HP Ilo 3 User Guide
Have a look at the manual HP Ilo 3 User Guide online for free. It’s possible to download the document as PDF or print. UserManuals.tech offer 1114 HP manuals and user’s guides for free. Share the user manual or guide on Facebook, Twitter or Google+.
NOTE:YoucanconfiguresomeofthesesettingsbyusingiLORBSU.Forinstructions,see“Using theiLORBSU”(page87). ToviewormodifyiLOaccessoptions: 1.NavigatetotheAdministration→AccessSettingspage. 2.ClicktheAccessSettingstabandscrolltotheAccessOptionssectionoftheAccessSettings page,asshowninFigure17(page41). Figure17AccessOptions 3.Updatethefollowingsettingsasneeded: Table2Accessoptions DescriptionDefaultvalueOption Thissettingspecifieshowlongausercanbeinactive,in minutes,beforetheiLOwebinterfaceandRemoteConsole 30IdleConnectionTimeout (minutes) sessionendautomatically.Thefollowingsettingsarevalid: 15,30,60,or120minutes,orInfinite.Inactiveusersarenot loggedoutwhenthisoptionissettoInfinite. FailuretologoutofiLObyeitherbrowsingtoadifferentsite orclosingthebrowseralsoresultsinanidleconnection.The iLOfirmwaresupportsafinitenumberofiLOconnections. MisuseoftheInfinitetimeoutoptionmightmakeiLO inaccessibletootherusers.Idleconnectionsarerecycledafter theytimeout. Thissettingappliestolocalanddirectoryusers.Directory servertimeoutsmightpreempttheiLOsetting. Changestothesettingmightnottakeeffectimmediatelyin currentusersessions,butwillbeenforcedimmediatelyinall newsessions. TheiLOnetworkandcommunicationswithoperatingsystem driversareterminatedwheniLOfunctionalityisdisabled. EnablediLOFunctionality IfiLOfunctionalityisdisabled(includingtheiLODiagnostic Port),youmustusetheserverSecurityOverrideSwitchto enableiLO.Seetheserverdocumentationtolocatethe SecurityOverrideSwitch,andthensetittoOverride.Power uptheserver,andthenusetheiLORBSUtosetiLO FunctionalitytoEnabled. NOTE:TheiLOfunctionalitycannotbedisabledonblade servers. ConfiguringiLOaccesssettings41
Table2Accessoptions(continued) DescriptionDefaultvalueOption ThissettingenablesordisablesiLORBSU.TheiLOOption ROMpromptsyoutopressF8tostartiLORBSU,butifiLOis disabledoriLORBSUisdisabled,thispromptisnotdisplayed. EnablediLOROM-BasedSetup Utility Thissettingdetermineswhetherauser-credentialpromptis displayedwhenauseraccessesiLORBSU.Ifthissettingis DisabledRequireLoginforiLO RBSU Enabled,alogindialogboxopenswhenyouaccesstheiLO RBSU. ThissettingenablesthedisplayoftheiLOnetworkIPaddress duringhostserverPOST. EnabledShowiLOIPduringPOST ThissettingenablesyoutochangetheloginmodeloftheCLI featurethroughtheserialport.Thefollowingsettingsarevalid: Enabled-Authentication Required SerialCommandLine InterfaceStatus •Enabled-AuthenticationRequired—Enablesaccesstothe iLOCLPfromaterminalconnectedtothehostserialport. ValidiLOusercredentialsarerequired. •Enabled-NoAuthentication—EnablesaccesstotheiLOCLP fromaterminalconnectedtothehostserialport.iLOuser credentialsarenotrequired. •Disabled—DisablesaccesstotheiLOCLPfromthehost serialport.Usethisoptionifyouareplanningtouse physicalserialdevices. Thissettingenablesyoutochangethespeedoftheserialport fortheCLIfeature.Thefollowingspeeds(inbitspersecond) 9600SerialCommandLine InterfaceSpeed arevalid:9600,19200,57600,and115200.Theserialport configurationmustbesettonoparity,8databits,and1stop bit(N/8/1)forcorrectoperation. Thissettingspecifiestheminimumnumberofcharacters allowedwhenauserpasswordissetorchanged.The characterlengthmustbeavaluefrom0to39. 