立即与支持人员聊天
与支持团队交流

Safeguard for Privileged Sessions On Demand Hosted - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing IPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers and operating systems The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving and cleanup Using plugins Forwarding data to third-party systems Starling integration
User management and access control Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received Using UPN usernames in audited SSH connections
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

The usermapped_channels view

This view collects data about the connections which used a usermapping policy. The view is defined as follows:

select
    channels.id,
    channels.scp_path,
    channels.subsystem_name,
    channels.protocol,
    channels.originator_port,
    channels.channel_policy,
    channels.target_addr,
    channels._archive_path,
    channels._close_cleanup,
    channels.dynamic_channel,
    channels.environment,
    channels.session_start,
    channels.remote_username,
    channels.local_port,
    channels.four_eyes_authorizer,
    channels.src_ip,
    channels.session_end,
    channels._archive_server,
    channels.server_port,
    channels.username,
    channels._archive_date,
    channels.server_ip,
    channels.exec_cmd,
    channels._archive_policy,
    channels.four_eyes_description,
    channels.connection_id,
    channels._connection_channel_id,
    channels.rule_num,
    channels.target_port,
    channels.src_port,
    channels.originator_addr,
    channels.auth_method,
    channels.audit,
    channels.local_ip,
    channels.session_id,
    channels.device_name,
    channels.channel_type,
    channels."connection",
    channels.verdict,
    channels.dst_port,
    channels.dst_ip
from channels
where channels.remote_username is not null
and channels.username <> channels.remote_username;

The the usermapped_channels view has the following columns.

NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.

Table 29: Columns of the usermapped_channels table
Column Type Description
_archive_date date

Archive date: The date when the connection was archived or cleaned up.

_archive_path text

Archive path: The path where the audit trail was archived on the remote server.

_archive_policy text
_archive_server text

Archive server: The hostname or IP address of the remote server where the audit trail was archived.

audit text

Audit-trail: Name and ID of the audit file storing the traffic of the channel. If the session has an audit trail, a icon is displayed. Note that a the following letters may appear on the download icon:

auth_method text

Authentication method: The authentication method used in the connection. For example, password

channel_policy text

Channel policy: The Channel policy applied to connection. The Channel policy lists the channels (for example, terminal session and SCP in SSH, or Drawing and Clipboard in RDP) that can be used in the connection, and also determines if the channel is audited or not. The Channel policy can also restrict access to each channel based on the IP address of the client or the server, a user list, user group, or a time policy.

channel_type text

Channel type: Type of the channel.

_close_cleanup boolean
_connection_channel_id integer

Unique connection ID: The unique identifier of the connection.

connection_id text

Connection policy ID: The identifier of the connection policy.

connection text

Connection policy: The connection policy that handled the client's connection request.

device_name text

Device name: The name or ID of the shared device (redirect) used in the RDP connection.

dst_ip text

Destination IP: The IP address of the server as requested by the client.

dst_port integer

Destination port: The port number of the server as requested by the client.

dynamic_channel text

Dynamic channel: The name or ID of the dynamic channel opened in the RDP session.

exec_cmd text

Exec command: The command executed in a Session exec channel.

four_eyes_authorizer text

Four-eyes authorizer: The username of the user who authorized the session. Available only if 4-eyes authorization is required for the channel. For details on 4-eyes authorization, see Configuring four-eyes authorization.

four_eyes_description text

Four-eyes description: The description submitted by the authorizer of the session.

id integer
local_ip text

Server-local IP: The IP address of SPS used in the server-side connection.

local_port integer

Server-local port: The port number of SPS used in the server-side connection.

originator_addr text

Port/X11 forward originator IP: The IP address of the host initiating the channel in Remote Forward and Local Forward channels. Note that this host is not necessarily the client or the server of the SSH connection.

originator_port integer

Port/X11 forward originator port: The number of the forwarded port in Remote Forward and Local Forward channels.

