ProLiant Servers (ML,DL,SL)

ILO4 security issues

Occasional Contributor

ILO4 security issues

Hi! I have already posted this problems 2 weeks ago, I though it was solved but unfortunately not yet.

My University is scanning all the campus servers with Nessus Vulnerability Scanner and they are complaining that my ILO4 (now just updated to firmware 2.53 May 03 2017) on ProLiant ML350p Gen8 HP server has a "medium" risk level of vulnerability, so they are asking to solve this issue as soon as possible, to avoid potential attacks.

I enclose the "medium" risk entries of the report: all the problems are connected with the 443/tcp port, it seemed I should update the version of SSL protocol to improve cipher, encription and certificate... however I have just updated also OpenSSL to Version : 1.0.1e Release : 57.el6 but the problem persists.

Is anybody able to help me in this respect?

Thank you very much in advance!


Oscar A. Perez
Honored Contributor

Re: ILO4 security issues

Nessus is warning you that your iLOs still have those "untrusted" default Self-Signed SSL Certificates that iLO generates automatically.  You need to replace them with new "trusted" SSL Certificates issued by the University's Certification Authority.

The other two issues can be resolved by enabling in iLO an option called "Enforce AES Encryption"

If you feel this was helpful please click the KUDOS! thumb below!
Honored Contributor

Re: ILO4 security issues

Exposing iLO4 on public Internet address of your University also doesn't help the way HPE iLO4 2.54 (July, 7th 2017) is already out (no "security" related fixes...but won't hurt stay update).

I'm not an HPE Employee
Kudos and Accepted Solution banner