awareness of attacks in progress, and unregulated virtual media access. While service processors
produced by other vendors may be at risk from the issues described here, that is not the case with
iLO.
iLO has been hardened against all of these risks:
•
Flash protection
– iLO firmware images are digitally signed with a 1024-bit RSA public/private key
and the digital signature is checked by the boot block every time iLO comes out of reset. For iLO 2
systems, the digital signature is also checked before allowing a firmware update to proceed.
Flashing the iLO firmware remotely requires login authentication and authorization, including
optional two-factor authentication.
•
Unencrypted ports
– iLO clearly defines the encryption status of the ports, and the customer can
disable access to any non-encrypted ports (such as telnet). All access to iLO requires a password, or
a trusted certificate if the customer so desires, unless the customer decides to disable the password
(availability of this option is very limited).
•
Lack of authentication and audit trails
– An audit trail of authentication failures as well as successful
access to the device. SSH access and failed attempts alike are logged. Using the SSH-key mode of
authentication makes brute force attacks even less likely to be successful. And, iLO offers 2-factor
authentication which provides an additional layer of security.
•
No awareness of attacks in progress
– iLO captures all login activity, successful or not.
Additionally, iLO implements a progressive timed delay during unsuccessful login attempts to
greatly slow the success of brute force and dictionary attacks.
•
Unregulated virtual media access
– iLO logs virtual media access, so potential information
destroyers can be traced. Additionally, typical iLO virtual media operations are one-way, from the
client to the server, so chances that critical information is copied via iLO are minimal.
All of these security issues are addressed in more detail later in this technical brief.
Security of the hardware design
The iLO processor is a 32-bit, PCI-based ASIC that includes its own 66-MHz RISC processor core with
separate instruction and data caches, memory controller, NVRAM, SDRAM, FlashROM, and Ethernet
controller (Figure 1). The iLO design denies or restricts access from the host server to the following
areas: management ROM, memory, NVRAM, and the iLO management port.
5