8MinimumPassword Length Thissettingenablesyoutospecifythehostservername.You canassignthisvaluemanually,butitmightbeoverwrittenby thehostsoftwarewhentheoperatingsystemloads. —ServerName Youcanenteraservernamethatisupto49bytes. Toforcethebrowsertorefresh,savethissetting,andthen pressF5. Thissettingenablesyoutoconfigureloggingcriteriaforfailed authentications.Alllogintypesaresupported;eachlogintype worksindependently.Thefollowingarevalidsettings: Enabled-Every3rd Failure AuthenticationFailure Logging •Enabled-EveryFailure—Afailedloginlogentryisrecorded aftereveryfailedloginattempt. •Enabled-Every2ndFailure—Afailedloginlogentryis recordedaftereverysecondfailedloginattempt. •Enabled-Every3rdFailure—Afailedloginlogentryis recordedaftereverythirdfailedloginattempt. •Enabled-Every5thFailure—Afailedloginlogentryis recordedaftereveryfifthfailedloginattempt. •Disabled—Nofailedloginlogentryisrecorded. ForinformationaboutusingthissettingwithSSHclients,see “LoggingintoiLObyusinganSSHclient”(page43). 4.ClickApplytoendyourbrowserconnectionandrestartiLO. Waitatleast30secondsbeforeyouattempttore-establishaconnection. 42ConfiguringiLO
LoggingintoiLObyusinganSSHclient WhenauserlogsintoiLObyusinganSSHclient,thenumberofloginnameandpassword promptsdisplayedbyiLOmatchesthevalueoftheAuthenticationFailureLoggingoption(3ifitis disabled).ThenumberofpromptsmightalsobeaffectedbyyourSSHclientconfiguration.SSH clientsalsoimplementdelaysafterloginfailure. Forexample,togenerateanSSHauthenticationfailurelogwiththedefaultvalue(Enabled-Every 3rdFailure),assumingthattheSSHclientisconfiguredwiththenumberofpasswordpromptsset to3,threeconsecutiveloginfailuresoccurasfollows: 1.RuntheSSHclientandloginwithanincorrectloginnameandpassword. Youreceivethreepasswordprompts.Afterthethirdincorrectpassword,theconnectionends andthefirstloginfailureisrecorded.TheSSHloginfailurecounterissetto1. 2.RuntheSSHclientandloginwithanincorrectloginnameandpassword. Youreceivethreepasswordprompts.Afterthethirdincorrectpassword,theconnectionends andthesecondloginfailureisrecorded.TheSSHloginfailurecounterissetto2. 3.RuntheSSHclientandloginwithanincorrectloginnameandpassword. Youreceivethreepasswordprompts.Afterthethirdincorrectpassword,theconnectionends andthethirdloginfailureisrecorded.TheSSHloginfailurecounterissetto3. TheiLOfirmwarerecordsanSSHfailedloginlogentry,andsetstheSSHloginfailurecounterto 0. ConfiguringiLOsecurity iLOprovidesthefollowingsecurityfeatures: •User-definedTCP/IPports.Formoreinformation,see“ConfiguringiLOaccesssettings” (page39). •UseractionsloggedintheiLOEventLog.Formoreinformation,see“UsingtheiLOEventLog” (page106). •Progressivedelaysforfailedloginattempts.Formoreinformation,see“Loginsecurity” (page46). •SupportforX.509CAsignedcertificates.Formoreinformation,see“AdministeringSSL certificates”(page48). •SupportforsecuringiLORBSU.Formoreinformation,see“iLORBSUsecurity”(page44). •EncryptedcommunicationthatusesSSLcertificateadministration.Formoreinformation,see “AdministeringSSLcertificates”(page48). •SupportforoptionalLDAP-baseddirectoryservices.Formoreinformation,see“Directory services”(page160). Someoftheseoptionsarelicensedfeatures.Formoreinformation,see“iLOlicensing”(page31). Generalsecurityguidelines GeneralsecurityguidelinesforiLOfollow: •Formaximumsecurity,configureiLOonaseparatemanagementnetwork.Formoreinformation, see“ConnectingiLOtothenetwork”(page16). •DonotconnectiLOdirectlytotheInternet. •Useabrowserthathasa128-bitcipherstrength. ConfiguringiLOsecurity43
