HP Ilo 4 User Guide

TheEncryptionSettingspagedisplaysthecurrentencryptionsettingsforiLO.
•CurrentNegotiatedCipher—Thecipherinuseforthecurrentbrowsersession.Afteryoulog
intoiLOthroughthebrowser,thebrowserandiLOnegotiateaciphersettingtouseduring
thesession.
•EncryptionEnforcementSettings—ThecurrentencryptionsettingsforiLO:
FIPSMode—IndicateswhetherFIPSModeisenabledordisabledforthisiLOsystem.◦
◦EnforceAES/3DESEncryption—IndicateswhetherAES/3DESencryptionisenforcedfor
thisiLO....

ConnectingtoiLObyusingAESor3DESencryption
AfteryouenabletheEnforceAES/3DESEncryptionsetting,iLOrequiresthatyouconnectthrough
securechannels(webbrowser,SSHconnection,orXMLchannel)byusingacipherstrengthofat
leastAESor3DES.
•Webbrowser—YoumustconfigurethebrowserwithacipherstrengthofatleastAESor3DES.
IfthebrowserisnotusingAESor3DESciphers,iLOdisplaysanerrormessage.Theerrortext
variesdependingontheinstalledbrowser.
Differentbrowsersusedifferentmethodsforselectinganegotiatedcipher.Formoreinformation,...

DisablingFIPSMode
IfyouwanttodisableFIPSModeforiLO(forexample,ifaserverisdecommissioned),youmust
setiLOtothefactorydefaultsettings.YoucanperformthistaskbyusingRIBCLscripts,iLORBSU,
ortheiLO4ConfigurationUtility.
Forinstructions,see“ResettingiLOtothefactorydefaultsettingsbyusingiLORBSU”(page311),
“ResettingiLOtothefactorydefaultsettingsbyusingtheiLO4ConfigurationUtility”(page312),
ortheHPiLO4ScriptingandCommandLineGuide....

ConfiguringiLOforHPSSO
1.NavigatetotheAdministration→Security→HPSSOpage.
2.MakesureyouhaveaniLOlicensekeyinstalled.
3.EnableSingleSign-OnTrustModebyselectingTrustbyCertificate,TrustbyName,orTrust
All.
TheiLOfirmwaresupportsconfigurabletrustmodes,whichenablesyoutomeetyoursecurity
requirements.ThetrustmodeaffectshowiLOrespondstoHPSSOrequests.Ifyouenable
supportforHPSSO,HPrecommendsusingtheTrustbyCertificatemode.Theavailablemodes
follow:
•TrustNone(SSOdisabled)(default)—RejectsallSSOconnectionrequests...

4.ConfigureiLOprivilegesforeachroleintheSingleSign-OnSettingssection.
WhenyoulogintoanHPSSO-compliantapplication,youareauthorizedbasedonyourHP
SSO-compliantapplicationroleassignment.TheroleassignmentispassedtoiLOwhenSSO
isattempted.Formoreinformationabouteachprivilege,see“ManagingiLOusersbyusing
theiLOwebinterface”(page46).
SSOattemptstoreceiveonlytheprivilegesassignedinthissection.iLOdirectorysettingsdo
notapply.Defaultprivilegeassignmentsareasfollows:
•User—Loginonly...

Viewingtrustedcertificates
TheManageTrustedCertificatestableontheSingleSign-OnSettingspagedisplaysthestatusof
thetrustedcertificatesconfiguredtouseSSOwiththecurrentiLOmanagementprocessor.
•Status—Thestatusofthecertificate(ifanyareinstalled).Thepossiblestatusvaluesfollow:
—Therecordisvalid.◦
◦—ThereisaproblemwiththetrustsettingsortheiLOlicense.Possiblereasonsfollow:
ThisrecordcontainsaDNSname,andthetrustmodeissettoTrustbyCertificate
(onlycertificatesarevalid).
–
–TrustNone(SSOdisabled)isselected....

NOTE:iLO41.20orlatermightberequiredtoinstallthelargercertificatesusedwithrecent
versionsofHPSIM.
NOTE:HPSIM7.3.2orlatersupports2048-bitcertificates.
•Enteroneofthefollowinglinksinawebbrowser:
ForHPSIMversionsearlierthan7.0:
http://:280/GetCertificate
◦
https://:50000/GetCertificate
◦ForHPSIM7.0orlater:
http://:280/GetCertificate?certtype=sso
https://:50000/GetCertificate?certtype=sso
NOTE:Allrequestparametersarecase-sensitive.Ifyoucapitalizethelowercase...

ConfiguringRemoteConsoleComputerLocksettings
RemoteConsoleComputerLockenhancesthesecurityofaniLO-managedserverbyautomatically
lockinganoperatingsystemorloggingoutauserwhenaRemoteConsolesessionendsorthe
networklinktoiLOislost.Thisfeatureisstandardanddoesnotrequireanadditionallicense.As
aresult,ifyouopena.NETIRCorJavaIRCwindowandthisfeatureisalreadyconfigured,the
operatingsystemwillbelockedwhenyouclosethewindow,evenifaniLOlicenseisnotinstalled.
TheRemoteConsoleComputerLockfeatureissettoDisabledbydefault....

Table1RemoteConsoleComputerLockkeys(continued)
s\F11END
t]F12PG_UP
u'""(space)PG_DN
va'ENTER
wb,TAB
xc-BREAK
yd.BACKSPACE
ze/NUMPLUS
f0NUMMINUS
3.ClickApplytosavethechanges.
ConfiguringtheIntegratedRemoteConsoleTrustsetting(.NETIRC)
The.NETIRCislaunchedthroughMicrosoftClickOnce,whichispartoftheMicrosoft.NET
Framework.ClickOncerequiresthatanyapplicationinstalledfromanSSLconnectionbefroma
trustedsource.IfabrowserisnotconfiguredtotrustaniLOprocessor,andtheIntegratedRemote...

1.NavigatetotheAdministration→Security→LoginSecurityBannerpage.
2.SelecttheEnableLoginSecurityBannercheckbox.
iLOusesthefollowingdefaulttextfortheLoginSecurityBanner:
This is a private system. It is to be used solely by authorized
users and may be monitored for all lawful purposes. By accessing
this system, you are consenting to such monitoring.
3.Optional:Tocustomizethesecuritymessage,enteracustommessageintheSecurityMessage
textbox....