立即与支持人员聊天
与支持团队交流

Safeguard for Privileged Passwords On Demand Hosted - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Getting started with the desktop client Using the desktop client Activity Center Search box Privileged access requests Toolbox Accounts Account Groups Assets
General/Properties tab (asset) Accounts tab (asset) Account Dependencies tab (asset) Owners tab (asset) Access Request Policies tab (asset) Asset Groups tab (asset) Discovered SSH Keys (asset) Discovered Services tab (asset) History tab (asset) Managing assets
Asset Groups Discovery Entitlements Linked Accounts Partitions Profiles Settings
Access Request settings Appliance settings Asset Management settings Tags Backup and Retention settings Certificates settings Cluster settings Enable or Disable Services settings External Integration settings Password Management settings Real-Time Reports Safeguard Access settings SSH Key Management settings Security Policy Settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 or later migration guidance Appendix C: SPP and SPS join guidance Appendix D: Regular Expressions About us

Preparing Amazon Web Services platforms

Safeguard for Privileged Passwords supports Amazon Web Services (AWS), a secure cloud services platform.

When adding an Amazon Web Services asset, the Network Address must contain the AWS Account ID or Alias.

To prepare Amazon Web Services platforms for Safeguard for Privileged Passwords

  1. In Safeguard for Privileged Passwords:

    1. Add Amazon's certificate and AWS certificate's root certificate authority (CA) to the Trusted Certificates store in Safeguard for Privileged Passwords.

    2. Configure an Identity and Access Management (IAM) user to use as a service account.
    3. Assign the IAM service account to the AdministratorAccess security policy.

  2. In Amazon:

    1. Create an access key for the IAM service account. Amazon creates a pair of data items called a Secret Key and a public Access Key ID. Take a note of both the Access Key ID and Secret Key. You will need them when you add the Amazon Web Services asset to Safeguard for Privileged Passwords.

Preparing Cisco devices

There are 4 Cisco platforms supported in Safeguard for Privileged Passwords:

  • Cisco ISE CLI platform: Safeguard for Privileged Passwords uses a local service account to manage accounts on the ISE CLI platform using SSH.

  • Cisco IOS/ASA platform: Cisco IOS/ASA platforms can be configured in the following ways to manage local accounts using SSH:

    • Safeguard for Privileged Passwords uses a local service account to manage accounts on the Cisco device.

    • If the Cisco device is configured (using AAA) to authenticate and authorize login requests to a Cisco ISE server that will be managed by Safeguard for Privileged Passwords, then you can use a directory account in the Cisco ISE directory asset to manage the Cisco device.

    • If the Cisco device is configured (using AAA) to authenticate and authorize login requests to a Cisco ISE server that is integrated with an Active Directory domain that will be managed by Safeguard for Privileged Passwords, then you can use a directory account in the Active Directory asset to manage accounts on the Cisco device.

  • Cisco ISE platform: Cisco ISE is managed as a directory asset in Safeguard for Privileged Passwords. It uses REST and TACACS+ to manage local accounts. It supports account discovery and password management. It does not support directory synchronization, asset discovery, or service discovery.

  • Cisco NX-OS platform: In order to perform all required operations on users, the service account used requires at least network-admin privileges.

ClosedCisco ISE CLI platform
ClosedCisco IOS/ASA platform
ClosedCisco ISE platform
ClosedCisco NX-OS platform

Preparing Dell iDRAC devices

Safeguard for Privileged Passwordssupports the Dell Remote Access Controller that is integrated with Dell PowerEdge servers. Safeguard for Privileged Passwords uses the SSH protocol to connect to iDRAC devices.

To prepare an iDRAC device for Safeguard for Privileged Passwords

  1. Use iDRAC to create a service account with administrator privileges and assign it a password.

    The service account must have login privileges and must be able to configure users.

  2. Verify that SSH is enabled in the iDRAC Network settings.
  3. In Safeguard for Privileged Passwords, create the asset and accounts for the iDRAC device using password authentication.

Preparing VMware ESXi hosts

Safeguard for Privileged Passwords supports VMware ESXi hosts.

IMPORTANT: Safeguard for Privileged Passwords can only manage local users on a VMware host.

To prepare a VMware ESXi host for Safeguard for Privileged Passwords

  1. Use an existing account or create a new account as the service account on the asset and assign it a password.

    The default administrator account is suitable.

  2. Grant the service account the privileges required to set user passwords using the web management API.
  3. When adding a VMware ESXi host to Safeguard for Privileged Passwords:
    1. Specify the network address.
    2. Specify port 443 as the HTTPS port.
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级