Preface
Introduction
The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS)
Policies
Credential Stores
Plugin framework
Indexing
Supported protocols and client applications
The Welcome Wizard and the first login
HTTP
Secure Shell Protocol
Remote Desktop Protocol
ICA
Telnet
Remote Desktop Gateway Server Protocol (RDGSP)
Virtual Network Computing
VMware Horizon View
Modes of operation
Transparent mode
Single-interface transparent mode
Non-transparent mode
Inband destination selection
Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS)
Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) using SSH
Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) using RDP
Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) using an RD Gateway
Archive and backup concepts
Configuration export
System backup
Connection backup
Connection archive
Support bundle
Debug logs
Connection logs
Core dump files
Maximizing the scope of auditing
IPv6 in One Identity Safeguard for Privileged Sessions (SPS)
SSH hostkeys
Authenticating clients using public-key authentication in SSH
The gateway authentication process
Four-eyes authorization
Network interfaces
High Availability support in One Identity Safeguard for Privileged Sessions (SPS)
Versions and releases of One Identity Safeguard for Privileged Sessions (SPS)
Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
The initial connection to One Identity Safeguard for Privileged Sessions (SPS)
Basic settings
Creating an alias IP address (Microsoft Windows)
Creating an alias IP address (Linux)
Modifying the IP address of One Identity Safeguard for Privileged Sessions (SPS)
Accessing the Welcome Wizard from a non-standard interface
Configuring One Identity Safeguard for Privileged Sessions (SPS) with the Welcome Wizard
Logging in to One Identity Safeguard for Privileged Sessions (SPS) and configuring the first connection
Supported web browsers and operating systems
The structure of the web interface
Network settings
User management and access control
Configuring user and administrator login addresses
Managing logical interfaces
Routing uncontrolled traffic between logical interfaces
Configuring the routing table
Configuring date and time
System logging, SNMP and e-mail alerts
Configuring system logging
Configuring e-mail alerts
Configuring SNMP alerts
Querying SPS status information using agents
Customize system logging in One Identity Safeguard for Privileged Sessions (SPS)
Configuring system monitoring on SPS
Configuring monitoring
Health monitoring
Preventing disk space fill-up
System related traps
Traffic related traps
Data and configuration backups
Creating a backup policy using Rsync over SSH
Creating a backup policy using SMB/CIFS
Creating a backup policy using NFS
Creating configuration backups
Creating data backups
Encrypting configuration backups with GPG
Archiving and cleanup
Creating a cleanup policy
Creating an archive policy using SMB/CIFS
Creating an archive policy using NFS
Archiving or cleaning up the collected data
Forwarding data to third-party systems
Joining to One Identity Starling
Managing One Identity Safeguard for Privileged Sessions (SPS) users locally
Managing One Identity Safeguard for Privileged Sessions (SPS)
Creating local users in One Identity Safeguard for Privileged Sessions (SPS)
Deleting a local user from One Identity Safeguard for Privileged Sessions (SPS)
Setting password policies for local users
Managing local usergroups
Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database
Authenticating users to a RADIUS server
Authenticating users with X.509 certificates
Managing user rights and usergroups
Assigning privileges to usergroups for the One Identity Safeguard for Privileged Sessions (SPS) web interface
Modifying group privileges
Finding specific usergroups
Using usergroups
Built-in usergroups of One Identity Safeguard for Privileged Sessions (SPS)
Listing and searching configuration changes
Displaying the privileges of users and user groups
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown
Managing Safeguard for Privileged Sessions (SPS) clusters
General connection settings
Cluster roles
Enabling cluster management
Building a cluster
Assigning roles to nodes in your cluster
Configuration synchronization across nodes in a cluster
Monitoring the status of nodes in your cluster
Updating the IP address of a node in a cluster
Managing a cluster with configuration synchronization without central search
Managing a cluster with central search configuration and configuration synchronization
Managing a high availability One Identity Safeguard for Privileged Sessions (SPS) cluster
HA cluster configuration and management options
Adjusting the synchronization speed
Redundant heartbeat interfaces
Next-hop router monitoring
