立即与支持人员聊天
与支持团队交流

One Identity Safeguard for Privileged Passwords 6.0 LTS - Release Notes

Safeguard for Privileged Passwords Release Notes

Safeguard for Privileged Passwords 6.0 LTS

Release Notes

16 June 2020, 09:36

These release notes provide information about the Safeguard for Privileged Passwords 6.0 LTS release.

Planning future release options

This release is the first Long Term Support (LTS) release, Safeguard for Privileged Passwords version 6.0 LTS.

Upcoming releases of Safeguard for Privileged Passwords will have Long Term Support (LTS) Release or Feature Release version numbering. The versions align with Safeguard for Privileged Sessions. For more information, see Long Term Support (LTS) and Feature Releases.

About this release

CAUTION: The embedded sessions module was removed in Safeguard for Privileged Passwords 6.0 LTS. Organizations must join to the more robust Safeguard for Privileged Sessions Appliance for sessions recording and playback. Please contact your Account Manager if you are currently using the embedded sessions module to discuss upgrading to 6.0 LTS including implementation of the Safeguard for Privilege Sessions appliance or virtual appliance.

Safeguard for Privileged Passwords Version 6.0 LTS is major release with new features and

resolved issues.

The new features include:

  • SPP embedded sessions module removed and SPS join complete (191547)
  • Support for the Safeguard for Privileged Passwords 3000 Appliance (191553)
    NOTE: No upgrade is needed for Safeguard for Privileged Passwords 2000 Appliance users.

For more details on the features and resolved issues, see:

NOTE: For a full list of key features in Safeguard for Privileged Passwords, see the Safeguard for Privileged Passwords Administration Guide.

About the Safeguard product line

The Safeguard for Privileged Passwords Appliance is built specifically for use only with the Safeguard for Privileged Passwords privileged management software, which is pre-installed and ready for immediate use. The appliance is hardened to ensure the system is secured at the hardware, operating system, and software levels. The hardened appliance approach protects the privileged management software from attacks while simplifying deployment and ongoing management and shortening the time frame to value.

Safeguard for Privileged Passwords virtual appliances and cloud applications are also available. When setting up a virtual environment, carefully consider the configuration aspects such as CPU, memory availability, I/O subsystem, and network infrastructure to ensure the virtual layer has the necessary resources available. See One Identity's Product Support Policies for more information on environment virtualization.

Safeguard privileged management software suite

Safeguard privileged management software is used to control, monitor, and govern privileged user accounts and activities to identify possible malicious activities, detect entitlement risks, and provide tamper proof evidence. The Safeguard products also aid incident investigation, forensics work, and compliance efforts.

The Safeguard products' unique strengths are:

  • One-stop solution for all privileged access management needs
  • Easy to deploy and integrate
  • Unparalleled depth of recording
  • Comprehensive risk analysis of entitlements and activities
  • Thorough Governance for privileged account

The suite includes the following modules:

  • Safeguard for Privileged Passwords automates, controls, and secures the process of granting privileged credentials with role-based access management and automated workflows. Deployed on a hardened appliance, Safeguard for Privileged Passwords eliminates concerns about secured access to the solution itself, which helps to speed integration with your systems and IT strategies. Plus, its user-centered design means a small learning curve and the ability to manage passwords from anywhere and using nearly any device. The result is a solution that secures your enterprise and enables your privileged users with a new level of freedom and functionality.
  • One Identity for Privileged Sessions is part of One Identity's Privileged Access Management portfolio. Addressing large enterprise needs, Safeguard for Privileged Sessions is a privileged session management solution, which provides industry-leading access control, as well as session monitoring and recording to prevent privileged account misuse, facilitate compliance, and accelerate forensics investigations.

    Safeguard for Privileged Sessions is a quickly deployable enterprise appliance, completely independent from clients and servers to integrate seamlessly into existing networks. It captures the activity data necessary for user profiling and enables full user session drill-down for forensics investigations.

  • One Identity Safeguard for Privileged Analytics integrates data from Safeguard for Privileged Sessions to use as the basis of privileged user behavior analysis. Safeguard for Privileged Analytics uses machine learning algorithms to scrutinize behavioral characteristics, and generates user behavior profiles for each individual privileged user. Safeguard for Privileged Analytics compares actual user activity to user profiles in real time, and profiles are continually adjusted using machine learning. Safeguard for Privileged Analytics detects anomalies and ranks them based on risk so you can prioritize and take appropriate action and ultimately prevent data breaches.

    Figure 1: Privileged Sessions and Privileged Passwords

New features

CAUTION:The embedded sessions module was removed in Safeguard for Privileged Passwords 6.0 LTS. Organizations must join to the more robust Safeguard for Privileged Sessions Appliance for sessions recording and playback. Please contact your Account Manager if you are currently using the embedded sessions module to discuss upgrading to 6.0 LTS including implementation of the Safeguard for Privilege Sessions appliance or virtual appliance.

