HP C700 Onboard Administrator HSTS support

[MichS]

Hi All,

We have security complaint regarding the HP onboard admistrator web interface where HTTPS server is not enforcing HTTP Strict Transport Security (HSTS).

Can You anyone advice how we can enable HSTS on the OAs

BR,

Mike

[Bill Hassell]

I would install the latest c7000 OA firmware. This might fix the issue.

However, unlike operating systems, web servers and other programs that use https, firmware is provided for support of the underlying hardware and as such, does not receive the same updates. That's why good data center practice is to never place hardware access ports such as OA, iLO, consoles, GSP, MP or any direct hardware connections on a company network. Instead, all these connections should be on an isolated subnet with *NO* router. The only access to these ports should be through a secure server (HP-UX, Linux, etc -- no Windows) with 2 NICs, one for the isolated subnet and the other to a sysadmin network. 

Virtually every server, switch, router, tape library, etc will have a security issue with a web interface after 3-4 years. Security audits will catch the issue but a fix is not likely and the only solution is get an audit exception, disconnect the service port and use a KVM (if possible), or use an isolated subnet.

[MichS]

Thanks for the reply.

So as I understood, upgrading the firmware will enable the Onboard Administrator to enforce the HTTP Strict Transport Security

[Bill Hassell]

No idea. You would have to read the firmware history for the latest version. Even if it isn't mentioned, it may have been fixed without comment. Or the latest version still doesn't have the fix. Updating the OA can be time consuming with a number of things to consider. Check the README file for the firmware.