Upgrading One Identity Safeguard for Privileged Sessions (SPS)
Upgrade checklist
Upgrading One Identity Safeguard for Privileged Sessions (SPS) (single node)
Upgrading a high availability One Identity Safeguard for Privileged Sessions (SPS) cluster
Troubleshooting
Exporting the configuration of One Identity Safeguard for Privileged Sessions (SPS)
Importing the configuration of One Identity Safeguard for Privileged Sessions (SPS)
Managing the One Identity Safeguard for Privileged Sessions (SPS) license
Accessing the One Identity Safeguard for Privileged Sessions (SPS) console
Using the console menu of One Identity Safeguard for Privileged Sessions (SPS)
Enabling SSH access to the One Identity Safeguard for Privileged Sessions (SPS) host
Changing the root password of One Identity Safeguard for Privileged Sessions (SPS)
Firmware update using SSH
Exporting and importing the configuration of One Identity Safeguard for Privileged Sessions (SPS) using the console
Sealed mode
Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS)
Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
Generating certificates for One Identity Safeguard for Privileged Sessions (SPS)
Uploading external certificates to One Identity Safeguard for Privileged Sessions (SPS)
Generating TSA certificate with Windows Certificate Authority on Windows Server 2008
Generating TSA certificate with Windows Certificate Authority on Windows Server 2012
Configuring connections
Modifying the destination address
Configuring inband destination selection
Modifying the source address
Creating and editing channel policies
Real-time content monitoring with Content Policies
Configuring time policies
Creating and editing user lists
Authenticating users to an LDAP server
Audit policies
HTTP-specific settings
Encrypting audit trails
Timestamping audit trails with built-in timestamping service
Timestamping audit trails with external timestamping service
Digitally signing audit trails
Verifying certificates with Certificate Authorities
Signing certificates on-the-fly
Creating a Local User Database
Configuring cleanup for the One Identity Safeguard for Privileged Sessions (SPS) connection database
Limitations in handling HTTP connections
Authentication in HTTP and HTTPS
Creating a new HTTP authentication policy
Setting up HTTP connections
ICA-specific settings
Setting up a transparent HTTP connection
Enabling One Identity Safeguard for Privileged Sessions (SPS) to act as a HTTP proxy
Enabling TLS encryption in HTTP
Configuring half-sided SSL encryption in HTTP
Session-handling in HTTP
Creating and editing protocol-level HTTP settings
Setting up ICA connections
Supported ICA channel types
Creating and editing protocol-level ICA settings
One Identity Safeguard for Privileged Sessions (SPS) deployment scenarios in a Citrix environment
Troubleshooting Citrix-related problems
RDP-specific settings
Supported RDP channel types
Creating and editing protocol-level RDP settings
Network Level Authentication (NLA) with One Identity Safeguard for Privileged Sessions (SPS)
SSH-specific settings
Network Level Authentication (NLA) with domain membership
Using One Identity Safeguard for Privileged Sessions (SPS) across multiple domains
Network Level Authentication without domain membership
Verifying the certificate of the RDP server in encrypted connections
Enabling TLS-encryption for RDP connections
Using One Identity Safeguard for Privileged Sessions (SPS) as a Remote Desktop Gateway
Configuring Remote Desktop clients for gateway authentication
Inband destination selection in RDP connections
Usernames in RDP connections
Saving login credentials for RDP on Windows
Configuring RemoteApps
Configuring SPS to enable exporting files from audit trails after RDP file transfer via clipboard
Setting the SSH host keys of the connection
Supported SSH channel types
Authentication Policies
Telnet-specific settings
Creating a new authentication policy
Client-side authentication settings
Relayed authentication methods
Configuring your Kerberos environment
Kerberos authentication settings
Server host keys
Automatically adding the host keys of a server to One Identity Safeguard for Privileged Sessions (SPS)
Manually adding the host key of a server
Creating and editing protocol-level SSH settings
Supported encryption algorithms
Enabling TLS-encryption for Telnet connections
Creating a new Telnet authentication policy
Extracting username from Telnet connections
Creating and editing protocol-level Telnet settings
Inband destination selection in Telnet connections
Limitations of using TN5250 protocol with IBM iSeries Access for Windows
VMware Horizon View connections
VNC-specific settings
Indexing audit trails
Configuring the internal indexer
Configuring external indexers
Using the Search interface
