Preface
Introduction
The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS)
Policies
Credential Stores
Plugin framework
Indexing
Supported protocols and client applications
The Welcome Wizard and the first login
HTTP
Secure Shell Protocol
Remote Desktop Protocol
ICA
Telnet
Remote Desktop Gateway Server Protocol (RDGSP)
Virtual Network Computing
VMware Horizon View
Modes of operation
Transparent mode
Single-interface transparent mode
Non-transparent mode
Inband destination selection
Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS)
Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) using SSH
Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) using RDP
Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) using an RD Gateway
Archive and backup concepts
Configuration export
System backup
Connection backup
Connection archive
Support bundle
Debug logs
Connection logs
Core dump files
Maximizing the scope of auditing
IPv6 in One Identity Safeguard for Privileged Sessions (SPS)
SSH hostkeys
Authenticating clients using public-key authentication in SSH
The gateway authentication process
Four-eyes authorization
Network interfaces
High Availability support in One Identity Safeguard for Privileged Sessions (SPS)
Versions and releases of One Identity Safeguard for Privileged Sessions (SPS)
Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
The initial connection to One Identity Safeguard for Privileged Sessions (SPS)
Basic settings
Creating an alias IP address (Microsoft Windows)
Creating an alias IP address (Linux)
Modifying the IP address of One Identity Safeguard for Privileged Sessions (SPS)
Accessing the Welcome Wizard from a non-standard interface
Configuring One Identity Safeguard for Privileged Sessions (SPS) with the Welcome Wizard
Logging in to One Identity Safeguard for Privileged Sessions (SPS) and configuring the first connection
Supported web browsers and operating systems
The structure of the web interface
Network settings
User management and access control
Configuring user and administrator login addresses
Managing logical interfaces
Routing uncontrolled traffic between logical interfaces
Configuring the routing table
Configuring date and time
System logging, SNMP and e-mail alerts
Configuring system logging
Configuring e-mail alerts
Configuring SNMP alerts
Querying SPS status information using agents
Customize system logging in One Identity Safeguard for Privileged Sessions (SPS)
Configuring system monitoring on SPS
Configuring monitoring
Health monitoring
Preventing disk space fill-up
System related traps
Traffic related traps
Data and configuration backups
Creating a backup policy using Rsync over SSH
Creating a backup policy using SMB/CIFS
Creating a backup policy using NFS
Creating configuration backups
Creating data backups
Encrypting configuration backups with GPG
Archiving and cleanup
Creating a cleanup policy
Creating an archive policy using SMB/CIFS
Creating an archive policy using NFS
Archiving or cleaning up the collected data
Forwarding data to third-party systems
Joining to One Identity Starling
Managing One Identity Safeguard for Privileged Sessions (SPS) users locally
Managing One Identity Safeguard for Privileged Sessions (SPS)
Creating local users in One Identity Safeguard for Privileged Sessions (SPS)
Deleting a local user from One Identity Safeguard for Privileged Sessions (SPS)
Setting password policies for local users
Managing local usergroups
Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database
Authenticating users to a RADIUS server
Authenticating users with X.509 certificates
Managing user rights and usergroups
Assigning privileges to usergroups for the One Identity Safeguard for Privileged Sessions (SPS) web interface
Modifying group privileges
Finding specific usergroups
Using usergroups
Built-in usergroups of One Identity Safeguard for Privileged Sessions (SPS)
Listing and searching configuration changes
Displaying the privileges of users and user groups
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown
Managing Safeguard for Privileged Sessions (SPS) clusters
General connection settings
Cluster roles
Enabling cluster management
Building a cluster
Assigning roles to nodes in your cluster
Configuration synchronization across nodes in a cluster
Monitoring the status of nodes in your cluster
Updating the IP address of a node in a cluster
Managing a cluster with configuration synchronization without central search
Managing a cluster with central search configuration and configuration synchronization
Managing a high availability One Identity Safeguard for Privileged Sessions (SPS) cluster
HA cluster configuration and management options
Adjusting the synchronization speed
Redundant heartbeat interfaces
Next-hop router monitoring
Upgrading One Identity Safeguard for Privileged Sessions (SPS)
Upgrade checklist
