iLo Active Directory Authentication and event logs

Al W. — Mon, 03 Jan 2011 22:04:13 GMT

I was wondering if anyone can confirm my observations or can report actual success in what I am trying to accomplish.

I am using a Security Incident and Event Monitor application an am trying to capture the events of either succesfully or unsucessfully logging into iLo. My goal would be to detect an attack, perhaps even detect an an authorized account login at an inappropriate time, or have the event for forensics later on.

It is my first round conclusion that Active Directory is not recording the source of the authentication, ie, it can't tell one iLo from another iLo.

Using the Dell equivalent, DRAC, has been easy, since it can output events in syslog. I don't have any iLo, but my understanding is that it has SNMP, which I dread trying to configure on my SIEM side.

Re: iLo Active Directory Authentication and event logs

Ali — Tue, 04 Jan 2011 03:00:59 GMT

Hi There,

I guess, You are looking for directory-enabled remote management. You can use HP schema directory integration with ILO to achieve this.

please refer ILO 2 userguide
http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00553302/c00553302.pdf

thanks,
Aftab

topic Re: iLo Active Directory Authentication and event logs in Server Management - Remote Server Management

iLo Active Directory Authentication and event logs

Re: iLo Active Directory Authentication and event logs