iLORBSUsecurity iLORBSUenablesyoutoviewandmodifytheiLOconfiguration.YoucanconfigureiLORBSU accesssettingsbyusingiLORBSU,awebbrowser,RIBCLscripts,ortheiLOSecurityOverride Switch. •ForinformationaboutusingawebbrowsertoconfigureiLORBSUaccesssettings,see “Configuringaccessoptions”(page40). •ForinformationaboutusingiLORBSUtoconfigureiLORBSUaccesssettings,see“Usingthe iLORBSU”(page87). •ForinformationaboutusingRIBCLscriptstoconfigureiLORBSU,seetheHPiLO3Scripting andCommandLineGuide. •ForinformationaboutusingtheiLOSecurityOverrideSwitchtoaccessiLORBSU,see“iLO SecurityOverrideSwitchadministration”(page44). iLORBSUhasthefollowingsecuritylevels: •LoginNotRequired(default) AnyonewhohasaccesstothehostduringPOSTcanenteriLORBSUtoviewandmodify configurationsettings.Thisisanacceptablesettingifhostaccessiscontrolled.Ifhostaccess isnotcontrolled,anyusercanmakechangesbyusingtheactiveconfigurationmenus. •LoginRequired(moresecure) IfiLORBSUloginisrequired,theactiveconfigurationmenusarecontrolledbytheauthenticated useraccessrights. •Disabled(mostsecure) IfiLORBSUisdisabled,useraccessisprohibited.ThispreventsmodificationbyusingtheiLO RBSU. Tochangetheloginrequirement: •UsetheiLOwebinterfacetoedittheRequireLoginforiLORBSUsetting.Forinstructions,see “Configuringaccessoptions”(page40). •UsetheiLORBSUtoedittheRequireiLO3RBSULoginsetting.Forinstructions,see“Using theiLORBSU”(page87). ToenableordisableaccesstoiLORBSU: •UsetheiLOwebinterfacetoedittheiLOROM-BasedSetupUtilitysetting.Forinstructions,see “Configuringaccessoptions”(page40). •UsetheiLORBSUtoedittheiLO3ROM-BasedSetupUtilitysetting.Forinstructions,see“Using theiLORBSU”(page87). iLOSecurityOverrideSwitchadministration TheiLOSecurityOverrideSwitchgrantstheadministratorfullaccesstotheiLOprocessor.This accessmightbenecessaryforanyofthefollowingconditions: •iLOhasbeendisabledandmustbere-enabled. •AlluseraccountsthathavetheAdministerUserAccountsprivilegearelockedout. •AninvalidconfigurationpreventsiLOfrombeingdisplayedonthenetwork,andiLORBSUis disabled. •Thebootblockmustbeflashed. •TheiLONICisturnedoff,andrunningiLORBSUtoturnitbackonisnotpossibleorconvenient. •Onlyoneusernameisconfigured,andthepasswordisforgotten. 44ConfiguringiLO
RamificationsofsettingtheiLOSecurityOverrideSwitchincludethefollowing: •Allsecurityauthorizationverificationsaredisabledwhentheswitchisset. •iLORBSUrunsifthehostserverisreset. •iLOisnotdisabledandmightbedisplayedonthenetworkasconfigured. •iLO,ifdisabledwhentheswitchisset,doesnotlogouttheuserandcompletethedisable processuntilthepoweriscycledontheserver. •Thebootblockisexposedforprogramming. •AwarningmessageisdisplayedoniLOwebinterfacepages,indicatingthattheswitchis currentlyinuse. •AniLOlogentryrecordstheuseoftheswitch. WheniLObootsafteryousetorcleartheiLOSecurityOverrideSwitch,anSNMPalertissentif