Upgrading One Identity Safeguard for Privileged Sessions (SPS) (single node)
Upgrading a high availability One Identity Safeguard for Privileged Sessions (SPS) cluster
Troubleshooting
Exporting the configuration of One Identity Safeguard for Privileged Sessions (SPS)
Importing the configuration of One Identity Safeguard for Privileged Sessions (SPS)
Managing the One Identity Safeguard for Privileged Sessions (SPS) license
Accessing the One Identity Safeguard for Privileged Sessions (SPS) console
Using the console menu of One Identity Safeguard for Privileged Sessions (SPS)
Enabling SSH access to the One Identity Safeguard for Privileged Sessions (SPS) host
Changing the root password of One Identity Safeguard for Privileged Sessions (SPS)
Firmware update using SSH
Exporting and importing the configuration of One Identity Safeguard for Privileged Sessions (SPS) using the console
Sealed mode
Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS)
Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
Generating certificates for One Identity Safeguard for Privileged Sessions (SPS)
Uploading external certificates to One Identity Safeguard for Privileged Sessions (SPS)
Generating TSA certificate with Windows Certificate Authority on Windows Server 2008
Generating TSA certificate with Windows Certificate Authority on Windows Server 2012
Configuring connections
Modifying the destination address
Configuring inband destination selection
Modifying the source address
Creating and editing channel policies
Real-time content monitoring with Content Policies
Configuring time policies
Creating and editing user lists
Authenticating users to an LDAP server
Audit policies
HTTP-specific settings
Encrypting audit trails
Timestamping audit trails with built-in timestamping service
Timestamping audit trails with external timestamping service
Digitally signing audit trails
Verifying certificates with Certificate Authorities
Signing certificates on-the-fly
Creating a Local User Database
Configuring cleanup for the One Identity Safeguard for Privileged Sessions (SPS) connection database
Limitations in handling HTTP connections
Authentication in HTTP and HTTPS
Creating a new HTTP authentication policy
Setting up HTTP connections
ICA-specific settings
Setting up a transparent HTTP connection
Enabling One Identity Safeguard for Privileged Sessions (SPS) to act as a HTTP proxy
Enabling TLS encryption in HTTP
Configuring half-sided SSL encryption in HTTP
Session-handling in HTTP
Creating and editing protocol-level HTTP settings
Setting up ICA connections
Supported ICA channel types
Creating and editing protocol-level ICA settings
One Identity Safeguard for Privileged Sessions (SPS) deployment scenarios in a Citrix environment
Troubleshooting Citrix-related problems
RDP-specific settings
Supported RDP channel types
Creating and editing protocol-level RDP settings
Network Level Authentication (NLA) with One Identity Safeguard for Privileged Sessions (SPS)
SSH-specific settings
Network Level Authentication (NLA) with domain membership
Using One Identity Safeguard for Privileged Sessions (SPS) across multiple domains
Network Level Authentication without domain membership
Verifying the certificate of the RDP server in encrypted connections
Enabling TLS-encryption for RDP connections
Using One Identity Safeguard for Privileged Sessions (SPS) as a Remote Desktop Gateway
Configuring Remote Desktop clients for gateway authentication
Inband destination selection in RDP connections
Usernames in RDP connections
Saving login credentials for RDP on Windows
Configuring RemoteApps
Configuring SPS to enable exporting files from audit trails after RDP file transfer via clipboard
Setting the SSH host keys of the connection
Supported SSH channel types
Authentication Policies
Telnet-specific settings
Creating a new authentication policy
Client-side authentication settings
Relayed authentication methods
Configuring your Kerberos environment
Kerberos authentication settings
Server host keys
Automatically adding the host keys of a server to One Identity Safeguard for Privileged Sessions (SPS)
Manually adding the host key of a server
Creating and editing protocol-level SSH settings
Supported encryption algorithms
Enabling TLS-encryption for Telnet connections
Creating a new Telnet authentication policy
Extracting username from Telnet connections
Creating and editing protocol-level Telnet settings
Inband destination selection in Telnet connections
Limitations of using TN5250 protocol with IBM iSeries Access for Windows
VMware Horizon View connections
VNC-specific settings
Indexing audit trails
Configuring the internal indexer
Configuring external indexers
Using the Search interface
Prerequisites and limitations
Hardware requirements for the external indexer host
Configuring One Identity Safeguard for Privileged Sessions (SPS) to use external indexers
Installing the external indexer
