BladeSystem - General
cancel
Showing results for 
Search instead for 
Did you mean: 

HP C700 Onboard Administrator HSTS support

MichS
Occasional Visitor

HP C700 Onboard Administrator HSTS support

Hi All,

We have security complaint regarding the HP onboard admistrator web interface where HTTPS server is not enforcing HTTP Strict Transport Security (HSTS).

 

Can You anyone advice how we can enable HSTS on the OAs

 

BR,

Mike

 

 

3 REPLIES
Bill Hassell
Honored Contributor

Re: HP C700 Onboard Administrator HSTS support

I would install the latest c7000 OA firmware. This might fix the issue.

However, unlike operating systems, web servers and other programs that use https, firmware is provided for support of the underlying hardware and as such, does not receive the same updates. That's why good data center practice is to never place hardware access ports such as OA, iLO, consoles, GSP, MP or any direct hardware connections on a company network. Instead, all these connections should be on an isolated subnet with *NO* router. The only access to these ports should be through a secure server (HP-UX, Linux, etc -- no Windows) with 2 NICs, one for the isolated subnet and the other to a sysadmin network. 

Virtually every server, switch, router, tape library, etc will have a security issue with a web interface after 3-4 years. Security audits will catch the issue but a fix is not likely and the only solution is get an audit exception, disconnect the service port and use a KVM (if possible), or use an isolated subnet.



Bill Hassell, sysadmin
MichS
Occasional Visitor

Re: HP C700 Onboard Administrator HSTS support

Thanks for the reply.

So as I understood, upgrading the firmware will enable the Onboard Administrator to enforce the HTTP Strict Transport Security

 

 

 

Bill Hassell
Honored Contributor

Re: HP C700 Onboard Administrator HSTS support

No idea. You would have to read the firmware history for the latest version. Even if it isn't mentioned, it may have been fixed without comment. Or the latest version still doesn't have the fix. Updating the OA can be time consuming with a number of things to consider. Check the README file for the firmware.



Bill Hassell, sysadmin