Prerequisites and limitations
Hardware requirements for the external indexer host
Configuring One Identity Safeguard for Privileged Sessions (SPS) to use external indexers
Installing the external indexer
Configuring the external indexer
Uploading decryption keys to the external indexer
Configuring a hardware security module (HSM) or smart card to integrate with external indexer
Monitoring the status of the indexer services
HTTP indexer configuration format
Setting up and testing the environment
Encrypting a PKCS#11 PIN
Starting and restarting the external-indexer service when using a custom password for PKCS#11 PIN encryption
Configuring SoftHSM
Configuring AWS CloudHSM
Configuring a smart card
Customizing the indexing of HTTP traffic
Starting the external indexer
Disabling indexing on One Identity Safeguard for Privileged Sessions (SPS)
Managing the indexers
Upgrading the external indexer
Troubleshooting external indexers
Search Permissions
Specifying time ranges
Using search filters
Searching in the contents of audit trails
Displaying statistics on search results
Analyzing data using One Identity Safeguard for Privileged Analytics
The search and filter process
Viewing session details
Replaying audit trails in your browser
Replaying encrypted audit trails in your browser
Creating report subchapters from search queries
Searching session data on a central node in a cluster
Advanced authentication and authorization techniques
Creating search-based report subchapters from search results
Creating search-based report subchapters from scratch
Search interface changes between version 5.0 and 6.0
Configuring usermapping policies
Configuring gateway authentication
Reports
Configuring out-of-band gateway authentication
Performing out-of-band gateway authentication on One Identity Safeguard for Privileged Sessions (SPS)
Performing inband gateway authentication in SSH and Telnet connections
Performing inband gateway authentication in RDP connections
Troubleshooting gateway authentication
Configuring four-eyes authorization
Configuring four-eyes authorization
Performing four-eyes authorization on One Identity Safeguard for Privileged Sessions (SPS)
Using credential stores for server-side authentication
Configuring local Credential Stores
Performing gateway authentication to RDP servers using local Credential Store and NLA
Configuring password-protected Credential Stores
Unlocking Credential Stores
Using a custom Credential Store plugin to authenticate on the target hosts
Integrating external authentication and authorization systems
How Authentication and Authorization plugins work
Using a custom Authentication and Authorization plugin to authenticate on the target hosts
Performing authentication with AA plugin in terminal connections
Performing authentication with AA plugin in Remote Desktop connections
Integrating ticketing systems
Creating a custom plugin
Plugin troubleshooting
Contents of the operational reports
Configuring custom reports
Creating reports from audit trail content
Creating report subchapters from search queries
The One Identity Safeguard for Privileged Sessions (SPS) RPC API
Creating search-based report subchapters from search results
Creating search-based report subchapters from scratch
Creating statistics from custom database queries
Database tables available for custom queries
The alerting table
The aps table
The archives table
The audit_trail_downloads table
The channels table
The closed_connection_audit_channels view
The closed_not_indexed_audit_channels view
The connection_events view
The connection_occurrences view
The connections view
The events table
The file_xfer table
The http_req_resp_pair table
The indexer_jobs table
The occurrences table
The progresses table
The results table
The skipped_connections table
The usermapped_channels view
Querying trail content with the lucene-search function
Generating partial reports
Creating PCI DSS reports
Contents of PCI DSS reports
Requirements for using the RPC API
RPC client requirements
Locking One Identity Safeguard for Privileged Sessions (SPS) configuration from the RPC API
Documentation of the RPC API
Enabling RPC API access to One Identity Safeguard for Privileged Sessions (SPS)
The One Identity Safeguard for Privileged Sessions (SPS) REST API
One Identity Safeguard for Privileged Sessions (SPS) scenarios
Configuring public-key authentication on One Identity Safeguard for Privileged Sessions (SPS)
Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Configuring public-key authentication using local keys
Configuring public-key authentication using an LDAP server and a fixed key
Configuring public-key authentication using an LDAP server and generated keys
Organizing connections in non-transparent mode
