User's Manual
Table Of Contents
- HP Remote Insight Lights-Out Edition II User Guide
- Notice
- Contents
- Operational overview
- Installing the RILOE II
- Configuring the RILOE II
- Using the RILOE II
- Accessing RILOE II for the first time
- Features of the RILOE II
- Managing the user and configuration settings of the RILOE II
- Using the Remote Console
- Terminal Services pass-through option
- Using virtual devices
- Resetting the RILOE II to the factory default settings
- Getting help
- Pocket PC access with RILOE II
- RILOE II security
- Systems Insight Manager integration
- Directory services
- Overview of directory integration
- Benefits of directory integration
- How directory integration works
- Advantages and disadvantages of schema-free and HP Extended
- Setup for Schema-free directory integration
- Setting up HP schema directory integration
- Features supported by HP schema directory integration
- Setting up directory services
- Directory services support
- Schema required software
- Schema installer
- Management snap-in installer
- Directory services for Active Directory
- Active Directory Lights-Out management
- Directory services for eDirectory
- User login using directory services
- Directory settings
- Directory-enabled remote management
- Scripting, command line, and utility options
- Overview of the Lights-Out DOS utility
- Lights-Out directories migration utilities
- Compatibility
- Pre-migration checklist
- HP Lights-Out directory package
- HPQLOMIG operation
- Finding management processors
- Upgrading firmware on management processors
- Selecting a directory access method
- Naming management processors
- Configuring directories when HP Extended schema is selected
- Configuring directories when schema-free integration is sele
- Setting up management processors for directories
- HPQLOMGC operation
- Lights-Out Configuration Utility
- Using Perl with the XML scripting interface
- HPONCFG
- Remote Insight command language
- RIBCL sample scripts
- RIBCL general guidelines
- XML header
- Data types
- Response definitions
- RIBCL
- LOGIN
- USER_INFO
- ADD_USER
- DELETE_USER
- GET_USER
- MOD_USER
- GET_ALL_USERS
- GET_ALL_USER_INFO
- RIB_INFO
- RESET_RIB
- GET_NETWORK_SETTINGS
- MOD_NETWORK_SETTINGS
- GET_GLOBAL_SETTINGS
- MOD_GLOBAL_SETTINGS
- CLEAR_EVENTLOG
- UPDATE_RIB_FIRMWARE
- GET_FW_VERSION
- HOTKEY_CONFIG
- DIR_INFO
- GET_DIR_CONFIG
- MOD_DIR_CONFIG
- SERVER_INFO
- RESET_SERVER
- INSERT_VIRTUAL_FLOPPY
- EJECT_VIRTUAL_FLOPPY
- COPY_VIRTUAL_FLOPPY
- GET_VF_STATUS
- SET_VF_STATUS
- GET_HOST_POWER_STATUS
- SET_HOST_POWER
- GET_VPB_CABLE_STATUS
- GET_ALL_CABLES_STATUS
- GET_TWOFACTOR_SETTINGS
- MOD_TWOFACTOR_SETTINGS
- Troubleshooting the RILOE II
- Supported client operating systems and browsers
- Supported hardware and software
- Server PCI Slot and Cable Matrix
- Network connection problems
- Alert and trap problems
- NetWare initialization errors
- Miscellaneous problems
- Accessing System Partition Utilities
- Inability to reboot the server
- Inability to upgrade the RILOE II firmware
- Incorrect time or date of entries in the event log
- Interpreting LED indicators
- Invalid Source IP address
- Login name and password problems
- Remote Console mouse control issue
- Resetting the RILOE II to Factory Default Settings
- Virtual Floppy media applet is unresponsive
- Video Problems
- Troubleshooting the host server
- Directory Services errors
- Directory Services schema
- Technical support
- Regulatory compliance notices
- Acronyms and abbreviations
- Index
Directory-enabled remote management 105
How directory login restrictions are enforced
Two sets of restrictions potentially limit a directory user's access to LOM devices. User access restrictions
limit a user's access to authenticate to the directory. Role access restrictions limit an authenticated user's
ability to receive LOM privileges based on rights specified in one or more Roles.
Restricting roles
Restrictions allow administrators to limit the scope of a role. A role only grants rights to those users that
satisfy the role's restrictions. Using restricted roles results in users with dynamic rights that change based
on the time of day or network address of the client.
For step-by-step instructions on how to create network and time restrictions on a role, refer to "Active
Directory Role Restrictions (on page 89)" or "eDirectory Role Restrictions (on page 97)" sections.
Role time restrictions
Administrators can place time restrictions on LOM roles. Users are granted the rights specified for the
LOM devices listed in the role, only if they are members of the role and meet the time restrictions for that
role.
LOM devices use local host time to enforce time restrictions. If the LOM device clock is not set, the role
time restriction fails unless no time restrictions are specified on the role.
Role-based time restrictions can only be satisfied if the time is set on the LOM device. The time is normally
set when the host is booted, and it is maintained by running the agents in the host operating system,
which allows the LOM device to compensate for leap year and minimize clock drift with respect to the
host. Events, such as unexpected power loss or flashing LOM firmware, can cause the LOM device clock
to not be set. Also, the host time must be correct for the LOM device to preserve time across firmware
flashes.
Role address restrictions
Role address restrictions are enforced by the LOM firmware, based on the client's IP network address.
When the address restrictions are met for a role, the rights granted by the role apply.
Address restrictions can be difficult to manage if access is attempted across firewalls or through network
proxies. Either of these mechanisms can change the apparent network address of the client, causing the
address restrictions to be enforced in an unexpected manner.