Skip to main content
Version: 3.22

Technical Specification

Introduction

senhasegura® is a security platform composed of software, operating system and hardware. This modularized platform meets the most stringent security standards in the industry.

In this document we will cover the main technical aspects of senhasegura® .

System Modules Architecture

The senhasegura® software solution is divided into the following modules:

Modules Architecture

These components support the operation of the senhasegura® , from the physical layer to the application layer.

  • Business layer: where all senhasegura features are located, from integrations to activity recording

  • Application Server layer: where Orbini is located, MT4 developed framework to support all solution features

  • Virtual Appliance: virtual device where the solution is executed

  • Appliance layer: senhasegura hardware solution

Basic Systems Solution Components

In addition to the modules presented, the solution has basic embedded software components integrated into the solution itself, without the need for external resources:

  1. Optimized and hardenized1 over all aspects (Application, Data Base, File System, etc) Linux-based operating system. The system has only the minimum services running, obeying the Minimum Privilege Principle, and kernel adapted to the functionality of the solution.

  2. Own database, no license required

  3. Own and integrated web server

  4. Embedded web interface, no licenses or additional features to use. With just a single network configuration interface, it is already possible for the deployer to have access to the HTTPS web interface so that all other configurations can be performed in a secure and user-friendly graphical environment.

Ports

On virtual and physical appliances senhasegura® , only service ports are released:

Protocol/PortFunction
TCP/22SSH Server
TCP/80Web Server with redirection to port 443
TCP/443Web Application Server
UDP/161SNMP
UDP/162SNMP
TCP/3389RDP Proxy
TCP/3306Database cluster
TCP/4444Database cluster
TCP/4567Database cluster
TCP/4568Database cluster
UDP/4567Database cluster

Language

The solution has all interfaces in the following languages:

  1. Brazilian Portuguese (PT-BR)

  2. United States English (EN-US)

  3. Germany (DE)

  4. Spanish (ES)

  5. Polish (PL)

  6. French (FR)

  7. Russian (RU)

The solution allow user input and storage using UTF-8 charset:

  1. Arabic

  2. Arabic Extended-A

  3. Arabic Extended-B

  4. Arabic Mathematical Alphabetic Symbols

  5. Arabic Presentation Forms-A

  6. Arabic Presentation Forms-B

  7. Arabic Supplement

  8. Basic Latin

  9. Bopomofo Extended

  10. CJK Compatibility

  11. CJK Strokes

  12. CJK Symbols and Punctuation

  13. CJK Unified Ideographs

  14. CJK Unified Ideographs

  15. CJK Unified Ideographs Extension B

  16. CJK Unified Ideographs Extension C

  17. CJK Unified Ideographs Extension D

  18. CJK Unified Ideographs Extension E

  19. CJK Unified Ideographs Extension F

  20. Cyrillic

  21. Cyrillic Supplement

  22. Enclosed CJK Letters a

  23. French

  24. Hangul Compatibility J

  25. Hebrew

  26. Hiragana

  27. Kanbun

  28. Katakana

  29. Katakana Phonetic Exte

  30. Latin Extended-A

  31. Latin-1 Supplement

  32. Syriac

  33. Syriac Supplement

  34. Russian

  35. Yijing Hexagram Symbol

Documentation

The solution has user manuals in the following languages:

  1. Brazilian Portuguese (PT-BR)

  2. United States English (EN-US)

Compatibility ISO 27001, PCI, SOX, GDPR, PQO BM&F

senhasegura® enables organizations to deploy the most stringent and complex privileged credential access controls required by standards such as ISO 27001, PCI, SOX, GDPR and PQO by automating privileged access controls, protecting the IT park from data breaches and potential compliance violations.

Component Update

senhasegura® Research and Development team is aligned with updates to the third party components that make up the solution. The process of updating these components is done through a fast communication channel, and is performed on customers if a critical demand is released.

The tool update process is aligned with the client's own update policy. In this case, a team will be deployed to fulfill the installation flow with the least risk of impact to the customer's business.

Functional Feature by Modules

caution

The senhasegura® do not allow the installation of other softwares.

Base Module - System Access Settings

This module has the following functions:

  • senhasegura® Authentication: senhasegura® has its own authentication module with functionality that: Implies in user blocking after a determined amount of unsuccessful login attempts. Change the password in the first login, validation of the complexity of the new password created with comparison of the history of passwords used.

