topic Re: ILO Encryption in ProLiant Servers (ML,DL,SL)

ILO Encryption

DrNick — Fri, 22 Jun 2012 16:51:00 GMT

During a security assessment, it was determined some of our ILO modules were allowing connections with Export level ciphers. Due to some risks with those types of ciphers, we'd like to turn off the ability of the ILOs to connect using them.

I cannot seem to find a way to disable those ciphers either in the GUI or CLI. Is it possible to do so? If it is, how do I do it?

Thanks!

Re: ILO Encryption

Oscar A. Perez — Fri, 22 Jun 2012 17:40:59 GMT

What iLO is this? iLO2, iLO3, iLO4?

You can set all these iLOs to "Enforce AES/3DES Encryption" but, the Internet Explorer browser will need the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy registry setting enabled before using this feature.

Re: ILO Encryption

DrNick — Fri, 22 Jun 2012 18:21:41 GMT

They are ILO 2 and 3.

So the clients connecting need registry tweaks to force the rule? The ILO won't just simply disable the cipher as an option?

Where do I need to go to Enforce it? I have not been able to find anything in GUI or in the CLI guide.

Please let me know. Thanks so much for your help!

Re: ILO Encryption

Oscar A. Perez — Fri, 22 Jun 2012 19:12:31 GMT

Log into iLO2/iLO3, click on Administrator tab -> Security -> Encryption then, enable Enforce AES/3DES Encryption. iLO will reboot after applying this setting.

Clients require the registry change or they would get an error message when attempting to connect to iLO with a cipher that is not AES/3DES.