Configuring the external indexer
Uploading decryption keys to the external indexer
Configuring a hardware security module (HSM) or smart card to integrate with external indexer
Monitoring the status of the indexer services
HTTP indexer configuration format
Setting up and testing the environment
Encrypting a PKCS#11 PIN
Starting and restarting the external-indexer service when using a custom password for PKCS#11 PIN encryption
Configuring SoftHSM
Configuring AWS CloudHSM
Configuring a smart card
Customizing the indexing of HTTP traffic
Starting the external indexer
Disabling indexing on One Identity Safeguard for Privileged Sessions (SPS)
Managing the indexers
Upgrading the external indexer
Troubleshooting external indexers
Search Permissions
Specifying time ranges
Using search filters
Searching in the contents of audit trails
Displaying statistics on search results
Analyzing data using One Identity Safeguard for Privileged Analytics
The search and filter process
Viewing session details
Replaying audit trails in your browser
Replaying encrypted audit trails in your browser
Creating report subchapters from search queries
Searching session data on a central node in a cluster
Advanced authentication and authorization techniques
Creating search-based report subchapters from search results
Creating search-based report subchapters from scratch
Search interface changes between version 5.0 and 6.0
Configuring usermapping policies
Configuring gateway authentication
Reports
Configuring out-of-band gateway authentication
Performing out-of-band gateway authentication on One Identity Safeguard for Privileged Sessions (SPS)
Performing inband gateway authentication in SSH and Telnet connections
Performing inband gateway authentication in RDP connections
Troubleshooting gateway authentication
Configuring four-eyes authorization
Configuring four-eyes authorization
Performing four-eyes authorization on One Identity Safeguard for Privileged Sessions (SPS)
Using credential stores for server-side authentication
Configuring local Credential Stores
Performing gateway authentication to RDP servers using local Credential Store and NLA
Configuring password-protected Credential Stores
Unlocking Credential Stores
Using a custom Credential Store plugin to authenticate on the target hosts
Integrating external authentication and authorization systems
How Authentication and Authorization plugins work
Using a custom Authentication and Authorization plugin to authenticate on the target hosts
Performing authentication with AA plugin in terminal connections
Performing authentication with AA plugin in Remote Desktop connections
Integrating ticketing systems
Creating a custom plugin
Plugin troubleshooting
Contents of the operational reports
Configuring custom reports
Creating reports from audit trail content
Creating report subchapters from search queries
The One Identity Safeguard for Privileged Sessions (SPS) RPC API
Creating search-based report subchapters from search results
Creating search-based report subchapters from scratch
Creating statistics from custom database queries
Database tables available for custom queries
The alerting table
The aps table
The archives table
The audit_trail_downloads table
The channels table
The closed_connection_audit_channels view
The closed_not_indexed_audit_channels view
The connection_events view
The connection_occurrences view
The connections view
The events table
The file_xfer table
The http_req_resp_pair table
The indexer_jobs table
The occurrences table
The progresses table
The results table
The skipped_connections table
The usermapped_channels view
Querying trail content with the lucene-search function
Generating partial reports
Creating PCI DSS reports
Contents of PCI DSS reports
Requirements for using the RPC API
RPC client requirements
Locking One Identity Safeguard for Privileged Sessions (SPS) configuration from the RPC API
Documentation of the RPC API
Enabling RPC API access to One Identity Safeguard for Privileged Sessions (SPS)
The One Identity Safeguard for Privileged Sessions (SPS) REST API
One Identity Safeguard for Privileged Sessions (SPS) scenarios
Configuring public-key authentication on One Identity Safeguard for Privileged Sessions (SPS)
Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Configuring public-key authentication using local keys
Configuring public-key authentication using an LDAP server and a fixed key
Configuring public-key authentication using an LDAP server and generated keys
Organizing connections in non-transparent mode
Using inband destination selection in SSH connections
Using inband destination selection with PuTTY
Using inband destination selection with OpenSSH
Using inband selection and nonstandard ports with PuTTY
Using inband selection and nonstandard ports with OpenSSH
Using inband destination selection and gateway authentication with PuTTY