  • User Registration: Complete user registration with change and configuration traceability.

  • Profile Management: Advanced granular profile management with ability to create according to each user profile.

  • Screen's Log: System screen view log.

  • Screen Identification by codes: Each system screen is uniquely identified with a code, making service and support easy.

  • External Authentication Servers: In addition to its own authentication module, senhasegura® can be used in conjunction with other directory services. You can set up senhasegura® to perform authentication across multiple servers, including establishing an authentication order. The main authentication servers that integrate with senhasegura® are Active Directory, LDAP, TACACS and RADIUS.

  • Two Factor Authentication: You can reinforce the authentication process through double factor authentication using, for example, the Google Authenticator application.

  • IP Access Blocking: senhasegura® is able to block access through a pre-established IP denylist.

  • Session Management: In the tool, the session management module is responsible for checking session validity and setting a timeout until the next login.

  • Authentication with A1 and A3 Certificates: The authentication process can be carried out using A1 and A3 certificates as the second authentication factor.

Base Module - Password and Information Vault

This module is the core of the password vault, and has the following functions:

  • Password Guard: Storage of passwords in the vault, encrypted in AES 256 algorithm with double encryption factor. Passwords can only be accessed in this module through the Access Management module.

  • Protected Information Guard: The password vault allows encrypted storage of information such as tokens, certificates and files in general.

  • Backup of Secrets: Passwords, protected information, and SSH keys require an independent backup unit in the solution.

    The information vault and passwords are responsible for writing the secrets to a backup encrypted by the Shamir algorithm-based master vault key.

  • HSM Integration: Integration with external or internal Hardware Security Module devices

Base Module - Equipment Register

This module is the password senhasegura® interface with the assets that will have their passwords managed, and includes the following functions:

  • Registration Interface: Where the equipment registration occurs, either by web screen individually, or by the batch registration process.

  • Connector Management: Each device has ports for connection and protocol for access. This module manages the configured connections and communicates with the devices.

  • Connectivity Test: Periodically, senhasegura® will connect to registered devices and validate their connectivity. Users can be alerted of test results.

  • Equipment Profile: Equipment types and models have default swap profiles and password templates in the tool. This module relates devices to these policies.

Base Module - Access to Information, Passwords, and Session Policies

The access policy module is the only one with access to the password and information vault, and has the following functions:

  • Access Workflow: The access workflow initiates an approval process for the delivery of the authenticated session or password. This process has different configurations and routes, depending on the client configurations.

  • Access Approvation: The access approval function allows the approving user to respond to the access request by:

    • User screen

    • E-mail

    • SMS

    • Emergency Access

  • Password Split: This function is responsible for breaking the password in two parts. for segmented delivery, and is relevant for PCI compliance.

  • Access Control: The access control module unifies the three entities considered in the decision to surrender the credential or access:

    • Delivery Policy

    • Involved Users

    • Related Equipment

    The joining of these entities defines the session delivery criteria in the system.

  • User Timing: The access control module can be synchronized with an authentication server. Users of a particular group on the authentication server are loaded into the senhasegura® access groups, making access management easier.

Base Module - Reports

  • Reporting Configuration: Through the interface, the user can remove or add information to a particular report. You can create a whole new view of information that is useful to your needs.

  • Shipping Schedule: The reports you create can be set to automatically send to certain users.

  • PCI Reports: Set of specific reports to meet requirements required by PCI audits.

  • Audit Trails: senhasegura® has reports with all relevant system events. Events can be exported to SIEM and Syslog.

Base Module - Dashboards

  • System Health: Responsible for graphically displaying the overview of senhasegura® hardware and Virtual Machines. You can view data such as I / O, memory, and processing.

  • Process Monitoring: Monitors execution of key vault processes:

    • Password Changes

    • Access Group Synchronisms

    • Password Reconciliation

    • Connectivity Tests

    • Settings Backup

    • Password's backup

  • Business Monitoring: Monitors health for credential and information protection:

    • Number of Passwords changed x Failures

    • by period

    • Number of Sessions:

    • Active and Concurrent x System Average

    • Recorded (by period)

    • Average session time logged in

    • Users logged in to the system

Password Change Module

  • SSH Password Change: Make the connection and run the default password exchange script on the device using the SSH protocol, without the need for agents installed.

