HP Integrated Lights-Out Security, 7th edition

3
iLO 2 and iLO 3 systems check the digital signature before allowing a firmware update to proceed.
Remote flashing requires login authentication and authorization, including optional two-factor
authentication.
• Unencrypted ports – iLO clearly defines the port encryption status. You can disable access to any
non-encrypted ports (such as telnet). Access to iLO requires a password (or an optional trusted
certificate for iLO 2), unless you decide to disable the password.
NOTE
iLO 3 does not support telnet.
• Lack of authentication and audit trails – iLO creates a log of SSH authentication failures and
successes. SSH-key authentication makes successful brute force attacks even less likely. For
additional protection, iLO and iLO 2 offer 2-factor authentication. iLO 3 creates a second session
key for remote access.
NOTE
iLO supports only secure shell version 2 (SSH-2).
• Attacks in progress – iLO captures all login activity. It uses a progressive timed delay during
unsuccessful login attempts to impede brute force and dictionary attacks.
• Unregulated virtual media access – iLO logs virtual media access so you can trace potential
information destroyers.
We address these security topics in more detail later in this technology brief.
Security keys
iLO uses layers of security and industry-standard methods to secure the server. For example, iLO
cryptographic keys use a minimum key length of 128 bits and conform to industry standards.
The HP manufacturing process protects sensitive information. We keep no record of initial or default
management security keys unless authorized by a "Factory Special" manufacturing process.
Manufacturing personnel do not have access to sensitive key or password data. Each server ships
with a unique, unpredictable iLO password. This ensures security out-of-the box. If you have specific
security requirements, you can order HP servers with pre-configured iLO passwords or use HP
deployment utilities to assign your own passwords.
iLO automatically generates new, unique, and site-specific SSL keys when you deploy a server. HP
cannot determine these site-specific keys, and iLO does not transmit them to HP.
Physical security
Data center managers are responsible for managing physical access to their facilities. Someone with
physical access to a server can alter the iLO setup. We assume that anyone with access to the inside
of a server is a super-user or administrator with potential access to the Security Override
jumper/switch. You can disable all of iLO’s security authorization checks by turning on Security
Override. This gives you full access to iLO for the following tasks:
• Reconfigure iLO through ROM-Based Setup (RBSU)