HP Ilo 2 User Guide

3.CreateHPRoleobjectsintherolesorganizationalunitusingtheHPprovidedConsoleOne
snap-instool.
a.Right-clicktherolesorganizationalunitfoundintheregion2organizationalunit,and
selectNew>Object.
b.SelecthpqRolefromthelistofclasses,andclickOK.
c.EnteranappropriatenameontheNewhpqRolepage.Inthisexample,therolewill
containuserstrustedforremoteserveradministrationandwillbenamedremoteAdmins.
ClickOK.TheSelectObjectSubtypepageappears.
d.BecausethisrolemanagestherightstoLights-OutManagementdevices,selectLightsOut...

5.Usingthesameprocedureasinstep4,editthepropertiesoftheremoteMonitorsrole:
a.AddthethreeiLO2deviceswithinhpdevicesunderregion1totheManagedDevices
listontheRoleManagedDevicesoptionoftheHPManagementtab.
b.AdduserstotheremoteMonitorsroleusingtheMemberstab.
c.SelecttheLogincheck-box,andclickApply>Close.UsingtheLightsOutManagement
DeviceRightsoptionoftheHPManagementtab,membersoftheremoteMonitorsrole
canauthenticateandviewtheserverstatus....

Members
Afteruserobjectsarecreated,theMemberstaballowsyoutomanagetheuserswithintherole.
ClickingAddenablesyoutobrowsetothespecificuseryouwanttoadd.Highlightinganexisting
userandclickingDeleteremovestheuserfromthelistofvalidmembers.
SettingupHPschemadirectoryintegration153 

eDirectoryRoleRestrictions
TheRoleRestrictionssubtabenablesyoutosetloginrestrictionsfortherole.Theserestrictions
include:
•Timerestrictions
•IPnetworkaddressrestrictions
IP/mask—
—IPrange
•DNSname
Timerestrictions
Youcanmanagethehoursavailableforlogonbymembersoftherolebyusingthetimegrid
displayedintheRoleRestrictionssubtab.Youcanselectthetimesavailableforlogonforeachday
oftheweekinhalf-hourincrements.Youcanchangeasinglesquarebyclickingit,orasectionof...

eDirectoryLights-OutManagement
Afteraroleiscreated,rightsfortherolecanbeselected.Usersandgroupobjectscannowbe
mademembersoftherole,givingtheusersorgroupofuserstherightsgrantedbytherole.Rights
aremanagedontheLightsOutManagementDeviceRightssubtaboftheHPManagementtab.
Theavailablerightsare:
•Login–Thisoptioncontrolswhetheruserscanlogintotheassociateddevices.
Loginaccesscanbeusedtocreateauserwhoisaserviceproviderandwhoreceivesalerts
fromiLO2butdoesnothaveloginaccesstoiLO2....

•ServerResetandPower–Thisoptionallowstheusertoremotelyresettheserverorpowerit
down.
•AdministerLocalUserAccounts–Thisoptionallowstheusertoadministeraccounts.Theuser
canmodifytheiraccountsettings,modifyotheruseraccountsettings,addusers,anddelete
users.
•AdministerLocalDeviceSettings–ThisoptionallowstheusertoconfigureiLO2settings.
ThesesettingsincludetheoptionsavailableontheGlobalSettings,NetworkSettings,SNMP
Settings,andDirectorySettingsscreensoftheiLO2browser.
Userloginusingdirectoryservices...

Directory”(page140),and“DirectoryservicesforeDirectory”(page149).Ingeneral,youcan
usetheHPprovidedsnap-instocreateobjects.ItisusefultogivetheLOMdeviceobjects
meaningfulnames,suchasthedevicenetworkaddress,DNSname,hostservername,or
serialnumber.
•ConfiguretheLights-Outmanagementdevices
EveryLOMdevicethatusesthedirectoryservicetoauthenticateandauthorizeusersmustbe
configuredwiththeappropriatedirectorysettings.Fordetailsonthespecificdirectorysettings,...

Anadminusergainstheloginrightfromtheregularusergroup.Moreadvancedrightsareassigned
throughtheAdminrole,whichassignsadditionalrights–ServerResetandRemoteConsole.
TheAdminroleassignsalladminrightsServerReset,RemoteConsole,andLogin.
Howdirectoryloginrestrictionsareenforced
Twosetsofrestrictionspotentiallylimitadirectoryuser'saccesstoLOMdevices.Useraccess
restrictionslimitauser'saccesstoauthenticatetothedirectory.Roleaccessrestrictionslimitan...

NOTE:Whendirectoriesareenabled,accesstoaparticulariLO2isbasedonwhethertheuser
hasreadaccesstoaRoleobjectthatcontainsthecorrespondingiLO2object.Thisincludesbut
isnotlimitedtothememberslistedintheroleobject.IftheRoleissetuptoallowinheritable
permissionstopropagatefromaparent,thenmembersoftheparentwhichhavereadaccess
privilegeswillalsohaveaccesstoiLO2.Toviewtheaccesscontrollist,navigatetoUsersand
Computers,openthepropertiesscreenfortheRoleobjectandselecttheSecuritytab....

IPaddressandsubnetmaskrestrictions
IPaddressandsubnetmaskrestrictionsenabletheadministratortospecifyarangeofaddresses
thataregrantedordeniedaccessbytherestriction.ThisformathassimilarcapabilitiesasanIP
addressrangebutmightbemorenativetoyournetworkingenvironment.AnIPaddressandsubnet
maskrangeistypicallyspecifiedusingasubnetaddressandaddressbitmaskthatidentifies
addressesthatareonthesamelogicalnetwork.
Inbinarymath,ifthebitsofaclientmachineaddress,addedwiththebitsofthesubnetmask,...