  • Windows Server: Windows Password Exchange connects to a Windows server and runs local password exchange scripts without the need for agents installed.

    Through the use of native Microsoft protocols (SMB, RPC, RM / WMI) senhasegura® is able to interact with the device using commands from the protocols or through PowerShell commands if protocol support is enabled.

  • Network Asset: Make the connection and run the default password exchange script on the device using the SSH protocol, without the need for agents installed.

  • Desktop: Make the connection and execute the default exchange script for that password on that desktop using various desktop-based protocols.

  • Database: Make the connection and execute the default exchange script for that password in that database using the base protocol.

Password Reconciliation Module

Password reconciliations happen in the same way on servers, network assets, desktops and banks: Access to devices and accounts is periodically performed trying to authenticate with the last password in custody, validating whether custody remains under the password safe.

Windows Session Management Module

  • Session Delivery: Authenticated session delivery is performed without entering a username or password.

  • Session Recording: During access to the authenticated session, the system records the session in video and text.

  • MP4 Video Generation: Recorded video can be generated in mp4 format to be downloaded and uploaded.

  • Audited Proxy Support: Native audited proxy support for SSH and RDP connectivity of client applications installed on clients. For compatibility between manufacturers, all proxy modules use current encryption algorithms and native protocol.

Management Module - Linux Sessions

  • Linux Web Session Delivery: Authenticated session delivery is performed without entering a username or password

  • Web Session Recording: During access to the authenticated session, the system records the session in video and text.

  • MP4 Video Generation: Recorded video can be generated in mp4 format to be downloaded and uploaded.

  • Audited Proxy Support: Native audited proxy support for SSH and RDP connectivity of client applications installed on clients. For compatibility between manufacturers, all proxy modules use current encryption algorithms and native protocol.

SSH Gate Session Management Module - senhasegura® Terminal Proxy

  • Linux Session Delivery via SSH Gate: Authenticated session delivery is performed without entering a username or password. This is done transparently to the user through any SSH client.

  • Web Session Recording: During access to the authenticated session, the system records the session in text.

  • Command Audit: All commands sent to the server through senhasegura® , and can be audited and generated Command Execution alerts.

  • Privilege Control: It has granular control of commands that can be executed with the possibility of blocking those not authorized for execution to the user.

  • Audited Proxy Support: Native audited proxy support for SSH and RDP connectivity of client applications installed on clients. For compatibility between manufacturers, all proxy modules use current encryption algorithms and native protocol.

Management Module - HTTP Sessions

  • HTTP and HTTPS Session Delivery: Authenticated session delivery to a page is done without the need for a username or password.

  • Web Session Recording: During access to the authenticated session, the system records the video session.

  • MP4 Video Generation: Recorded video can be generated in mp4 format to be downloaded and uploaded.

Discovery Module

  • Windows Passwords: Discover administrative credentials on Microsoft platform servers and desktops, identifying which ones are privileged, and importing into the vault.

  • Linux / Unix / AIX Passwords: Discover administrative credentials on Linux / Unix / Aix servers and desktops, identifying which ones are privileged, and importing into the vault.

  • AD Passwords: Discover administrative credentials on the Microsoft platform Active Directory server, identifying which ones are privileged, and importing into the vault.

  • SQL / Oracle Passwords: Discover administrative credentials in databases, identifying which ones are privileged, and importing into the vault.

  • SSH Keys: Discovers public and private SSH keys that are present on the target device.

  • Certificates: Find local or Windows user certificates stored in devices, containers or on the domain.

  • Local Authorities: Find local authorities for the devices.

  • Services: Find out what services are being performed on the target device.

  • DevOps: Find DevOps artifacts that are present in the devices.

  • Glossary of Provisions: Allows to create scan list with segmentation by type

Module A2A - App to App

  • .Net: Password delivery via lib on .Net to be added to platform application code.

  • Java: Password delivery via passwords lib in Java to be added to platform application code.

  • PHP: Password delivery via passwords lib in PHP to be added to the platform application code.

  • Application Server: Password change in the main Application Servers of the market.

  • senhasegura API: Password delivery through the senhasegura® API.

