立即与支持人员聊天
与支持团队交流

One Identity Safeguard for Privileged Sessions 6.0.14 LTS - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS) Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers and operating systems The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving and cleanup Forwarding data to third-party systems Joining to One Identity Starling
User management and access control Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing Safeguard for Privileged Sessions (SPS) clusters Managing a high availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings RDP-specific settings SSH-specific settings Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Searching session data on a central node in a cluster Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) RPC API The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS) Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Appendix: Deprecated features Glossary

Performing four-eyes authorization on One Identity Safeguard for Privileged Sessions (SPS)

The following describes how to perform four-eyes authorization on One Identity Safeguard for Privileged Sessions (SPS).

To perform four-eyes authorization on SPS

  1. When a user initiates a connection from a client and four-eyes authorization is required for the connection, SPS will pause the connection.

    		 NOTE:

    Four-eyes authorization can be set separately for every channel. However, if a client of an existing connection opens a new channel that requires four-eyes authorization, every channel is paused until the authorization is completed.

  2. Login to SPS, and select Four-Eyes from the main menu. The list of connections waiting for authorization will be displayed.

    Figure 253: Four-Eyes — Performing four-eyes authorization

    		 NOTE:

    Only those connections will be listed, where your usergroup has the Authorize or the Search&Authorize permissions. No other SPS privilege is required to access this page.

  3. Select the connection and click Accept to enable the connection, Reject to deny the connection, or Accept&Follow to enable it and monitor in real-time.

    		 NOTE:

    Following a session requires the following:

    • The Record audit trail option must be enabled for the specific channel in the Channel policy of the connection.

    • The Audit Player application must be installed on the computer of the auditor.

    • If the Audit policy of the connection uses encryption, the appropriate decryption keys must be available on the computer of the auditor.

    The Safeguard Desktop Player application replays the live streams in live mode. For details on how to monitor a connection in real-time using the Safeguard Desktop Player, see "Replay audit files in follow mode" in the Safeguard Desktop Player User Guide.

  4. Enter a note why the connection was accepted/rejected into the appearing dialog box. This description will be stored in the connection database together with other metadata about the connection.

    Figure 254: Describing why a connection was accepted/rejected

  5. If you have to terminate an ongoing connection for some reason, select Active Connections from the main menu. The list of ongoing connections will be displayed.

    Figure 255: Active Connections — Displaying active connections

  6. Select the connection to stop, and click Terminate.

    		 NOTE:

    When following a connection in the Safeguard Desktop Player application, the auditor can also terminate the connection from the Audit Player by clicking Terminate.

    Figure 256: Terminating a connection in Safeguard Desktop Player

Using credential stores for server-side authentication

Credential Stores offer a way to store user credentials (for example, passwords, private keys, certificates) and use them to log in to the target server, without the user having access to the credentials. That way, the users only have to perform gateway authentication on One Identity Safeguard for Privileged Sessions (SPS) with their usual password (or to an LDAP database), and if the user is allowed to access the target server, SPS automatically logs in using the Credential Store. For details on gateway authentication, see Configuring gateway authentication.

 NOTE:

Keyboard-interactive authentication is not supported when using credential stores.

Figure 257: Authenticating using Credential Stores

Credential Stores can be stored locally on SPS, or on a remote device. For remote Credential Stores, SPS integrates with external authentication and authorization systems using plugins.

 NOTE:

After performing a successful gateway authentication, if the credential store does not contain a password for the user, the user is prompted for the server-side password as a fallback.

In case of authenticating to RDP servers using Network Level Authentication (NLA), the server-side password is prompted at the start of the connection. If there is no password in the credential store for the user and the server-side password is incorrect, the connection is terminated.

Configuring local Credential Stores

The following describes how to configure a local Credential Store that stores the credentials used to login to the target host.

Prerequisites

 NOTE:

Users accessing connections that use Credential Stores to authenticate on the target server must authenticate on One Identity Safeguard for Privileged Sessions (SPS) using gateway authentication or an AA plugin. Therefore gateway authentication or an AA plugin must be configured for these connections. For details, see "Configuring gateway authentication" in the Administration Guide and "Integrating external authentication and authorization systems" in the Administration Guide.