SPP embedded sessions module removed (191547)

The embedded sessions module has been removed with Safeguard for Privileged Passwords 6.0 LTS. For uninterrupted service, organizations must join to the more robust Safeguard for Privileged Sessions Appliance for sessions recording and playback.

See the Safeguard for Privileged Passwords Administration Guide:

  • Session Appliances with SPS join
  • Appendix C: SPP and SPS sessions appliance join guidance

Support for the Safeguard for Privileged Passwords 3000 Appliance (191553)

NOTE: No upgrade is needed for Safeguard for Privileged Passwords 2000 Appliance users.

The Safeguard for Privileged Passwords 3000 Appliance is available with the latest security updates and trusted certificate updates/revocations.

  • Appliance Administrators can factory reset to a recent Safeguard for Privileged Passwords version to get the appliance back up and running on the latest version.
  • Government agencies and their contractors can rely on the 3000 Appliance to meet common criteria for purchase approval with no need for exceptions.

Functionality includes:

  • Default password rules are enhanced for better security including symbols, length, and so on.
  • The same certificates as the Safeguard for Privileged Passwords 2000 appliance are used.
  • Twitter and Facebook internal platforms are removed in favor of the open source custom platform versions. If in use, the platforms become Other, Other.

Session recordings

Before patching to the 3000 Appliance, move any SPP embedded sessions recordings from local SPP to an archive server. For details, see SPP and SPS sessions appliance join guidance, Step 1: Prepare for the join.

AWS to run in cloud (191525)

Safeguard for Privileged Passwords can be run in the cloud using Amazon Web Services (AWS).

For instructions, see the Safeguard for Privileged Passwords Administration Guide:

  • Using the cloud
  • Using AWS

Management web kiosk available for cloud platforms

The Management web kiosk is available via HTTPS port 9337 for cloud platforms.

CAUTION:The Management web kiosk is available via HTTPS port 9337 for cloud platforms (including AWS and Azure). The Management web kiosk gives access to functions without authentication, such as pulling a support bundle or rebooting the appliance. In AWS, all ports are denied unless explicitly allowed. To deny access to port 9337, the port should be left out of the firewall rules. If the port is used, firewall rules should allow access to targeted users.

See also:

Resolved issues

Issues addressed by this release follow.

Table 1: General resolved issues
Resolved issue

Issue ID

An approver can click a link in the email to approve/deny request.

227573

In the web client, an Approver can view one access request to approve or deny a request.

227453

Backup and restore documentation was updated.

227452

A session recorded while Safeguard for Privileged Passwords is in Offline Workflow mode can be replayed.

227143

Removing user as partition owner resets the user back to the previous ownerships.

225806

SPS initiated SSH sessions works from AA plugin after SPP upgrade from 2.10 to 2.11.

225421

Changed the .rdp temp file name to include the asset and account name.

223817

If you have a single node SPS cluster where the Central Management node is also the Search Master, SPP will be unable to launch sessions. There has to be at least one SPS appliance in the cluster that is capable of recording sessions. See the SPS Administration Guide, Managing Safeguard for Privileged Sessions (SPS) clusters.

223712

AS400 check and change succeeds.

222020

Creating backups works as designed. 220387

Added KB article 313918: Why does the ‘Launch’ button on Safeguard’s Web Interface not initiate the session as expected?

220245

SPS join works with SpsInteractive Service credentials.

219188

Documentation was added for:

  • The procedure to change the IP address of a clustered SPP appliance
  • Considerations when SPP and SPS are joined and the IP address of either the SPS cluster master (Central Management role) or the SPP primary appliance are changed.

For more information, see the Safeguard for Privileged Passwords Administration Guide, Networking.

218270

Creating an archive server with SSH key works through test connection through archive backup.

218022

In the web UI, the approver sees Request Available in green.

217759

Safeguard for Privileged Passwords can import accounts using a .csv file if asset name is capitalized

216931

Discovering accounts runs efficiently.

215940

Entitlement report lists entitlements when running the report against the linked accounts or assets.

215689

Customers can replay session videos recorded and archived from the embedded sessions module and the external SPS sessions feature.

201046

The headers on requests were updated for vulnerability scan results. 200486 188719

AS400 starting task works as designed.

200383

Schedule reports attachments can be sent as a .csv file.

198007

Changed UTC to local time in email template for email notifications.

188650

The temporary .rdp file name now includes Asset and Account information in the naming convention.

187954

自助服务工具
知识库
通知和警报
产品支持
下载软件
技术说明文件
用户论坛
视频教程
RSS订阅源
联系我们
获得许可 帮助
技术支持
查看全部
相关文档