Module senhasegura.go

senhasegura.go allows you to invoke administrator privileges to run applications on local workstations. This module is based on .NET Framework for 4.8.

Supported Integrations

senhasegura® has several types of integration, besides the possibility of configuring integration templates. The templates are open and can be modified by the administrator.

Performing integration may require specific plug-ins. Password architecture and integration features allow senhasegura® to develop plug-ins quickly.

senhasegura® is noninvasive. Therefore, no agent installation is required on the systems managed by the solution. For some applications it is possible to use senhasegura® through agents to create more integration possibilities.

Operational System

VendorsModels
AppleOS X
CiscoCisco IOS, NX-OS (Nexus)
EMCUNIX
F5Big IP, LTM
HPHPUX, Tru64, NonStop (Tandem), Open VMS, HP5500, Tande
IBMAIX, iSeries, Z/OS, CICS, OS/390
LinuxFedora, Ubuntu, Red Hat, SUSE Linux, Debian
MicrosoftWindows XP, Windows Vista, Windows 7, Windows 8 / 8.1, Windows 10, Windows Server 2003, 2008, 2012, 2016
NetAppNetApp
OracleSolaris, Solaris Intel, Enterprise Linux
JuniperJUNOS

Network Equipment

VendorsModels
3ComSwitches
A10 NetworksA10
AdtranNetVanta 838, Tracer 6420
AlcatelSwitches, Switches (Omniswitch 7000 Series), Intelligent Services Access Manager (ISAM)
AllotAllot Secure Service Gateway, Allot Service Gateway, Allot SmartEngage, Allot WebSafe Personal
Applied InnovationAISCOUT-S02
Aruba NetworksArubaOS
AvayaMedia Gateway
AvocentDSView management
BlueCoatPacketShaper
BrocadeSilkworm
BTI Photonic SystemsNETSTENDER 1030
CiscoRouters, ACS (Access Control Server), Switches Catalyst, Switches Nexus, JMC, Wireless LAN Controller 5508, WAAS, ONS, ESA (Email Security Appliance), Privilege 15, Unified Communication Manager, ISE (Identity Services Engine), UCS (Unified Computing System)
CitrixNetscaler
DellSwitches
EnterasysRouters, Switches
EricssonServiceOn Element Manager (SOME)
F5BigIP, LTM
FujitsuFSC iRMC
GemaltoSafeNet KeySecure, SafeNet HSM
HPProCurve, HPE 5500
HuaweiS1720, S2700, S5700, S6720, S6720 V200R011C10
JuniperRouters (JUNOS), Pulse secure
McafeenDLP
MeinbergLantime
NetscoutInfinistream
NokiaNetAct, DX200
NortelBayStack, VPN Router, Ethernet Routing Switch
RadwareISR Infiniband Switch, ODS1 Load Balancer, Alteon, Linkproof
RadwareISR Infiniband Switch, ODS1 Load Balancer, Alteon, Linkproof
RFL ElectronicsIMUX 2000
RiverbedCMI, Xilinx
RuggedComRouters, Switches
SymmetricomSymmetricom Xli
VoltaireISR Infiniband Switch
Extreme NetworksSwitch, Router
YamahaRTX

Applications Servers

VendorsModels
Red HatJboss
KasperskyKaspersky Endpoint Security for Business
MicrosoftSQL Server, Exchange Server 2007 - 2019, entre outras aplicações que permitam interatividade via RemoteApp, Windows RPC, Windows SMB e Windows RM
VeritasNetBackup 7.7, 8.0, 8.1 e 8.2
IBMWebsphere Application Server, Websphere Datapower
Apache FoundationApache HTTP Server, Apache tomcat
OracleWebLogic Server
MicrosoftIIS

Security Devices (Firewall, UTMs, IPSs)

