Strange Error accessing console via ilo

[chambo]

I have an HPUX 11i.v3 instance and I'm trying to log in vai the console in the ilo.  But, I get this strange error that says:

Server applet version is yyyyyyyy

local applet version is BC.03.08.

Server Pericom version is.

Local Pericom version is 2.0.1.5.

Applet or Pericom version mismatch between the local applet the browser already has, and what the server has to send to the browser. Close all browser instances and start the browser again.

I do notice the ilo says it requires a browser with java plugin 1.5.0_8 for the remote serial console.  While the server I'm accessing the ilo through says it has java version 7 Update 75.  Unfortunately, I don't have access rights on the server I need to use to access the ilo so I can't update the java version.

Any help about this error would be greatly appreciated.

Thanks,

Chambo

[Bill Hassell]

I could write a book on the Java version issues with consoles (iLO, GSP, MP, storage, tape libraries, etc). I worked at one data center that had 3 PCs, each with a different version of Java. There was no way around the awful compatibilities with Java. Save yourself a lot of frustration and login to the iLO with telnet or if available, ssh. PuTTY is the best (free) tool for this task.

[chambo]

Thank you for the response!  I don't think the ports are open for telnet.  It's a production system and security has so much locked down I don't have a lot of options.

[Bill Hassell · Accepted solution]

>> I don't think the ports are open for telnet.  

>> It's a production system and security has so much locked down I don't have a lot of options.

It's important to understand that iLO ports have nothing to do with HP-UX. iLO (also known as the GSP, MP or my favorite: the Real Console) are connected to the system board. The iLO is another computer (small) with no disk, just firmware that tells the iLO how to communicate with the various components like power supplies, I/O cards, fans, etc. Nothing in HP-UX configures the iLO -- that is all done through a separate LAN or through a serial port. This design is standard on virtually every server made in the last 20 years and is similar to configuration ports on routers, firewalls, storage, etc. Virtually all of them have telnet available, more recent boxes have ssh (preferred if available) and (IMHO) a waste of code that provides a fancy web page to perform simple text queries.

From a security point of view, the web page and telnet are equally problematic. Telnet will be caught by auditors but almost any machine more than 5 years old will also be caught with unpatched web server code (including obsolete Java stuff). The problem is that fixing the vulnerablities in the web server code is often impossible as the manufacturer may never provide any replacement ROMs or downloadable firmware. So the auditors will write a "finding" for these bad web servers which the data center manager must then request exceptions. In some cases, the auditors will demand that such console ports be permanently disconnected, making support for the server hardware very difficult.

That's why most seasoned sysadmins recommend that iLO ports *NEVER* be attached to production networks. Instead, a separate subnet is created with *NO* router. All iLO ports are connected to this isolated subnet and the only way to reach these ports is through a secure machine with two LAN cards, one for the isolated subnet and the other to the production network. In that way, all vulnerabilities are hidden from the rest of the world, and also from the auditors.

To address your issue, just use ssh to talk to the iLO ports. No Java issues, and much, much faster than web pages.

[chambo]

Thank you very much Bill!  This is a huge help!  I'm pretty new to these HPUX systems.  So, I'm srambling a bit to accomplish some things that I'm familiar with in linux.  I'm digesting what you said.  I'll respond again if I have questions.

Thanks again,

chambo