CPQLODOS
Administrators can use the CPQLODOS utility for initial deployment of the iLO processor. It is used
only in a DOS environment, such as during SmartStart scripted deployment, and not over the network.
Therefore, it requires a reboot to DOS. The administrator must have a DOS image loaded on a host
or a floppy, which means that the user either has physical access or a virtual media privilege, with all
the accompanying user rights and authentications.
Terminal services
The iLO processor uses a pass-through service (HPLOPTS.EXE) to access Windows Terminal Services.
When the administrator requests a remote console connection, the iLO remote console applet
activates the Terminal Services client application and sets up a socket, listening on port 3389. The
iLO processor forwards all data that it receives from the Terminal Services client to the server. The iLO
processor forwards back to the Terminal Services socket all data that it receives from the server.
Because it is a pass-through service, when iLO is using the Terminal Services connection, it implements
security identically to the Windows Terminal Services Remote Desktop Protocol (RDP) implementation.
This means that any active security measures are established between the Microsoft terminal services
client and Microsoft’s RDP service.
The Terminal Services port is the second of two ports in iLO that allow traffic to be passed to the host
OS through the iLO driver. Administrators can disable the Terminal Services Pass-Through port.
Specific IT infrastructure concerns
Customers have questioned security issues regarding two particular IT environments: when operating
iLO in the infrastructure between an external firewall and an internal network (DMZ), and when
operating iLO in a server blade environment.
Operating iLO servers in the DMZ
Within an Internet connected architecture, there is typically a more secure zone, commonly referred to
as the de-militarized zone (DMZ). This zone is positioned between the corporate servers and the
Internet, usually separated from both by firewalls that restrict traffic flow. With this architecture,
servers that provide publicly available Internet services can be accessed through a firewall, but these
services are inaccessible on the internal network. This more secure zone provides an area that is
isolated from the internal network and is hardened against external attack (Figure 15). The security
challenges in the DMZ require a careful balance between critical security requirements and the need
to effectively manage and maintain the systems.
31