VendorsModels
Acme PacketNet-Net OS-E
AkerAker Firewall UTM
Blue CoatProxy SG
CheckpointFireWall-1, SPLAT, Provider-1, GAIA
Cisco SystemsPIX, ASA, IronPort, Mail Gateway
Critical PathMemova Anti-Abuse
FortinetFortiGate, Fortimanager
IBMDataPower Integration Appliance
JuniperNetscreen
McafeeNSM (Network Security Manager), SideWinder, ePO
NokiaCheckpoint FireWall -1 on IPSO
Palo Alto Networks®Panorama
ProofPointProtection Server
RSAAuthentication Manager (SecurID)
SafenetLuna HSM
SchneiderIndustrial Defender
SonicWallFirewalls
SophosAstaro Security Gateway
SourceFireSourceFire 3D
SymantecBrightmail Gateway
TippingPointIPS, SMS
WatchGuardFirebox X Edge e-series, Firebox X Core e-series, Firebox X Peak e-series, WatchGuard XTM

Virtualization Environments

VendorsModels
VMwareESX/ESXi Server
CitrixXen Citrix
MicrosoftHyper-V, Azure
GoogleGoogle Cloud Platform (GCP)
AmazonAmazon Web Services (AWS)
GenericISO installation media

Database

VendorsModels
IBMDB2, Informix, Datastage
InterSystemsCaché Release 2010 - 2017 (and other supported ODBC versions connected to devices with supported connectivity)
MicrosoftSQL Server
MongoDBMongoDB
MySQLMySQL
ODBCODBC compatible databases
OracleOracle Database, Oracle Enterprise Manage, RDBMS, Mysql 4 - 8
PostgresqlPostgresql 6 - 11
SAPHANA
SybaseSybase Database, IQ

Storages

VendorsModels
DellDell EMC PowerMax 2000, Dell EMC PowerMax 8000, Dell EMC SC5020, Dell EMC SC5020F, Dell EMC SC7020, Dell EMC SC7020F, Dell EMC SC9000 , Dell EMC SCv3000, Dell EMC Unity XT 380F, Dell EMC Unity XT 480F, Dell EMC Unity XT 680F, Dell EMC Unity XT 880F, Dell EMC XtremIO X2, Dell PowerVault, Dell EMC VMAX Among other models compatible with supported connections.
IBMStorwize V7000 Gen 3 ”Next Gen”, Storwize V7000 Gen 2+, Storwize V7000 Gen 2, Storwize V7000 family, Storwize V5100E, Storwize V5030E, Storwize V5010E, Storwize V5030, Storwize V5020, Storwize V5010, Storwize V5000
HuaweiOceanStor 18000F V5, OceanStor 5300 V3, OceanStor 5300F, OceanStor 5500 V3, OceanStor 5500F, OceanStor 5600 V3, OceanStor 5600F , OceanStor 5800 V3, OceanStor 5800F V5, OceanStor 6800 V3, OceanStor 6800F V5 Among other models compatible with supported connections
NetAppNetApp ONTAP (BSD)

Windows applications

VendorsModels
MicrosoftApplications developed under Java, .Net, PHP, Phyton, SQL accounts, Windows scheduled tasks, Windows services, Apache applications, IIS applications, COM+ services, Clustered applications

Directory Systems

VendorsModels
DigiDigi Remote Manager
FujitsuiRMC
MicrosoftActiveDirectory
NovellNovell Directory Services (NDS)
SunJava System Directory Server

Remote Access and Monitoring

VendorsModels
AmazonAmazon Web Services (AWS)
DellDell Remote Access Card (DRAC)
HPStorageWorks, iLO

DevOps environment, VSC and others SDLC softwares

VendorsModels
AnsibleAnsible
AtlassianBamboo CI/CD, JIRA Core, Bitbucket
GitLab Inc.GitLab CI/CD
GoogleKubernetes
JenkinsJenkins CI/CD

ITSM Tools

VendorsModels
AtlassianJira Service Desk
ZendeskZendesk
FreshworksFreshdesk
ServiceNowServiceNow ITSM

TOTP Tools

senhasegura 2FA function works with any Time-based One-Time Password (TOTP) tool. Here you can see some options:

VendorsModels
GoogleGoogle Authenticator
MicrosoftMicrosoft Authenticator
AuthyTwilio Authy 2-Factor Authentication
Red HatFreeOTP Authenticator
SophosSophos Authenticator
LastPassLastPass Authenticator
andOTPandOTP

Integration Plugins

IntegrationFunction
JenkinsAllows the consultation of secrets in the senhasegura®

SIEM Solutions

VendorModel
ExabeamVersion i31 onwards.
IBM QRadarVersion 7.3 onwards.
LogRhythmVersion 7.4 onwards.
Rapid7 - InsightIDRVersion 20180814 onwards.
Rapid7 - InsightOpsVersion 20190204 onwards.
SecuronixVersion 6.3 onwards.
SplunkVersion 6.3 onwards.

