The following limitations apply to running version 7.0.3.1 LTS of SPS under KVM:
-
SPS can be installed under KVM on most modern Linux distributions. One Identity currently tests the following KVM version:
# virsh version
Compiled against library: libvirt 1.2.17
Using library: libvirt 1.2.17
Using API: QEMU 1.2.17
Running hypervisor: QEMU 1.5.3
-
SPS can only use fixed disk space assigned to the virtual host, it is not possible to use on-demand disk allocation scenarios.
-
If High Availability (HA) operation mode is required in a virtual environment, use the HA function provided by the virtual environment.
-
Hardware-related alerts and status indicators of SPS may display inaccurate information, for example, display degraded RAID status.
Deploying One Identity Safeguard for Privileged Sessions from the Azure Marketplace
This guide provides detailed descriptions for deploying One Identity Safeguard for Privileged Sessions (SPS) from the Microsoft Azure Marketplace.
Before you start:
Before you start evaluating SPS, make sure you understand what SPS is and how it works. This information can greatly help you get SPS operational.
The following prerequisites must be met to deploy SPS in Microsoft Azure:
-
You have a valid One Identity Safeguard for Privileged Sessions license. When deployed from the Microsoft Azure Marketplace, the One Identity Safeguard for Privileged Sessions uses the "Bring your own license" model. Note that to deploy two active SPS nodes as an availability set, you must purchase two standalone SPS licenses. To purchase a license, contact our Sales Team.
-
Microsoft recommends to use the Azure Resource Manager (ARM) deployment model. When you install SPS from the Azure Marketplace, SPS supports only this deployment method. If you need to deploy SPS into and infrastructure that uses the Classic deployment model, contact your One Identity sales representative.
-
You have a Microsoft Azure account.
The following limitations apply to SPS when you deploy it from the Microsoft Azure Marketplace.
|
|
Caution:
Do not export or import configuration between a physical SPS deployment and a virtual one. Because of the differences and limitations between physical and virtual appliances, configure the virtual appliance from scratch to ensure proper functionality. When you migrate a virtual SPS to another one, you can export and import the configuration. |
-
Root login is not available on the console.
-
SSH access is only available after you have completed the Welcome Wizard.
-
Currently, the data that is entered during the provisioning phase (for example, the username and the IP address) of creating the virtual machine in Azure is not transferred to SPS. Therefore, only the data entered in the Welcome Wizard will be used.
-
By default, you can only use Physical interface 1 (eth0) of SPS, with a single IP address. Aside from changing the IP address of SPS, do not modify other interface-related settings (additional logical interfaces, IP forwarding, and so on) on the Basic Settings > Network page of SPS.
The number of interfaces you can use depends on the size of your Azure VM. If your VM allows you to use multiple interfaces, you can configure multiple interfaces in SPS. For details, see VM with multiple NICs.
-
The Seal the box functionality is not available.
-
The High Availability support of SPS was designed to work between two physical SPS appliances. This feature is not available in Azure environments. For further details, see the High Availability and redundancy in Microsoft Azure.
-
Due to Azure requirements, an additional 5-minute delay has been added to the boot process. This ensures that the root device appears in the system.
-
The size of the virtual disk in Azure is 100 GB, which you can increase. To increase the size of the virtual disk, see "Modifying the disk size of a SPS virtual appliance" in the Installation Guide.
-
SPS currently cannot receive its IP address using DHCP. Make sure that:
-
The IP address you have configured in Azure and the IP address that you configure for SPS for the Physical interface 1 on the Networking settings part of the Welcome Wizard are the same. Otherwise, you will not be able to access SPS.
-
You set the internal IP static on the Network Interfaces tab of the Virtual Machine.
-
Do not assign a public IP address to SPS, use SPS as a component of your internal infrastructure. If you absolutely must configure Welcome Wizard from a publicly accessible IP address, note that SPS will be publicly accessible. If you assign a public IP to the web management interface, consider the following:
-
Select a complex passphrase.
-
Limit access to the management interface based on the source IP address, and make sure that brute-force protection for the administrator web login is enabled (they are enabled by default). For details, see "Configuring user and administrator login addresses" in the Administration Guide.
-
Configure an email alert or SNMP trap for administrator logon events. For details, see "Configuring e-mail alerts" in the Administration Guide and "Configuring SNMP alerts" in the Administration Guide.
-
Forward the logs of SPS to a log server (for example, to a syslog-ng server, or an syslog-ng Store Box appliance) so that if the local logs are compromised, you still have an authentic copy of the original logs.
-
For security reasons, disable SSH access to SPS when it is not needed. Accessing the SPS host directly using SSH is not recommended or supported, except for troubleshooting purposes. If you enable SSH access, restrict the clients that can access SPS based on their source IP address, and make sure that brute-force protection is enabled (they are enabled by default). For details, see "Enabling SSH access to the One Identity Safeguard for Privileged Sessions (SPS) host" in the Administration Guide.
-
To prevent unauthorized access to the audit trail files recorded on SPS, configure proper access control rules for the user groups and encrypt every audit trail. If you use encryption, store your keys in the personal or in the temporary key store. For details, see "Encrypting audit trails" in the Administration Guide,
-
Upgrading SPS in Azure is the same as upgrading a physical appliance: you have to upload the firmware on the SPS web interface. For detailed instructions, see Upgrade Guide.