protocol text

Protocol: The protocol used in the connection (Citrix ICA, HTTP, RDP, SSH, Telnet, or VNC).

remote_username text

Username on server: The username used to log in to the remote server. This username can differ from the client-side username if usermapping is used in the connection. For details on usermapping, see Configuring usermapping policies.

rule_num text

Rule number: The number of the line in the Channel policy applied to the channel.

scp_path text

SCP path: Name and path of the file copied via SCP. Available only for SCP sessions (Session exec SCP SSH channels) if the Log file transfers to database option is enabled in the Channel Policy of the connection.

server_ip text

Server IP: The IP address of the server connected by SPS.

server_port integer

Server port: The port number of the server connected by SPS.

session_end integer

End time: Date when the channel was closed.

session_id text

Session ID:

A globally unique string that identifies the session. This session ID has the following format: svc/<unique-random-hash>/<name-of-the-connection-policy>:<session-number-since-service-started>/<protocol>, for example, svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:1/ssh.

Log messages related to the session also contain this ID. For example:

2015-03-20T14:29:15+01:00 demo.example
zorp/scb_ssh[5594]: scb.audit(4):
(svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:0/ssh):
Closing connection; connection='ssh_console',
protocol='ssh', connection_id='409829754550c1c7a27e7d',
src_ip='10.40.0.28', src_port='39183',
server_ip='10.10.20.35', server_port='22',
gateway_username='', remote_username='example-username',
verdict='ZV_ACCEPT'
session_start integer

Start time: Date when the channel was started.

src_ip text

Source IP: The IP address of the client.

src_port integer

Source port: The port number of the client.

subsystem_name text

Subsystem name: Name of the SSH subsystem used in the channel.

target_addr text

Port-forward target IP: The traffic was forwarded to this IP address in Remote Forward and Local Forward channels.

target_port integer

Port-forward target port: The traffic was forwarded to this port in Remote Forward and Local Forward channels.

username text

Username: The username used in the session.

  • If the user performed inband gateway authentication in the connection, the field contains the username from the gateway authentication (gateway username).

  • Otherwise, the field contains the username used on the remote server.

verdict text

Verdict: Indicates what SPS decided about the channel.

  • ACCEPT: Accepted.

  • ACCEPT-TERMINATED: Connection was accepted and established, but a content policy terminated the connection. For details on content policies, see Real-time content monitoring with Content Policies.

  • CONN-AUTH-FAIL: User authentication failed.

  • CONN-DENY: Connection rejected.

  • CONN-FAIL: Connection failed, that is, it was allowed to pass SPS but timed out on the server.

  • CONN-GW-AUTH-FAIL: Gatway authentication failed.

  • CONN-KEY-ERROR: Hostkey mismatch.

  • CONN-USER-MAPPING-FAIL: Usermapping failed.

  • DENY: Denied.

  • FOUR-EYES-DEFERRED: Waiting for remote username.

  • FOUR-EYES-ERROR: Internal error during four-eyes authorization.

  • FOUR-EYES-REJECT: Four-eyes authorization rejected.

  • FOUR-EYES-TIMEOUT: Four-eyes authorization timed out.

Querying trail content with the lucene-search function

 Caution:

This function works only if you have enabled indexing for the audit trails.

The lucene_search function allows you to search the content of indexed audit trails for a specific keyword and return the IDs of the channels that contain the search keyword. The lucene_search function requires four parameters:

  • search phrase: The keyword or keyphrase you are looking for, for example, a command issued in an SSH session (exit). The keyphrase can contain the following special operators to be used & (AND), | (OR), ! (NOT). Brackets can be used to group parts of the keyphrase.

  • beginning_timestamp: The date in UNIX-timestamp format. Only audit trails created after this date will be queried.

  • ending_timestamp: The date in UNIX-timestamp format. Only audit trails created before this date will be queried.