SCIM protocol solutions

VendorModel
OktaLifecycle Management

SSO solutions

VendorModel
OktaLifecycle Management
RSARSA SecurID
DuoDuo Multi-factor Authentication

Embedded browser version

ToolVersion
Firefox78.13.0esr (64-bit)

Encryption and Security Features

Encryption

All sensitive information provided is stored encrypted in the solution database using the AES-256 cipher.

For authentication to the senhasegura® web interface - both locally and via external authentication servers - all user passwords are stored in SHA-256 hash format. The communication between the client workstation and the senhasegura® is made through encrypted communication respecting the encryption standards of the protocols used. Independent of the communication channel, be it RDP, SSH or HTTPS.

Likewise, access to remote target devices respects the same encryption standard in all protocols that allow configuration.

HSM Encryption

For companies that need a higher level of security, you can opt for the Hardware Secure Module (HSM), a hardware security and encryption device with military specification and tamper-evident standards.

HSM Technical Specifications
  • Encryption

  • RSA (PKCS #1 V2.1) (1024, 2048, 4096 bits)

  • ECDSA (NIST FIPS PUB 186-3)

  • FIPS 197 AES 128, 192, 256

  • FIPS 46-3 DES/3DES

  • Supports certificates x509v3

  • Supports import and internal key generation

  • Random Number Generator

  • Internal, hardware based

  • Meets AIS31 P2 standard

  • Real time clock (RTC)

  • Internal, maximum deviation of 1 minute per year

  • Appliance and Appliance Security Features

  • HSM Kryptus

  • HSM Thales

  • HSM GEMALTO

  • HSM DINAMO

  • HSM YUBICO

Encryption for SSH sessions

Symmetric ciphers
  • 3DES

  • AES128-cbc

  • AES192-cbc

  • AES256-cbc

  • rijndael-cbc

  • AES128-ctr

  • AES192-ctr

  • AES256-ctr

  • AES128-gmc

  • AES256-gmc

  • chacha20-poly1305

Symmetric ciphers that support authenticated encryption
  • AES128-gmc

  • AES256-gmc

  • chacha20-poly1305

MAC
  • hmac-sha1

  • hmac-sha1-96

  • hmac-sha1-256

  • hmac-sha1-512

  • hmac-md5

  • hmac-md5-96

  • umac-64

  • umac-128

  • hmac-sha1-96-etm

  • hmac-sha1-256-etm

  • hmac-sha1-512-etm

  • hmac-md5-etm

  • hma-md5-96-etm

  • umac-64-etm

  • umac-128-etm

Key exchange algorithms
  • diffie-hellman-group1-sha1

  • diffie-hellman-group14-sha1

  • diffie-hellman-group14-sha256

  • diffie-hellman-group16-sha512

  • diffie-hellman-group18-sha512

  • diffie-hellman-group-exchange-sha1

  • diffie-hellman-group-exchange-sha256

  • ecdh-sha2-nistp256

  • ecdh-sha2-nistp384

  • ecdh-sha2-nistp521

  • curve25519-sha256

Certificate Key
  • ssh-ed25519-cert-v01

  • ssh-rsa-cert-v01

  • ssh-dss-cert-v01

  • ecdsa-sha2-nestp256-cert-v01

  • ecdsa-sha2-nestp384-cert-v01

  • ecdsa-sha2-nestp521-cert-v01

Key types

  • ssh-ed25519

  • ssh-ed25519-cert-v01

  • ssh-rsa

  • ssh-dss

  • ecdsa-sha2-nestp256

  • ecdsa-sha2-nestp384

  • ecdsa-sha2-nestp521

  • ssh-rsa-cert-v01

  • ssh-dss-cert-v01

  • ecdsa-sha2-nestp256-cert-v01

  • ecdsa-sha2-nestp384-cert-v01

  • ecdsa-sha2-nestp521-cert-v01

Availability and Contingency

The senhasegura® system supports operation on virtual or physical appliances. The senhasegura® virtual appliance is customized for installation without releasing administrative users in the operating system.