anSNMPAlertDestinationisconfigured. SettingtheiLOSecurityOverrideSwitchenablesyoutoflashtheiLObootblock.HPdoesnot anticipatethatyouwillneedtoupdatethebootblock.However,ifanupdateisrequired,youmust bephysicallypresentattheservertoreprogramthebootblockandresetiLO.Thebootblockis exposeduntiliLOisreset.Formaximumsecurity,HPrecommendsdisconnectingiLOfromthe networkuntiltheresetiscomplete.YoumustopentheserverenclosuretoaccesstheiLOSecurity OverrideSwitch. TosettheiLOSecurityOverrideSwitch: 1.Powerofftheserver. 2.Settheswitch. 3.Powerontheserver. ReversethisproceduretocleartheiLOSecurityOverrideSwitch. Dependingontheserver,theiLOSecurityOverrideSwitchmightbeasinglejumperoraspecific switchpositiononaDIPswitchpanel.ForinformationaboutaccessingtheiLOSecurityOverride Switch,seetheserverdocumentationorusethediagramsontheserveraccesspanel. TPMsupport ATPMisacomputerchipthatsecurelystoresartifactsusedtoauthenticatetheplatform.These artifactscanincludepasswords,certificates,orencryptionkeys.YoucanalsouseaTPMtostore platformmeasurementstomakesurethattheplatformremainstrustworthy. Onasupportedsystem,iLOdecodestheTPMrecordandpassestheconfigurationstatustoiLO, theCLP,andtheXMLinterface.TheiLOOverviewpagedisplaysthefollowingTPMstatus information: •NotSupported—ATPMisnotsupported. •NotPresent—ATPMisnotinstalled. •Present—Thisindicatesoneofthefollowingstatuses: ATPMisinstalledbutisdisabled.◦ ◦ATPMisinstalledandenabled. ◦ATPMisinstalledandenabled,andExpansionROMmeasuringisenabled.IfExpansion ROMmeasuringisenabled,theUpdateFirmwarepagedisplaysalegalwarningmessage whenyouclickUpload. ConfiguringiLOsecurity45
Useraccountsandaccess iLOsupportstheconfigurationofupto12localuseraccounts.Eachaccountcanbemanaged throughthefollowingfeatures: •Privileges •Loginsecurity YoucanconfigureiLOtouseadirectorytoauthenticateandauthorizeitsusers.Thisconfiguration enablesanunlimitednumberofusersandeasilyscalestothenumberofiLOdevicesinanenterprise. ThedirectoryalsoprovidesacentralpointofadministrationforiLOdevicesandusers,andthe directorycanenforceastrongerpasswordpolicy.iLOenablesyoutouselocalusers,directory users,orboth. Thefollowingdirectoryconfigurationoptionsareavailable: •AdirectoryextendedwithHPschema •Thedirectorydefaultschema Formoreinformationaboutusingdirectoryauthentication,see“Directoryservices”(page160). Userprivileges iLOallowsyoutocontroluseraccountaccesstoiLOfeaturesthroughtheuseofprivileges.When auserattemptstouseafeature,iLOverifiesthattheuserhastheproperprivilegetousethat feature. Forinformationabouttheavailableuseraccountanddirectorygroupprivileges,see“Managing iLOusersbyusingtheiLOwebinterface”(page32). Loginsecurity iLOprovidesseveralloginsecurityfeatures.Afteraninitialfailedloginattempt,iLOimposesa delayoftenseconds.Eachsubsequentfailedattemptincreasesthedelaybytenseconds.An informationpageisdisplayedduringeachdelay;thiscontinuesuntilavalidloginoccurs.This featurehelpstopreventdictionaryattacksagainstthebrowserloginport. iLOsavesadetailedlogentryforfailedloginattempts.YoucanconfiguretheAuthenticationFailure LoggingfrequencyontheAdministration→AccessSettingspage.Formoreinformation,see “Configuringaccessoptions”(page40). AdministeringSSHkeys