For example:

select lucene_search
from lucene_search('root', 1287402232, 1318938150);
       
# Sample output:
(1,2,3,1)
(1 row)

The output of this query is a formatted as the following:

(<channel_id>,<trail_id>,<hits_count>,<rank>)

Alternatively, you can use the following query format that returns a header of the displayed columns, and uses the pipe (|) character for separator:

For example:

select * from lucene_search('tmp',1496885628,1496954028);
channel_id | trail_id | hits_count | rank
-----------------------------+-----
1    | 2    | 3    | 1
(1 row)

The output contains the following columns:

  • channel_id: The ID of the channel within the audit trail (an audit trail file can contain audit trails of multiple channels).

  • trail_id: Identifies the audit trail using the unique identifier of the session (the _connection_channel_id of the channel for which the audit trail was created).

  • hits_count: The number of hits in the audit trail.

  • rank: Shows the relevance of the search result on a 0-1 scale, where 1 is the most relevant. Note that on the SPS search page, this information is scaled to 0-5 (and shown graphically with stars).

For details on how to use more complex keyphrases, see the Apache Lucene documentation.

For details of content indexing, see Configuring the internal indexer.

Creating PCI DSS reports

To help you comply with the regulations of the Payment Card Industry Data Security Standard (PCI DSS), One Identity Safeguard for Privileged Sessions (SPS) can generate reports on the compliance status of SPS. Note that this is not a fully-featured compliance report: it is a tool to enhance and complement your compliance report by providing information available in SPS. The report corresponds with the document Payment Card Industry (PCI) Data Security Standard, Requirements and Security Assessment Procedures, Version 3.0, published by the PCI Security Standards Council.

For details on the contents of the report, see Contents of PCI DSS reports.

To create PCI DSS reports

  1. Log in to the SPS web interface, and navigate to Reporting > Create & Manage Reports > Built-in reports > PCI DSS > Create report.

    Figure 346: Reporting > Create & Manage Reports > Built-in reports > PCI DSS > Create report — Generating PCI DSS reports

  2. By default, members of the report group can access the custom reports through the SPS web interface. To change this, click Edit and enter the name of a different group into the Groups field.

    NOTE: Members of the listed groups can access only these custom reports even if their groups do not have read access to the Reporting > Download reports page. However, only those reports will be listed, to which their group has access to.

  3. By default, SPS sends out the reports in email to the address set in the Basic Settings > Management > Mail settings > Send reports to field.

    NOTE: If this address is not set, the report is sent to the SPS administrator's email address.

  4. To disable email sending, clear the Deliver in email option.

  5. To email the reports to a different address, select Custom, and enter the email address where the reports should be sent. Click Add email to list multiple email addresses if needed.

  6. Click Update report.

  7. Click Create report.

    The report will be automatically added in the list of reports (Reporting > Download reports), and also sent in an e-mail to the regular recipients of the report.

Contents of PCI DSS reports

To help you comply with the regulations of the Payment Card Industry Data Security Standard (PCI DSS), One Identity Safeguard for Privileged Sessions (SPS) can generate reports on the compliance status of SPS. Note that this is not a fully-featured compliance report: it is a tool to enhance and complement your compliance report by providing information available in SPS. The report corresponds with the document Payment Card Industry (PCI) Data Security Standard, Requirements and Security Assessment Procedures, Version 3.0, published by the PCI Security Standards Council.

For details on creating PCI DSS reports, see Creating PCI DSS reports. The following table details the information included in the SPS PCI DSS reports, and the relevant PCI compliance requirement.

Table 30: Contents of PCI DSS reports
PCI DSS Requirement Compliance details
Requirement 1.1.6

Documentation and business justification for use of all services, protocols, and ports allowed, including documentation of security features implemented for those protocols considered to be insecure. Examples of insecure services, protocols, or ports include but are not limited to FTP, Telnet, POP3, IMAP, and SNMP v1 and v2.

 The report lists the insecure connection policies configured in SPS, including SNMP server and agent settings, and the list of connection policies that permit unencrypted HTTP and Telnet. This list does not include any insecure connections that can be used to access SPS itself.
Requirement 2.1

Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network. This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, Simple Network Management Protocol (SNMP)community strings, etc.).