In any configuration, the system supports high availability and external contingency disaster configurations.

  • High Availability

  • Contingency and Disaster Recovery

Backup

senhasegura® has several mechanisms to recover information in case of failure:

Encrypted Password Backup

External in client infrastructure. The backup file of this information is password protected, which is distributed in multiple custody among trusted participants at the client's free choice. At least two custodian users are required to receive and retrieve the information. Once the senhasegura® delivery ceremony has taken place, all passwords to the safe will be reset and the client will receive their respective custody, except for the passwords to the senhasegura® database and operating system.

From version 3.10 on the backup procedure will also be performed for user passwords and Access Keys of the DevSecOps module.

Backup Fast Recovery

Internal and rapid recovery. Stores more critical information, is considered faster, because with the content of the base available the environment is recovered quickly and already becomes accessible upon request.

Encrypted Backup of Settings

Allows not only the stored data but also the password settings to be available for retrieval. This backup is not enabled by default, but its activation is available in system settings.

Safe Video Backup

The senhasegura® allows the backup of the videos to be stored in a remote directory under the responsibility of the client. By default the videos are stored in the solution's file system.

Secrets Backup

The backup of secrets: console credentials and access keys are stored in dedicated directories.

Monitoring and Syslog and SIEM

senhasegura® has monitoring capabilities designed to alert administrators of any process, integration, connectivity, or access failure.

This system issues on-screen alerts to the administrator or via email, SMS, snmpmibs and snmptraps.

The solution can be integrated with any industry tool using SNMP V1, V2 or V32 standard.

Integration with Syslog and SIEM services.

Own integration with ArcSight.

Browser Compatibility

The senhasegura® web interface is accessible only through HTTPS protocol, and it is recommended that you provide your own SSL certificate in accordance with current security assumptions.

senhasegura® uses HTML5 and WebSocket technology and only browsers that support these technologies will provide a complete passwords security experience. It also maintains compatibility with browsers in their most recent versions:

  • Internet Explorer

  • Google Chrome

  • Microsoft Edge

  • Mozilla Firefox

Network Operating Conditions

Connections between users and the senhasegura® application have a minimum bandwidth of 180 Kbps per remote session without loss of functionality.

Connections between users and the senhasegura® application have a maximum latency of 900 ms without any loss of functionality.

senhasegura® application allows IPV4 and IPV6 protocol support following IETF RFC 2460 specification.

Supported Protocols and Ports

senhasegura® allows the use of several protocols, through their respective standard ports or any other configured in the solution, for the following operations: remote connections, password changes, Scan Discovery, authentication and web access.

Operations are performed based on the ports configured on the device.

ConnectivityDefault PortDescription
HTTP80Web Access
HTTPS443Secure Web Access
LDAP389Scan Discovery / Authentication
LDAPS636Password Change / Scan / Discovery / Authentication
MySQL3306Remote Connection* / Password Change
Oracle1521Remote Connection* / Password Change
PostgreeSQL5432Remote Connection* / Password Change
RDP*3389Remote Connection
RM HTTP5985Password Change / Scan Discovery
RM HTTPS5986Password Change / Scan Discovery
SQL Server1433Remote Connection* / Password Change
SSH22Remote Connection / Password Change
Telnet23Remote Connection / Password Change
VNC**5900Remote Connection
Windows RM5986Password Change
Windows RPC135Password Change / Scan Discovery
Windows SMB445Password Change
X11 Forward**22Remote Connection / Password Change

The supported protocols are only available on TLS1.2 and TLS1.3, once connected to the senhasegura vault.

*RemoteApp only

**graphical interfaces

Performance

The senhasegura® architecture is designed for maximum performance in all operations performed through the solution.