TheSecureShellKeypagedisplaysthehashoftheSSHpublickeyassociatedwitheachuser. Eachusercanhaveonlyonekeyassigned.Usethispagetoview,add,ordeleteSSHkeys. YoumusthavetheAdministerUserAccountsprivilegetoaddanddeleteSSHkeys. AboutSSHkeys WhenyouaddanSSHkeytoiLO,youpastetheSSHkeyfileintoiLOasdescribedin“Authorizing anewSSHkey”(page47).Thefilemustcontaintheuser-generatedpublickey.TheiLOfirmware associateseachkeywiththeselectedlocaluseraccount.IfauserisremovedafteranSSHkeyis authorizedforthatuser,theSSHkeyisremoved. AsampleSSHkeyfilefollows: ssh-dss AAAAB3......wHM Administrator Inthissample,ssh-dss AAAAB3.....wHMisthepublickey,andAdministratorisalocal iLOuseraccount. 46ConfiguringiLO
NotethefollowingwhenworkingwithSSHkeys: •AnySSHconnectionauthenticatedthroughthecorrespondingprivatekeyisauthenticatedas theownerofthekeyandhasthesameprivileges. •TheiLOfirmwareprovidesstoragetoaccommodateSSHkeysthathavealengthof639bytes orless.Ifthekeyislargerthan639bytes,theauthorizationmightfail.Ifthisoccurs,usethe SSHclientsoftwaretogenerateashorterkey. •IfyouusetheiLOwebinterfacetoenterthepublickey,youselecttheuserassociatedwith thepublickey.IfyouusetheCLItoenterthepublickey,thepublickeyislinkedtotheuser namethatyouenteredtologintoiLO.IfyouuseHPQLOCFGtoenterthepublickey,you appendtheiLOusernametothepublickeydata.Thepublickeyisstoredwiththatusername. AuthorizinganewSSHkey 1.Generatea1,024-bitDSASSHkeybyusingssh-keygen,puttygen.exe,oranother SSHkeyutility. 2.Createthekey.pubfile. 3.NavigatetotheAdministration→Securitypage. 4.ClicktheSecureShellKeytab,asshowninFigure18(page47). Figure18Security–SecureShellKeypage 5.SelectthecheckboxtotheleftoftheusertowhichyouwanttoaddanSSHkey. 6.ClickAuthorizeNewKey. 7.CopyandpastethepublickeyintotheDSAPublicKeyImportDataboxasshownin Figure19(page48). ConfiguringiLOsecurity47
Figure19DSAPublicKeyImportDatabox Thekeymustbea1,024-bitDSAkey. 8.ClickImportPublicKey. DeletingSSHkeys 1.NavigatetotheAdministration→Securitypage. 2.ClicktheSecureShellKeytab,asshowninFigure18(page47). 3.SelectthecheckboxtotheleftoftheuserforwhichyouwanttodeleteanSSHkey. 4.ClickDeleteSelectedKey(s). TheselectedSSHkeyisremovedfromiLO.WhenanSSHkeyisdeletedfromiLO,anSSH clientcannotauthenticatetoiLObyusingthecorrespondingprivatekey. AuthorizingSSHkeysfromanHPSIMserver ThemxagentconfigutilityenablesyoutoauthorizeSSHkeysfromanHPSIMserver. •SSHmustbeenabledoniLObeforeyouusemxagentconfigtoauthorizeakey. •TheusernameandpasswordenteredinmxagentconfigmustcorrespondtoaniLOuser whohastheConfigureiLOSettingsprivilege.Theusercanbeadirectoryuseroralocaluser. •ThekeyisauthorizedoniLOandcorrespondstotheusernamespecifiedinthe mxagentconfigcommand. Formoreinformationaboutmxagentconfig,seetheHPiLO3ScriptingandCommandLine Guide. AdministeringSSLcertificates SSLisastandardforencryptingdatasothatitcannotbeviewedormodifiedwhileintransiton thenetwork.SSLusesakeytoencryptanddecryptthedata.Thelongerthekey,thebetterthe encryption. Acertificateisapublicdocumentthatdescribestheserver.Itcontainsthenameoftheserverand theserver'spublickey.Becauseonlytheserverhasthecorrespondingprivatekey,thisishowthe serverisauthenticated. Acertificatemustbesignedtobevalid.IfitissignedbyaCA,andthatCAistrusted,allcertificates signedbytheCAarealsotrusted.Aself-signedcertificateisoneinwhichtheownerofthecertificate actsasitsownCA.Self-signedcertificatesarethedefaultforHPmanagementproducts,though theydosupportcertificatessignedbycertifyingauthorities. 48ConfiguringiLO
