立即与支持人员聊天
与支持团队交流

One Identity Safeguard for Privileged Passwords 7.4.1 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home page Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms Importing objects
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

Preparing ACF - Mainframe systems

This applies to both ACF2 - Mainframe and ACF2 - Mainframe LDAP platforms.

To prepare IBM ACF-mainframe systems for SPP

  1. Create a service account on the asset and assign it a password. The service account must have the SECURITY attribute enabled for ACF2 ChangePassword to work properly.
  2. Grant the service account the privileges required to use the ALTERUSER command on other profiles.

  3. If not already installed, install a telnet server on the z/OS system. If required, secure telnet with SSL.

    NOTE: Please refer to your IBM z/OS system documentation for details on installing and configuring the telnet server (and SSL).

  4. Test the telnet server using a Windows-based 3270 emulator or on Linux, use the telnet-ssl or x3270 programs to test SSL and non-SSL connections to an z/OS system.
  5. In SPP, create the asset and accounts for the z/OS system using password authentication.
About certificate support for the telnet protocol

SPP automatically accepts any server certificate that the connection offers and does not verify the trust chain on the telnet certificate. In addition, SPP does not support client certificate selection, so if telnet requires that the client present a certificate that is signed by a recognized authority, SPP cannot support that configuration.

Preparing Amazon Web Services platforms

SPP supports Amazon Web Services (AWS), a secure cloud services platform.

When adding an Amazon Web Services asset, the Network Address must contain the AWS Account ID or Alias.

To prepare Amazon Web Services platforms for SPP

  1. In SPP: 

    1. Ensure the latest Amazon's certificate and AWS certificate's root certificate authority (CA) are in the Trusted Certificates store in SPP.

    2. Configure an Identity and Access Management (IAM) user to use as a service account.

    3. Assign the IAM service account to the AdministratorAccess security policy.

  2. In Amazon:

    1. Create an access key for the IAM service account. Amazon creates a pair of data items called a Secret Key and a public Access Key ID. Take a note of both the Access Key ID and Secret Key. You will need them when you add the Amazon Web Services asset to SPP.

Preparing Cisco devices

There are 4 Cisco platforms supported in SPP:

  • Cisco ISE CLI platform: SPP uses a local service account to manage accounts on the ISE CLI platform using SSH.

  • Cisco IOS/ASA platform: Cisco IOS/ASA platforms can be configured in the following ways to manage local accounts using SSH:

    • SPP uses a local service account to manage accounts on the Cisco device.

    • If the Cisco device is configured (using AAA) to authenticate and authorize login requests to a Cisco ISE server that will be managed by SPP, then you can use a directory account in the Cisco ISE directory asset to manage the Cisco device.

    • If the Cisco device is configured (using AAA) to authenticate and authorize login requests to a Cisco ISE server that is integrated with an Active Directory domain that will be managed by SPP, then you can use a directory account in the Active Directory asset to manage accounts on the Cisco device.

    • If the service account is not configured with privilege level 15, then the enable password for privilege level 15 will be required when creating the asset.

  • Cisco ISE platform: Cisco ISE is managed as a directory asset in SPP. It uses REST and TACACS+ to manage local accounts. It supports account discovery and password management. It does not support directory synchronization, asset discovery, or service discovery.

  • Cisco NX-OS platform: In order to perform all required operations on users, the service account used requires at least network-admin privileges.

ClosedCisco ISE CLI platform
ClosedCisco IOS/ASA platform
ClosedCisco ISE platform
ClosedCisco NX-OS platform

Preparing Dell iDRAC devices

SPPsupports the Dell Remote Access Controller that is integrated with Dell PowerEdge servers. SPP uses the SSH protocol to connect to iDRAC devices.

To prepare an iDRAC device for SPP

  1. Use iDRAC to create a service account with administrator privileges and assign it a password.

    The service account must have login privileges and must be able to configure users.

  2. Verify that SSH is enabled in the iDRAC Network settings.
  3. In SPP, create the asset and accounts for the iDRAC device using password authentication. Accounts can also be discovered.
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级