Server Requirements
Multiple, Load-Balanced Servers
Hitachi ID Privileged Password Manager supports multiple, load-balanced servers.
Each server can host multiple Privileged Password Manager instances, each with its own users, managed systems, features and policies.
Server Platform
Privileged Password Manager must be installed on a Windows 2003 or Windows 2008 server.
Installing on Windows 2003 or Windows 2008 allows Privileged Password Manager to leverage client software for most types of target systems, which is available only on the "Wintel" platform. In turn, this makes it possible for Privileged Password Manager to manage passwords and accounts on target systems without installing a server-side agent.
The Privileged Password Manager server must also be configured with a web server. Since the Privileged Password Manager application is implemented as CGI executables, any web server will work. The Privileged Password Manager installation program can detect and automatically configure IIS or Apache web servers, but other web servers can be configured manually.
Privileged Password Manager is a security application and should be locked down accordingly. Please refer to the Hitachi ID Systems document about hardening Privileged Password Manager servers to learn how to do this. In short, most of the native Windows services can and should be removed, leaving a very small attack surface, with exactly one inbound TCP/IP port (443):
- IIS is not required (Apache is a reasonable substitute).
- No ASP, JSP or PHP are used, so these engines should be disabled.
- .NET is not required on the web UI, so should be disabled on IIS.
- No ODBC or DCOM are required inbound, so these services should at least be filtered.
- File sharing should be disabled.
- Remote registry services should be disabled.
- Inbound TCP/IP connections should be firewalled, allowing only port 443 and possibly terminal services (if required for some configuration tasks).
Server Configuration
(1) Each Privileged Password Manager server is configured as follows:
- Hardware requirements:
- A Pentium-IV class or better x86 CPU with at least 1 CPU core. Note that multi-core CPUs are supported and leveraged.
- At least 4GB RAM -- more is better.
- At least 100GB disk, preferably configured as RAID for reliability and preferably larger to hold more historical data and log files.
- At least one Gigabit Ethernet NIC.
A similarly equipped virtual machine can also be used.
- Operating system:
- Windows 2003 or Windows 2008 (or R2) Server with current service packs.
- 32-bit or 64-bit versions are both acceptable.
- The server should not normally be a domain controller.
- Installed and tested software on the server:
- TCP/IP networking, with a static IP address and DNS name.
- Web server (Apache/Windows or IIS or).
- Client software: web browser, Acrobat reader (to read the manual) native clients for the systems that Privileged Password Manager needs to interface with.
- SQL Server client or Oracle client to connect to the Privileged Password Manager database.
- If the Privileged Password Manager database is local (reduces hardware cost), then SQL Server or Oracle Database.
- SSL server certificate, to support HTTPS UI sessions.
In addition to a web server, Privileged Password Manager requires a database server. In most environments, the database server software (Microsoft SQL Server or Oracle Database Server) can be installed on the same hardware as the Privileged Password Manager software. This reduces hardware cost, eliminates network latency and reduces the security surface of the combined solution. In large deployments, a separate database server may be required, so as to distribute the processing load between application and data components. In these cases, the database server is typically configured similarly to the application server and co-located with the application.