To configure a local Credential Store that stores the credentials used to login to the target host

  1. Navigate to Policies > Credential Stores.

  2. Click and enter a name for the Credential Store.

  3. Select Local.

  4. Select Encryption key > Built-in. That way the credentials will be encrypted with a built-in password, and the Credential Store is automatically accessible when SPS boots up. To use custom passwords to encrypt the Credential Store, see Configuring password-protected Credential Stores.

    Figure 258: Policies > Credential Stores > Local — Configuring local Credential Stores

  1. Add credentials to the Credential Store.

    1. Click and enter the destination host and the username. For the destination host, you can use hostname, IP address, or subnet as well. To use the same credentials for every destination host, enter the 0.0.0.0/0 subnet. To use the credentials only on the hosts of a specific domain, enter *.domain. Note that:

      • Usernames are case sensitive.

      • To authenticate users of a Windows domain, enter the name of the domain into the Host field.

      Use an IPv4 address.

    2. Set the credentials. SPS will use these credentials to login to the destination host if the credential store is selected in a Connection policy. If more than one credential is specified to a host-username pair, SPS will attempt to use the credentials as the destination host requests it.

      • To add a password, click Passwords > , then enter the password corresponding to the username.

      • To upload a private key, click SSH Keys > > , then paste or upload a private key.

        		 NOTE:

        If the private key is protected by a passphrase, enter the passphrase. The passphrase is needed only once during the upload, it is not required for the later operation of the Credential Store.

      • To generate a keypair on SPS click SSH Keys > > , set the length and type of the key, then click Generate. After that, click the fingerprint of the key to download the public part of the keypair. There is no way to download the private key from the SPS web interface.

        		 NOTE:

        One Identity recommends using 2048-bit RSA keys (or stronger).

      • To upload a certificate and the corresponding private key, click X509 Keys > > , then paste or upload a certificate and the private key.

        		 NOTE:

        If the private key is protected by a passphrase, enter the passphrase. The passphrase is needed only once during the upload, it is not required for the later operation of the Credential Store.

      		 NOTE:

      One Identity Safeguard for Privileged Sessions (SPS) accepts passwords that are not longer than 150 characters. The following special characters can be used: !"#$%&'()*+,-./:;<=>?@[\]^-`{|}

    3. Repeat the previous step to add further credentials to the username as necessary.

  2. Repeat the previous step to add further hosts or usernames as necessary.

    		 NOTE:

    Credential Stores can be used together with usermapping policies to simplify the administration of users on the target hosts. For details, see Configuring usermapping policies.

  1. Click Commit.

  2. Navigate to the Connection policy where you want to use the Credential Store (for example, to SSH Control > Connections), select the Credential Store to use in the Credential Store field, then click Commit.

    		 NOTE:

    The Connection Policy will ignore the settings for server-side authentication (set under Relayed authentication methods) if a Credential Store is used in the Connection Policy.

    Figure 259: <Protocol name> Control > Connections — Select a Credential Store to use

Performing gateway authentication to RDP servers using local Credential Store and NLA

The following describes how to perform a gateway authentication to RDP servers using local Credential Store and Network Level Authentication (NLA).

To perform a gateway authentication to RDP servers using local Credential Store and NLA

  1. Initiate the RDP connection.

  2. Enter your gateway credentials during the gateway authentication. This can be web gateway authentication, or inband gateway authentication using RD Gateway.

  3. Enter the following:

    • In the Username field, enter the domain name, the -AUTO suffix, and your username. For example, EXAMPLEDOMAIN-AUTO\Administrator.

      		 NOTE:

      The -AUTO suffix is the default value of the RDP Control > Settings > Autologon domain suffix option of One Identity Safeguard for Privileged Sessions (SPS). If your SPS administrator has changed this option, use the appropriate suffix instead of -AUTO.

    • Enter your username (only the username, without the domain, for example, Administrator) into the Password field.

  4. If the authentication is successful, the desktop of the remote server is displayed.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级