Machine.
l
Do not assign a public IP address to SPS, use SPS as a component of your
internal infrastructure. If you absolutely must configure Welcome Wizard
from a publicly accessible IP address, note that SPS will be publicly
accessible. If you assign a public IP to the web management interface,
consider the following:
l
Select a complex passphrase.
l
Limit access to the management interface based on the source IP
address, and make sure that brute-force protection for the administrator
web login is enabled (they are enabled by default). For details, see
"Configuring user and administrator login addresses" in the
Administration Guide
.
l
Configure an email alert or SNMP trap for administrator logon events.
For details, see
"Configuring e-mail alerts" in the Administration Guide
"Configuring SNMP alerts" in the Administration Guide
l
Forward the logs of SPS to a log server (for example, to a
server, or an syslog-ng Store Box appliance
) so that if the local logs are
compromised, you still have an authentic copy of the original logs.
l
For security reasons, disable SSH access to SPS when it is not needed.
Accessing the SPS host directly using SSH is not recommended or
supported, except for troubleshooting purposes. If you enable SSH
access, restrict the clients that can access SPS based on their source IP
address, and make sure that brute-force protection is enabled (they are
enabled by default). For details, see
"Enabling SSH access to the One
Identity Safeguard for Privileged Sessions (SPS) host" in the
Administration Guide
.
l
To prevent unauthorized access to the audit trail files recorded on SPS,
configure proper access control rules for the user groups and encrypt
every audit trail. If you use encryption, store your keys in the personal
or in the temporary key store. For details, see
,
l
Upgrading SPS in Azure is the same as upgrading a physical appliance: you have to
upload the firmware on the SPS web interface. For detailed instructions, see
SPS 6.0 Installation Guide
Deploying One Identity Safeguard for Privileged Sessions from the Azure
Marketplace
32
