White Papers

Understanding OpenManage Mobile (OMM) and Quick Sync Security (PowerEdge 14th Gen servers and
MX Chassis)
8
Technical support and resources
2 OpenManage Mobile remote connection security
OpenManage Mobile retrieves data remotely from the Dell OpenManage Enterprise or OpenManage
Essentials one-to-many systems management console, and iDRAC server management controllers.
The information retrieved includes device inventory, health status information, alerts, log entries, and
configuration information. OMM can configure servers by using an iDRAC connection. OMM sends
powercontrol and other commands by using the same OME or iDRAC connections. The devices that subscribe
to OME alerts receive them by using OpenManage Mobile Cloud Services (OMCS) and vendor- specific push
notification services. OMM also retrieves warranty data from Dell Services. OMM can start external
applications such as remote-desktop clients and web browsers.
In general, OMM communications are protected by the standard HTTPS protocol, which provides protection
against tampering and information disclosure. Remote hosts are identified by using the x509 PKI certificates.
OMM users are authenticated by using the systems management or iDRAC credentials.
2.1 General remote connection security
Dell EMC recommends that OMM be connected to management networks by using VPN or encrypted
Wi-Fi. This connection layer security provides an extra layer of protection.
OMM connects to system management console or iDRAC by using HTTPS which tunnels HTTP over the
TLS protocol. TLS signs and encrypts data, preventing tampering, information disclosure, and replay attacks.
Each OME or iDRAC is identified by using a certificate. Because OME and iDRAC often have self- signed
certificates, OMM displays the certificate info when it first connects to a system, and then records the
certificate thumbprint. Users are alerted if the thumbprint changes during subsequent communication
attempts. Connections to the iDRAC GUI started from OMM also use HTTPS.
Systems Management consoles and iDRAC users are authenticated by their OME (Windows) or iDRAC
credentials, which may be associated with an Active Directory Domain or other LDAP server. Connections to
iDRAC are logged.
While Warranty status and online (QRL) resources present publicly available information, OMM
communications with the Dell Warranty and QRL sites are also encrypted by using HTTPS. The information
cannot be tampered with, and an unauthorized observer would not be able to determine what information is
being exchanged with OMM. Dell EMC sites are identified by standard PKI certificates issued from a trusted
authority.
Most information within OMM may be forwarded by using email. While email clients are outside the scope
of OMM, many email clients will encrypt email message contents or transmit email over encrypted
connections.
Users may voluntarily share information with Dell on how the app is used, including which features are used
and which devices it is used with. Information shared with Dell is sent via HTTPS. Dell does not store or use
any information that would personally identify an individual OMM user or information on customer networks,
with the exception that the OMM client IP is logged temporarily for security purposes. The IP is not stored with
analytics data and is discarded after a reasonable period of time.