functionality or restrict user access by requiring authentication to the CLI. In addition, administrators
can change the host server OS to disable any support for the host server serial port.
iLO Security Override jumper switch
As stated in the section titled “Security assumptions about iLO and its environment,” people with
physical access to a server can alter the host server and the iLO setup. Therefore, it is assumed that
any individual with unrestricted access to the inside of a server enclosure is a super-user or
administrator. Someone with access to the inside of a server can access the security override jumper,
reconfigure iLO through RBSU, reprogram the iLO ROM, or reprogram the boot block. The location of
the iLO Security Override jumper depends on the host platform, so system administrators must consult
the host documentation for details.
Access to the server from iLO
Users can directly access the server through the iLO functions such as virtual serial port, remote
console, virtual media, and Terminal Services (Figure 13). The question for administrators is whether a
user has authorization to perform specific functions on the host server.
Any of these functions is secure from the host by means of the host OS. More importantly, iLO secures
the environment through the strong user authentication and authorization processes that have already
been discussed.
iLO software on host using the PCI bus
Several pieces of iLO software reside on the host server, thus providing an entry point into the server.
The iLO driver enables the other iLO integration services, such as RBSU, Terminal Services pass-
through, HPONCFG, and the agents.
RBSU
RBSU allows users to initially configure iLO and iLO user accounts. Every time the server boots, RBSU
is available to anyone with access to the server console. Therefore, RBSU requires strong security.
Administrators can configure RBSU to require valid user credentials for authorization, using the robust
iLO login mechanisms. Those who do not want RBSU to be accessible at reboot can disable RBSU in
the Global Settings preferences. Disabling RBSU prevents reconfiguration from the host unless the iLO
Security Override Switch is set.
iLO firmware (FlashROM)
The firmware boot block protects the iLO main-line code by using a digital signature. A digital
signature for the firmware image is generated using a private key known only to HP. The iLO boot
block verifies the digital signature by using a corresponding public key. No one can modify the
firmware contents without generating a new digital signature, which requires the original private key
from HP. The boot block examines the digital signature of the iLO main-line code and refuses to
transfer control to the main-line code if the signature is invalid. This prevents loading corrupt or rogue
firmware.
HPONCFG
The HPONCFG utility is a host-based service that allows configuration of iLO using XML scripts.
Because it is host-based, the iLO firmware ignores login credentials and assumes that the user has the
rights to configure iLO. This potential security risk is reduced because HPONCFG requires a root
login (in Linux operating systems) or administrator login (in Windows operating systems) to access the
utility.
30
