A.05.80 HP Insight Remote Support Advanced and Remote Device Access Security Overview (October 2012)

Security Overview
Chapter 2: HP Insight Remote Support Advanced
l Event Log Monitoring Collector (ELMC)
The Event Log Monitoring Collector (ELMC), formerly known as WCCProxy, is included with WEBES
in some cases and downloaded separately in others. The platform-specific functionality to interface
with the operating system and with certain other service tools is contained in the ELMC. It provides
error condition detection on the managed endpoint system on which it is installed. It communicates
these events to WEBES, which can be running either on the same system as the ELMC system or
another system on the same TCP/IP network. Different ELMC packages exist for the same ELMC
version, depending on the operating system and hardware platform.
l Insight Management Agents
Insight Management Agents are available as part of the ProLiant Support Pack and are required to
capture hardware events and to send them to WEBES. WEBES sends qualified incidents to the
Remote Support Client, which in turn submits the incidents to HP for reactive support.
l HP Remote Support XP Application Integration Module (XP AIM)
XP AIM is an optional software component that is installed on the CMS to enable monitoring of HP
P9000/XP Disk Arrays. This component integrates with Insight Remote Support Advanced and
facilitates event and data collections from XP Continuous Track (C-Track) on the XP Service
Processor (SVP). XP AIM performs the following functions:
n Proactively informs remote HP support personnel about potential XP issues by sending them
incident/event data for analysis.
n Transfers array enhanced configuration files and configuration change event bundles for remote HP
support personnel access, whenever the a configuration change is detected.
The SVP sends event information on to the HP SIM CMS using HTTPS on TCP port 50000. The
information is deposited in a temporary directory on the CMS that is monitored by the XP AIM module.
The XP AIM module will forward the information to the Remote Support Client for transmission to the
HP Remote Support Data Center. HP Remote Access to the SVP is done via the Remote Desktop
Protocol on TCP port 3389 or pcAnywhere on TCP port 5631. The SVP runs either Windows 7,
Windows Vista or Windows XP.
l Remote Support Network Component
Remote Support Network Component (RSNC) is a network discovery and inventory software package
that provides information for all the devices located on a network. It does not require the deployment of
proprietary agents. Discovery is performed by probing network devices on the host’s subnet. Note that
Remote Support Network Component may trigger alarms on network intrusion detection systems. The
CMS must have access to the following ports for Remote Support Network Component detection to
work:
Remote Support Network Component
Port Usage
IP Protocol Port Protocol Notes
ICMP n/a n/a
TCP 22 SSH
HP Insight Remote Support Advanced and Remote Device Access (A.05.80)Page 29 of 97