC2 documentation.

    1. To enable enhanced networking through ENA for your SPS instance, select an instance type that supports ENA.

  4. Once you have finished configuring the instance, select and launch it.

    NOTE: The instance launch process may take a few minutes to complete.

  5. Once the instance has finished launching, complete the SPS Welcome Wizard. While advancing through the SPS Welcome Wizard, you can create the admin password. For more information, see The Welcome Wizard and the first login.

    NOTE: Ensure that you upgrade SPS to the latest available release. For more information, see the Upgrade Guide.

Azure deployment

The following describes how to have a One Identity Safeguard for Privileged Sessions running in Microsoft Azure.

To have a One Identity Safeguard for Privileged Sessions running in Microsoft Azure

  1. Deploy One Identity Safeguard for Privileged Sessions from the Microsoft Azure Marketplace

    Create and configure a One Identity Safeguard for Privileged Sessions virtual machine (VM) in the Azure portal. For more information, see the Microsoft Azure documentation, here we just describe the SPS-specific settings.

    1. Login to the Azure portal, select One Identity Safeguard for Privileged Sessions from the Azure Marketplace, then click Create.

    2. Fill the required fields of the Basics blade. Note that you must fill the User name and Authentication Password/SSH public key fields, but SPS will not actually use these settings (SPS will use the parameters you configure in the SPS Welcome Wizard).

    3. Choose a size for the VM. If you want to use this machine in production and need help about sizing or architecture design, contact your One Identity sales representative.

      The number of interfaces you can use depends on the size of your Azure VM. If your VM allows you to use multiple interfaces, you can configure multiple interfaces in SPS. For details, see VM with multiple NICs.

    4. On the Settings blade, disable monitoring.

    5. When the deployment is finished, navigate to the network settings of the new VM in the Azure portal. Change the IP address of the SPS network interface to Static, and note down the IP address and the hostname (you will need it in the SPS Welcome Wizard).

    6. If you want to backup or archive data from SPS into Azure, create an Azure File Share. Note down the following information of the file share, because you will need it to configure SPS backups and archiving: URL, Username, Password.

      		 Caution:

      If you have multiple SPS VMs, make sure to use a separate file share for each SPS.

  2. Complete the SPS Welcome Wizard

    Complete the SPS Welcome Wizard (for more information, see Configuring One Identity Safeguard for Privileged Sessions (SPS) with the Welcome Wizard in the Administration Guide). Note the following points specific for Azure deployments. When configuring the network settings of SPS note the following points.

    		 Caution:

    Do not export or import configuration between a physical SPS deployment and a virtual one. Because of the differences and limitations between physical and virtual appliances, configure the virtual appliance from scratch to ensure proper functionality. When you migrate a virtual SPS to another one, you can export and import the configuration.

    1. Into the Physical interface EXT or 1 — IP address field, enter the static IP address of the SPS VM that you set on the Azure portal.

    2. Default GW: The default gateway is usually the first address in a subnet (for example, if your subnet is 10.7.0.0/24, then the gateway will be 10.7.0.1).

    3. Hostname: Use the hostname you have configured for the SPS VM on the Azure portal.

    4. DNS server: You can use any DNS server that the SPS VM can access, even public ones.

  3. Configure SPS

    Login to SPS and configure it.

    1. Configure backups for SPS. For backup and archiving purposes One Identity recommends the built-in file shares of Azure. For more information on configuring backups, see Data and configuration backups in the Administration Guide.

    2. Configure archiving for SPS. For backup and archiving purposes One Identity recommends the built-in file shares of Azure. For more information on configuring backups, see Archiving in the Administration Guide. Configuring Archiving policy is highly recommended: because if the disk of the VM fills up, SPS stops working.

    3. Configure a server: set up a host that is on the same subnet as SPS, and enable Remote Desktop (RDP) or Secure Shell (SSH) access to it.

    4. Configure a connection on SPS to forward the incoming RDP or Secure Shell (SSH) connection to the host and establish a connection to the host. For more information, see Logging in to One Identity Safeguard for Privileged Sessions (SPS) and configuring the first connection in the Administration Guide.

    5. Replay your session in the browser. For more information, see Replaying audit trails in your browser in the Administration Guide.

      In case you have questions about SPS, or need assistance, contact your One Identity representative.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating