Using iLO license key turns on two-factor auth?

[Nate Sternberg]

I have several Proliant servers running iLO firmware 1.43. Once, I needed to access the graphical remote console, so I entered an eval license key. I did my work, and logged off.

But apparently, entering the license key also turns on two-factor authentication (?!) So now when I attempt to log back in, it requests a cert, but I haven't uploaded any certs to trust. So I appear to be locked out. So my questions are:

1) Is there any way to get back in to the server, other than flipping the security override switch on the chassis?
2) Is this really how it's supposed to work (entering an eval key activates two-factor auth)? Or is something else going on that's turning it on?

[KarloChacon · Accepted solution]

hi Nate

reboot your server and press F8 to get into ilo configuration and disable 2-Factor auth

or you can use the ilo scripting and disable it without rebooting server at all you must use this script called: Mod_2Factor.xml included here

http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=15351&prodSeriesId=1121516&prodNameId=3288134&swEnvOID=1005&swLang=8&mode=2&taskId=135&swItem=MTX-84d9a19b43b84516ac2d26d01f

and this is the utility that will let you run those script

there is one to run local
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=15351&prodSeriesId=1121516&prodNameId=3288134&swEnvOID=1005&swLang=8&mode=2&taskId=135&swItem=MTX-2cd1363574034e0da1392c8911

and another one to run on net
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=15351&prodSeriesId=1121516&prodNameId=3288134&swEnvOID=1005&swLang=8&mode=2&taskId=135&swItem=MTX-5ee197c5bd7641359f45d876b1

bye

[acartes]

>> But apparently, entering the license key also turns on two-factor authentication (?!)

2-factor requires a license key, but a license key does not activate the support without prior configuration.

>> Is there any way to get back in to the server, other than flipping the security override switch on the chassis?

Karlo pointed-out some options. However the network-based method for RIBCL is closed if 2-factor is active, so that may not be an option.

[Nate Sternberg]

Thank you Karlo and acartes! Hitting F8 during the boot process and disabling 2-factor auth from the console worked.

acartes, it's strange that entering an activation key is not supposed to enable 2-factor auth. It seems to do so quite reliably for me. Can settings like that get set to "on" even before the feature is activated? If so, that might explain my case...

[acartes]

>> Can settings like that get set to "on" even before the feature is activated? If so, that might explain my case...

I would guess that some deployment scripts are being run that are installing 2-factor parameters. This setting is inert until a license key is later installed.