System Administration (New UI)

System messages are generated by the VPAM server itself and are not attributable to any specific user. Therefore, User ID is not present in System Messages. These messages include system logins, login failures, debug information, password resets, and Desktop Sharing video recording management information.

The User Activity section of the Admin Logs helps determine "who's doing what" within the system. While the Activity Reports show the actions taken by users when connected to a Gatekeeper, the User Activity section specifically tracks changes made to system objects.

As its name suggests, the Authorized Domains section contains a list of all the domains (@domain.com) that a user's or customer's email can have to access your VPAM server. The system displays these authorized domains in the New Customer and New User forms. Only System Admins can add, remove, and set domains as primary.

To create an authorized domain:

1. Click Add.

2. Type the domain after the @ symbol.
   
   Instead of "@company.com", type "company.com".

3. Click Save.

To remove an authorized domain, click Remove in the domain list. The system must have at least one authorized domain at all times, so you can only remove domains when you have created a new domain, and have set it to Default.

To set a domain as the Default, select Set as Default in the domain list. The domain moves to the top of the list.

Maintenance Mode disables access to the VPAM server to non-administrator users. When you set your VPAM server in Maintenance Mode, the system displays a customizable message that your non-admin users will see when trying to log in to the VPAM server.

Select the Schedule end of maintenance mode at: option to provide access to your users at a specific date and time. If you do not set an end date, a System Admin must Disable the maintenance mode manually in this same page.

The system effectively disables access 10 minutes after you click Save.

Secret Check Out provides exclusive access to the user who checks out the secret. Other users cannot view the password, unlock, edit, or connect to associated host services that use the secret. The system suspends task rotation until the secret is checked back in. Only administrators can check in a secret that another user has checked out. If you disable this feature, the system prevents new checkouts but does not affect secrets that are already checked out.

For more information, see Vault or Credentials.

Syslog Server enables you to export audit and system events to an external server running the Syslog service.

Syslog Configuration for Cloud Customers

Imprivata Cloud customers may not be able to configure the Syslog Server directly through the System Settings page of their VPAM server. Before you continue with your Syslog Configuration in the System Settings page, you must first:

1. Navigate to System Admin > Settings > Tunneled Services.

2. Create a new tunnel service for your Syslog server.

3. Provide the following information

   • Description: Provide a description for the service.

   • Host Name: Provide the DNS or FQDN of the syslog server.

   • Port: Set the default port 514 or alternate port for your syslog server.
     
     

     IMPORTANT:
     
     If you use the default port 514, no additional configuration or assistance is required. However, if you specify a non-standard port, you must contactImprivata Support to open the corresponding firewall port to enable connectivity
     
     

   • Protocol: Select UDP as the syslog server protocol.

4. Save the service.

To configure the Syslog Server Setting:

1. Select the type of server protocol you want to use.
   

2. Provide the system with the IP Address or hostname of the server.
   If you have not configured DNS resolution in your VPAM server, it is recommended to use IP Addresses, instead of host names when specifying a syslog server.

3. Specify the communication port.
   If no port is specified, port 514 is assumed.

   IMPORTANT:

   If you use the default port 514, no additional configuration or assistance is required. However, if you specify a non-standard port, you must contact ImprivataSupport to open the corresponding firewall port to enable connectivity.

The options RFC-5425 (TCP, with TLS) and RFC-3164 (TCP, with TLS) enable you to add more secure, flexible, and standards-compliant event logging across varied network environments. These options activate the following sections:

• Syslog Server SSL Settings: The system enables you to either upload the syslog server SSL certificate or disable the verification.

• Client Authentication Settings: The system enables you to use client authentication settings that require you upload the keystore file and password.

The Connection Manager Cipher Preference setting enables you to express a preference for the encryption cipher used in the Connection Manager when users connect to the VPAM sessions. Since export control may limit the available ciphers for some users, a small amount of users may fall-back to using a cipher with a shorter key length than the expressed preference. VPAM recommends 128-bit AES as a compromise between connection efficiency and security appropriate for most systems.

The System Message opens as a banner across the top of the Login page, or optionally on every page. This is useful to notify Users of upcoming system downtime or system policy changes. You can select when to start and stop displaying the message, the display location and set the text and background colors of the message. To delete a message, clear the Message area and click Save.

The Login Page Note appears as a notice on the Login page. This is useful to provide information to everyone prior to login. You can use HTML in the note, which is sanitized before display to prevent dangerous tags.

Login Help Contact Information appears as a help contact information in Authorization when a key is requested right after being authenticated in Login, and in forgot password. This is useful to provide information about who to contact in case the authorization key is not received or the password is forgotten. You can use HTML in the contact information, which is sanitized before display to prevent dangerous tags.

The Vendor Representative Terms and Conditions appears during the login process and requires Vendor Representatives to acknowledge the terms before they can continue. This is useful to ensure compliance with your organization’s access policies. You can enter and update the terms as needed.

The Disabled Vendor Representative Message appears when a disabled Vendor Representative attempts to log in. This is useful to inform the user of their account status and provide next steps or contact information. You can customize the message content.

Support Contact Statement allows you to customize the contact information on the footer of the emails sent by the application. The default values are a general VPAM contact email and phone number. You can update one or both values to reflect specific internal support routes, such as a help desk or administrator.

The Feedback Email specifies the email address that receives notifications when users submit Report a Problem issues or Vendor Feedback. This is useful to ensure feedback is routed to the appropriate support or administrative team.