Using inband destination selection in SSH connections
Using inband destination selection with PuTTY
Using inband destination selection with OpenSSH
Using inband selection and nonstandard ports with PuTTY
Using inband selection and nonstandard ports with OpenSSH
Using inband destination selection and gateway authentication with PuTTY
Using inband destination selection and gateway authentication with OpenSSH
SSH usermapping and keymapping in AD with public key
Network troubleshooting
Gathering data about system problems
Viewing logs on One Identity Safeguard for Privileged Sessions (SPS)
Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS)
Collecting logs and system information for error reporting
Support hotfixes
Status history and statistics
Using SPS with SPP
Configuring external devices
Connection statistics
Memory
Disk
CPU
Network connections
Interface
Load average
Number of processes
Displaying custom connection statistics
Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster
Understanding One Identity Safeguard for Privileged Sessions (SPS) cluster statuses
Recovering One Identity Safeguard for Privileged Sessions (SPS) if both nodes broke down
Recovering from a split brain situation
Replacing a HA node in a One Identity Safeguard for Privileged Sessions (SPS) cluster
Resolving an IP conflict between cluster nodes
Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status
Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data
VNC is not working with TLS
Configuring the IPMI interface from the BIOS after losing IPMI password
Incomplete TSA response received
Using UPN usernames in audited SSH connections
Configuring advanced routing on Linux
Configuring advanced routing on Cisco routers
Configuring advanced routing on Sophos UTM (formerly Astaro Security Gateway) firewalls
Using SCP with agent-forwarding
Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS)
Jumplists for in-product help
Basic Settings > Management
Basic Settings > Local Services
Basic Settings > System
<Protocol name> Control > Global Options
LDAP user and group resolution in SPS
Appendix: Deprecated features
Deprecated: Using the Search (classic) interface
Glossary
Searching audit trails: the One Identity Safeguard for Privileged Sessions (SPS) connection database
Connection details
Replaying audit trails in your browser in Search (classic)
Replaying encrypted audit trails in your browser
Using the content search
Connection metadata
Using and managing search filters
The search and filter process
Displaying statistics on search results
Single-interface transparent mode
The concepts of One Identity Safeguard for Privileged Sessions (SPS) > Modes of operation > Single-interface transparent mode
Single-interface transparent mode is similar to transparent mode, but both client-side and server-side traffic use the same interface. An external device that actively redirects the audited traffic to One Identity Safeguard for Privileged Sessions (SPS) (typically, a firewall, a router, or a layer3 switch) is required . To accomplish this, the external device must support advanced routing (also called policy-based routing or PBR). For details on configuring an external device to work with SPS in single-interface transparent mode, see Configuring external devices.
Figure 9: SPS in single-interface transparent mode
Advantages
The advantages of using the single-interface transparent mode are:
-
Totally transparent for the clients, no need to modify their configuration.
-
The network topology is not changed.
-
Only the audited traffic is routed to SPS, production traffic is not.
Disadvantages
The disadvantages of using the single-interface transparent mode are:
-
SPS acts as a man-in-the-middle regarding the connection between the client and the target server. Instead of a single client-server connection, there are two separate connections: the first between the client and SPS, and a second between SPS and the server. Depending on how you configure SPS, the source IP in the SPS-server connection can be the IP address of SPS, or the IP address of the client. In the latter case — when operating in transparent mode (including single-interface transparent mode) — SPS performs IP spoofing. Consult the security policy of your organization to see if it permits IP spoofing on your network.
-
Traffic must be actively routed to SPS using an external device. Consequently, a network administrator can disable SPS by changing routing rules.
-
When adding a new port or subnet to the list of audited connections, the configuration of the external device must be modified as well.
-
A network administrator can (intentionally or unintentionally) easily disable monitoring of the servers, therefore additional measures have to be applied to detect such activities.