Using inband destination selection and gateway authentication with OpenSSH
SSH usermapping and keymapping in AD with public key
Network troubleshooting
Gathering data about system problems
Viewing logs on One Identity Safeguard for Privileged Sessions (SPS)
Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS)
Collecting logs and system information for error reporting
Support hotfixes
Status history and statistics
Using SPS with SPP
Configuring external devices
Connection statistics
Memory
Disk
CPU
Network connections
Interface
Load average
Number of processes
Displaying custom connection statistics
Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster
Understanding One Identity Safeguard for Privileged Sessions (SPS) cluster statuses
Recovering One Identity Safeguard for Privileged Sessions (SPS) if both nodes broke down
Recovering from a split brain situation
Replacing a HA node in a One Identity Safeguard for Privileged Sessions (SPS) cluster
Resolving an IP conflict between cluster nodes
Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status
Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data
VNC is not working with TLS
Configuring the IPMI interface from the BIOS after losing IPMI password
Incomplete TSA response received
Using UPN usernames in audited SSH connections
Configuring advanced routing on Linux
Configuring advanced routing on Cisco routers
Configuring advanced routing on Sophos UTM (formerly Astaro Security Gateway) firewalls
Using SCP with agent-forwarding
Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS)
Jumplists for in-product help
Basic Settings > Management
Basic Settings > Local Services
Basic Settings > System
<Protocol name> Control > Global Options
LDAP user and group resolution in SPS
Appendix: Deprecated features
Deprecated: Using the Search (classic) interface
Glossary
Searching audit trails: the One Identity Safeguard for Privileged Sessions (SPS) connection database
Connection details
Replaying audit trails in your browser in Search (classic)
Replaying encrypted audit trails in your browser
Using the content search
Connection metadata
Using and managing search filters
The search and filter process
Displaying statistics on search results
Upgrade checklist
The following list applies to all configurations:
-
You have created a configuration backup of One Identity Safeguard for Privileged Sessions (SPS).
For detailed instructions, refer to Exporting the configuration of One Identity Safeguard for Privileged Sessions (SPS).
-
You have a valid support portal account.
To download the required firmware file and license, you need a valid support portal account. Note that registration is not automatic, and might require up to two working days to process.
-
You have downloaded the latest SPS firmware from the Downloads page.
-
You have read the Release Notes of the firmware before updating. The Release Notes might include additional instructions specific to the firmware version.
The Release Notes are available at the Downloads page.
-
You have verified that SPS is in good condition (no issues are displayed on the System Monitor).
-
Optional: You have exported core dump files, if necessary for debugging, from Basic Settings > Troubleshooting > Core files. These files are removed during upgrade.
If you have a high availability cluster:
-
You have IPMI access to the secondary node. You can find detailed information on using the IPMI interface in the following documents:
For Safeguard Sessions Appliance 3000 and 3500, see the X9 SMT IPMI User's Guide.
-
You have verified on the Basic Settings > High Availability page that the HA status is not degraded.
If you are upgrading SPS in a virtual environment:
-
You have created a snapshot of the virtual machine before starting the upgrade process.
-
You have configured and enabled console redirection (if the virtual environment allows it).
During the upgrade, SPS displays information about the progress of the upgrade and any possible problems in the following places:
-
On the web interface of SPS, at any of the Listening addresses configured at Basic settings > Local Services > Web login (admin and user). (After booting, you are directed to the login screen of SPS.)
NOTE: If you are upgrading to version 6.0 from version 5.0.x, this feature is enabled after the first boot to version 6.0. So during the upgrade to version 6.0, you will not be able to see any upgrade logs on the web interface.
-
On the console, which you can monitor with IPMI (ILOM) or console access.
The information displayed in the browser and on the console is the same.
One Identity strongly recommends that you test the upgrade process in a non-production (virtual, and so on) environment first.
Upgrading SPS requires a reboot. We strongly suggest that you perform the upgrade on the production appliance during maintenance hours only, to avoid any potential data loss.