Telnet, remote console, and virtual serial port
Because Telnet is not an inherently secure protocol, administrators may be reluctant to use its
functionality. The following section describes how iLO facilitates secure Telnet access. The remote
console and virtual serial port functions use the standard Telnet port to connect to the iLO device.
Although Telnet itself is not encrypted, invoking the remote console applet enables its encryption
feature. This forces iLO to connect using the remote console applet rather than a standard Telnet
session for a text-based console session. iLO maintains exclusive control over the port when using the
remote console applet.
Administrators can configure the Telnet port to allow only the remote console and virtual serial port
functions
―
the “automatic” setting for port 23. This means that iLO disables the port except when it
senses the remote console or virtual serial port applets starting. Because the iLO device refuses any
other connection attempt to port 23, the host server will be inaccessible through a standard Telnet
application.
There are two instances in which a standard Telnet application could connect to the server. The first
instance occurs after the user clicks on the remote console or virtual serial port but before the applet
connects to iLO. For this case, if the user has enabled encryption, iLO will close the connection as
soon as it realizes the client has not sent valid information to begin the encrypted communication. The
second case is if one of these clients terminates abnormally. In that case, iLO will not close the socket
until it realizes it has not received a keep-alive signal during the specified interval (one minute).
The Telnet port number can be changed to any unused port number, or an administrator can disable
the Telnet port entirely. When the remote console port is in the “Disabled” mode, no application
(including the remote console or virtual serial port applet) can connect to port 23.
Finally, any potential security risk of the Telnet port across the network is reduced because the remote
console and virtual serial port applets have strong authentication and authorization processes.
Multi-user Integrated Remote Console (IRC)
Beginning with the iLO v1.91 and iLO 2 v1.30 releases, IRC is available as an iLO Advanced and
iLO Select feature. The IRC is a user-configurable setting and supports up to four simultaneous remote
console sessions on the same server.
The first user to initiate a remote console session is designated as session host. The session host has
the option to deny access, grant full access, or allow read only access. Participant sessions are
terminated when the host session is terminated. All console sessions are encrypted. For added
security, the Remote Console Computer Lock feature provides the ability to self-lock the operating
system when the session is closed or timed out.
The IRC is supported on Windows and Linux. The client browser on the management console must use
a Windows Internet Explorer browser because the IRC uses the ActiveX code, not Java.
SSH for the command-line interface
Administrators with access to the CLI have access to most of the iLO functionality; however, they
access iLO in text mode rather than in graphical mode. To ensure the data and keystroke integrity, the
SSH data stream is encrypted. Administrators can disable the SSH/CLI functionality, change the SSH
port number, or restrict user privileges to ensure that only authorized personnel can access the CLI.
CPQLOCFG utility
The CPQLOCFG utility connects to the iLO processor across the network using the encrypted SSL port.
Because the connection is over the network, users can only access the CPQLOCFG utility with valid
user credentials and privileges authorized by the strong iLO authorization process. Administrators can
change the HTTPS port number to reduce the likelihood of unauthorized persons accessing iLO.
28