 SPS can be accessed as "root" via the local management console, or - if explicitly enabled - remotely using a Secure Shell (SSH v2) connection. The report lists the local web user accounts that can access SPS. For details on configuring these accounts, see Managing One Identity Safeguard for Privileged Sessions (SPS) users locally.
Requirement 2.2.2

Enable only necessary services, protocols, daemons, etc., as required for the function of the system.

 The report includes the list of services running on SPS.
Requirement 2.2.3

Implement additional security features for any required services, protocols, or daemons that are considered to be insecure, for example, use secured technologies such as SSH, S-FTP, SSL, or IPSec VPN to protect insecure services such as NetBIOS, file-sharing, Telnet, FTP, etc.

 The report lists the connection policies enabling unencrypted HTTP and Telnet access, and any such session that was active when the report was generated.
Requirement 2.3

Encrypt all non-console administrative access using strong cryptography. Use technologies such as SSH, VPN, or SSL/TLS for web-based management and other non-console administrative access.

 Use HTTPS to connect to SPS. HTTP connections are forbidden.
Requirement 3.5.2

Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times:

  • Encrypted with a key-encrypting key that is at least as strong as the dataencrypting key, and that is stored separately from the data-encrypting key

  • Within a secure cryptographic device (such as a host security module (HSM) or PTS-approved point-of-interaction device)

  • As at least two full-length key components or key shares, in accordance with an industry-accepted method

Note: It is not required that public keys be stored in one of these forms.

 Audit trails are encrypted with AES128-GCM (audit trails recorded with SPS 5 F3 and earlier are encrypted with AES128-CBC). The master key is encrypted with the key you provided.
Requirement 5.1.2

For systems considered to be not commonly affected by malicious software, perform periodic evaluations to identify and evaluate evolving malware threats in order to confirm whether such systems continue to not require anti-virus software.

 SPS is an appliance running minimal services and using a hardened operating system. One Identity, the vendor of SPS, continuously monitors vulnerabilities and CVEs that might affect the components of SPS, and publishes security updates and announcements as needed. Using an up-to-date SPS version should keep the risk of SPS being affected by malicious software at a minimum level.
Requirement 6.2

Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release.

 The report includes the firmware version running on SPS. You can check which is the latest version at the Downloads page.
Requirement 8.1.8

If a session has been idle for more than 15 minutes, require the user to reauthenticate to re-activate the terminal or session.

 The report includes the timeout value to the SPS web interface (10 minutes by default). To change this value, see Web interface timeout.
Requirement 8.2.1

Using strong cryptography, render all authentication credentials (such as passwords/phrases) unreadable during transmission and storage on all system components.

 The report lists where SPS stores passwords, and the hash used to secure them.
Requirement 8.2.4

Change user passwords/passphrases at least every 90 days.

 The report lists the password expiry settings of local web users of SPS, and also the last time the password of each user was changed. For details on configuring these accounts, see Managing One Identity Safeguard for Privileged Sessions (SPS) users locally. For details on configuring password expiry for these accounts, see Setting password policies for local users.
Requirement 8.2.5

Do not allow an individual to submit a new password/phrase that is the same as any of the last four passwords/phrases he or she has used.

 The report includes the password history settings of local web users of SPS. For details on configuring password history for these accounts, see Setting password policies for local users.
Requirement 10.5.3

Promptly back up audit trail files to a centralized log server or media that is difficult to alter.

 The report lists the addresses of the logservers where SPS forwards its log messages. For details on forwarding log messages, see Configuring system logging.
Requirement 10.5.4

Write logs for external-facing technologies onto a secure, centralized, internal log server or media device.

 The report lists the security settings of the communication between SPS and the logservers where SPS forwards its log messages. For details on forwarding log messages, see Configuring system logging.
Requirement 10.7

Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis.

The retention time for local logs of SPS is seven days. To retain them longer, forward them to a remote logserver.
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级