OneView Auto-Create Local Account on iLO & Overwrite NTP Primary Time Server Value

[Tan_Foo_Siang]

Recently I just found out that when I added a server to HPE OneView, it created a local account “_HPOneViewMonitor” with full administrative rights and overwrite the Primary Time Server value to the HPE OneView IP Address.

Is this action by HPE OneView intended by design to support its other functions such as remote reboot and console?

Any way to prevent HPE Oneview to change the primary time server value when the server is being added?

If we change the primary time server back to the original setting, will it affect anything on the HPE OneView?

[ChrisLynchHPE]

This is by design. The NTP Primary server is set to the OneView appliance to make sure the time stamps for alerts match. If you remove the value,the appliance will set it back.

The user account is required to be present with the rights we give it. If you change this, you will break further management remediation capabilities.

[woro]

How can you simply overwrite my NTP entry and simply delete my second NTP entry?
My interconnect bays have my original NTP server.
Your explanation so that the log times fit are lapsed.
The software has potential but my solution is now,hp oneview to remove.
You can not overwrite my settings!

[ChrisLynchHPE]

@woro, can you help me understand why modifying the Primary NTP server is an unacceptable process?  The appliance can be set to get its time source (NTP or via VMware Tools).  Are you worried about micro-adjustments for time sync?

Please know that OneView doesn't modify the EBIPA settings.  The NTP setting for Interconnect EBIPA are ignored when Virtual Connect is being managed by HPE OneView.  VCM is turned off, so there isn't a need for NTP settings for Virtual Connect.

[Bobinhed]

I also have issues with NTP changes as well and I want to disable OneView from changing ILO NTP settings. 

In our environment the NTP port between ILO and HPOV server is blocked by firewall. In changing the NTP settings it causes NTP sync to fail completely. The NTP servers that are configured are required by my organization and opening firewall ports for every ILO that comes online to point to the HPOV server is an unsustainable process.

The initial assumption by setting 'monitored' instead of 'managed' on a device was that only the account with needed permissions was added... I was unaware until looking further into the NTP issue and documentation that HPOV also changes SSO certs, and SNMP.

Thanks,

Keith

[Bobinhed]

It doesn't appear that HPOV will overwrite NTP if you add the server as 'monitored' and then revert NTP back to their original settings. I've accomplished this with the HPE Powershell module:

https://www.hpe.com/us/en/product-catalog/detail/pip.5440657.html

$DHCP_SNTP_SETTINGS_ENABLE = 'No'; $SNTP_SERVER1 = 'DNS or IP'; $SNTP_SERVER2 = 'DNS or IP'; $TIMEZONE     = 'America/Los_Angeles'

Set-HPILONetworkSetting -Server $LightsOut.BmcIpAddress -Username $LightsOut.Login -Password $LightsOut.Password -DHCPSNTP $DHCP_SNTP_SETTINGS_ENABLE -SNTPServer1 $SNTP_SERVER1 -SNTPServer2 $SNTP_SERVER2 -Timezone $TIMEZONE