TheiLOfirmwareenablesyoutocreateacertificaterequest,importacertificate,andview informationassociatedwithastoredcertificate.Certificateinformationisencodedinthecertificate bytheCAandisextractedbyiLO. Bydefault,iLOcreatesaself-signedcertificateforuseinSSLconnections.Thiscertificateenables iLOtoworkwithoutadditionalconfigurationsteps.Importingatrustedcertificatecanenhancethe iLOsecurityfeatures.UserswhohavetheConfigureiLOSettingsprivilegecancustomizeand importatrustedcertificate. ViewingSSLcertificateinformation Toviewcertificateinformation,navigatetotheAdministration→Security→SSLCertificatepage. Thefollowingcertificatedetailsaredisplayed: •IssuedTo—Theentitytowhichthecertificatewasissued •IssuedBy—TheCAthatissuedthecertificate •ValidFrom—Thefirstdatethatthecertificateisvalid •ValidUntil—Thedatethatthecertificateexpires •SerialNumber—TheserialnumberthattheCAassignedtothecertificate ObtainingandimportinganSSLcertificate UserswhohavetheConfigureiLOSettingsprivilegecancustomizeandimportatrustedcertificate. AcertificateworksonlywiththekeysgeneratedwithitscorrespondingCSR.IfiLOisresettofactory defaults,oranotherCSRisgeneratedbeforethecertificatethatcorrespondstothepreviousCSR isimported,thecertificatedoesnotwork.Inthatcase,anewCSRmustbegeneratedandused toobtainanewcertificatefromtheCA. Toobtainandimportacertificate: 1.NavigatetotheAdministration→Security→SSLCertificatepage,asshowninFigure20 (page49). Figure20Security–SSLCertificateInformationpage 2.ClickCustomizeCertificate. TheSSLCertificateCustomizationpageopens,asshowninFigure21(page50). ConfiguringiLOsecurity49
Figure21Security–SSLCertificateCustomizationpage 3.EnterthefollowinginformationintheCertificateSigningRequestInformationsection.The requiredboxesaremarkedwithanasterisk(*)intheiLOwebinterface. •Country(C)—Thetwo-charactercountrycodethatidentifiesthecountrywherethecompany ororganizationthatownsthisiLOsubsystemislocated •State(ST)—ThestatewherethecompanyororganizationthatownsthisiLOsubsystemis located •CityorLocality(L)—Thecityorlocalitywherethecompanyororganizationthatownsthis iLOsubsystemislocated •OrganizationName(O)—ThenameofthecompanyororganizationthatownsthisiLO subsystem •OrganizationalUnit(OU)—(Optional)Theunitwithinthecompanyororganizationthat ownsthisiLOsubsystem •CommonName(CN)—TheFQDNofthisiLOsubsystem 4.ClickGenerateCSR. Thefollowingmessageappears: The iLO subsystem is currently generating a Certificate Signing Request (CSR). This may take 10 minutes or more. In order to view the CSR, wait 10 minutes or more, and then click the Generate CSR button again. 5.After10minutesormore,clicktheGenerateCSRbuttonagain. AnewwindowdisplaystheCSR. TheCSRcontainsapublicandprivatekeypairthatvalidatescommunicationsbetweenthe clientbrowserandiLO.iLOsupportskeysizesupto2,048bits.ThegeneratedCSRisheld inmemoryuntilanewCSRisgenerated,iLOisreset,oracertificateisimported. 6.SelectandcopytheCSRtext. 7.Openabrowserwindowandnavigatetoathird-partyCA. 50ConfiguringiLO