All tests were performed on senhasegura® PAM Crypto Appliances with the following configuration:

Hardware Settings

  • Model: senhasegura PAM Crypto Appliance Titanium

  • Processor: Intel E5-2630v4

  • RAM Memory: 128GB

  • HD: 2x2TB NLSAS RAID1

senhasegura Settings

  • Cores: 38 vCPUs

  • RAM Memory: 126GB

  • HD: 2TB

SSH sessions via senhasegura® Terminal Proxy

ConnectionsCPURAMDISK W
5005%10GB4.500 KB/s
200020%50GB6.000 KB/s
350055%85GB8.000 KB/s

SSH sessions via senhasegura® Web Proxy

ConnectionsCPURAMDISK W
25010%10GB7.500 KB/s
75035%15GB5.000 KB/s
125045%20GB2.000 KB/s

RDP sessions via senhasegura® RDP Proxy

ConnectionsCPURAMDISK W
5005%15GB8.500 KB/s
125010%30GB5.000 KB/s
200015%50GB2.000 KB/s

RDP sessions via senhasegura® Web Proxy

ConnectionsCPURAMDISK W
2505%10GB16.000 KB/s
100010%20GB9.000 KB/s
175020%30GB1.000 KB/s

Web HTTP Connections (High Usage)

ConnectionsCPURAMDISK W
1010%5GB2.100 KB/s
2018%10GB1.800 KB/s
3020%15GB1.500 KB/s

Web HTTP Connections (Medium Usage)

ConnectionsCPURAMDISK W
1010%4GB80.000 KB/s
2020%8GB40.000 KB/s
3020%10GB10.000 KB/s

Connections Web HTTP (Low Usage)

ConnectionsCPURAMDISK W
1010%10GB40.000 KB/s
3520%15GB20.000 KB/s
6030%20GB10.000 KB/s

Resource limit

The platform senhasegura® has some features that are technically limited, either for reasons for database limitations, operating system limitations, file-system limitations or software architecture limitations.

The limitations relating to contract or license are fixed by contract, and will not be addressed in this topic.

The limitations relating to the number of contracted instances, in a cluster scenario, will also not be addressed in this topic. We will focus on limitations on an instance and its components.

User Limit

Technically, the application will support up to 16,500,000 user records. This number is shared with WebService A2A users, service users, and actual system users. This number does not express the ability of all these users are using the system simultaneously. Simultaneous use capacity may vary according to the type of use, quantity of contracted instances and network latency supplied.

Device Limit

The technically application will support up to 16,500,000 device records. This number contains even inactivated devices over time. This number does not express the ability of all these devices are being accessed via proxy, or any other asynchronous process that accesses the device simultaneously. The ability to manage devices can vary by the number of contracted instances, supported systems and protocols and the network latency provided.

Credentials Limit and Protected Information

The application technically will support up to 16,500,000 credential records. This number contains even inactive credentials over time. This number does not express the ability of all these credentials are being accessed and used by asynchronous tasks or proxy sessions simultaneously. The ability to manage credentials can vary by the amount of contracted instances and the network latency provided.

Proxy session recording

Different from other market solutions, the senhasegura® does not perform screen captures in image format, or real-time mp4 videos or other media formats. The real persistence of protocol ensures a faithful and optimized copy of the session. Inactivity times are recorded through 4Bytes timestamp per second, unlike screens capture that would consume much more resources. Native format recording of the protocol already considers the native compression format of the protocol.

User behavior will define the amount of sessions that can be stored. Not excluding the possibility of disk expansion or remote storage mapping to increase storage capacity.

This combination of factors makes the limit of sessions virtually unlimited. Consider the performance table described in the techspec-performance session to calculate your need.

Simultaneous proxy sessions

The amount of simultaneous sessions may vary with the amount of contracted instances, making the solution appropriate to its need without excessive hiring of resources. The cluster architecture also allows the definition of dedicated nodes for specific protocols, or the definition of dedicated instances for different datacenters or network segments. This combination of factors makes the limit of sessions virtually unlimited. Consider the performance table described in the techspec-performance session to calculate your need.

senhasegura versioning

The senhasegura versioning nomenclature follows the M.N.P format (eg: 3.22.1-9):

Release TypeDescription
M - MajorIncludes profound architecture and/or technology changes.
N - MinorIncludes new features and/or improvements to existing features. Also includes known bug fixes and minor architectural changes.
P - PatchIncludes critical bug fixes and security patches. (immediate update recommended)

New versions frequency of release

senhasegura N Updates can vary from 1 to 5 months, depending on the period of the year.

As for the available formats, there are two ways:

  1. For the new senhasegura environment, can be used the virtual machines available in the partner support.
  2. Updates are always available through our repositories, with new releases updated as soon as they become available.