Login process using a local account
Figure 3 shows the iLO login process using a local account.
Figure 3.
User login process when using a local account
5. iLO performs login with cookie
credentials. Privileges are verified
The first step in the login/authentication process is for the web browser on the management console
to connect with the web server in the iLO device. iLO provides incorporates a progressive login delay.
After an initial failed login attempt, iLO imposes a delay of five seconds. After a second failed
attempt, iLO imposes a delay of 10 seconds. After the third failed attempt, and any subsequent
attempts, iLO imposes a delay of 60 seconds. All subsequent failed login attempts cycles through
these values. An information page is displayed during each delay. This will continue until a valid
login is completed. This feature assists in defending against possible dictionary attacks against the
browser login port. iLO saves a detailed log entry for failed login attempts, which imposes a delay of
60 seconds.
The iLO management processor uses 128-bit SSL encryption and the accompanying digital certificates
to encrypt web pages (HTTP data) transmitted across the network. SSL encryption ensures that all
information and commands issued through the web pages are private. An integral part of SSL is a
digital certificate (see “
Appendix A: Digital certificates
”). The iLO management processor creates its own
self-signed certificate by default. Administrators can
also import a certificate from a third-party
Certificate Authority (CA) or from the customer’s own internal CA or PKI rather than the self-signed iLO
certificate.
NOTE:
This step, SSL encryption, is performed both when logging in using
directory services and when logging in using a local account.
Customers can use the digital certificate capabilities within iLO to prevent malicious attacks (such as
Trojan horse attacks) in which an impostor appears to be a trusted iLO web server. For example, if
someone were to put a server that emulated iLO onto a corporate network, that server would not have
a legitimate iLO certificate. Therefore, if any user browsed to this emulated iLO device, the browser
would, at a minimum, flag the lack of a recognized certificate. An administrator can configure the
browser to reject a connection to any unrecognized certificates.
10
