Cmdlet to disable TLS 1.0 and 1.1 in iLO 5 without OneView

[Prem_Kumar_S]

Hi,

How to disable TLS1.0 and TLS 1.1 in production mode using REST API without OneView. So that I can use script to do that on multiple servers.

[support_s]

System recommended content:

1. HPE iLO 5 1.40 User Guide | iLO Service Port

2. HPE iLO 6 1.55 User Guide | iLO Service Port

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".

Thank you for being a HPE valuable community member.

[BPSingh]

Greetings!

It appears that you can send a raw rest call.
PATCH /redfish/v1/Managers/1/SecurityService/

It's discussed in this web-link: https://internal.support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00130372en_us 

If using ilorest, I would recommend using a rawpatch to change TLS Versions. To disable TLS 1.0 and 1.1, write the following json to a file (Lets say  disabletls.json):

{
    "/redfish/v1/managers/1/securityservice": {
        "TLSVersion": {
            "TLS1_0": "Disabled",
            "TLS1_1": "Disabled"
        }
    }
}

And run:
ilorest rawpatch disabletls.json 
iLOrest : RESTful Interface Tool version 4.0.0.0
Copyright (c) 2014-2022 Hewlett Packard Enterprise Development LP
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The operation completed successfully.

Please note that iLO will immediately reboot when you run that command.

[Marcel_D]

If a Powershell-Script is the thing for you:

$ilocred = get-credential
$iloboard = "YOURILOBOARDNAME" 

$bodycred = @{
            "UserName"= $ilocred.UserName
            "Password"=$ilocred.GetNetworkCredential().Password
        } | ConvertTo-Json
  
        $session = Invoke-WebRequest -Uri "https://$iloboard/redfish/v1/Sessions" -Method Post -Body $bodycred -ContentType "application/json" -UseBasicParsing -ErrorAction Stop 
        $AuthHeaders = @{ "X-Auth-Token" = $Session.Headers.'X-Auth-Token' }
        $body =  '{
                        "TLSVersion": {
                            "TLS1_0":"Disabled",
                            "TLS1_1":"Disabled"
                        }
                    }' 

        Invoke-WebRequest -Uri "https://$iloboard/redfish/v1/Managers/1/SecurityService/" -Method Patch -Body $body -Headers $AuthHeaders -ContentType "application/json" 

[MichelDE]

I have tried this script from @Marcel_D . 
But i receive an Error:

Invoke-WebRequest:
{
"error": {
"code": "iLO.0.10.ExtendedInfo",
"message": "See @Message.ExtendedInfo for more information.",
"@Message.ExtendedInfo": [
{
"MessageId": "Base.1.18.NoValidSession"
}
]
}
}

Do you know, whats my Problem?

Thanks

[Cederberg]

The NoValidSession seems to indicate that you failed to login to the ilo and create the session needed to execute the other command.
Do you use the selfsigned SSL certificates on your ilo? Powershell is by default checking for a trusted certificate and fails if you don't trust it.
in powershell 7 you can add -SkipCertificateCheck to your invoke-webrequest commands but in earlier versions you need something else to get powershell to ignore certificate checks

[MichelDE]

Hey Cederberg,

thank you for reply.

I have tested with Parameter -SkipCertificateCheck. We also use signed certificates from our own CA. The Session displayed correctly in ILO. The connection is created with local admin PRIVs in ILO.

Anyway....

i tested the same configuration with curl and it runs:

$body =  '{

            "TLSVersion": {

                "TLS1_0":"Disabled",

                "TLS1_1":"Disabled"

            }

        }'

curl -d $body -H 'Content-Type: application/json' -X PATCH '$ILO/redfish/v1/Managers/1/SecurityService/ -u Username:Password

Thank you