ILO4 security issues

[Mauro1967]

Hi! I have already posted this problems 2 weeks ago, I though it was solved but unfortunately not yet.

My University is scanning all the campus servers with Nessus Vulnerability Scanner and they are complaining that my ILO4 (now just updated to firmware 2.53 May 03 2017) on ProLiant ML350p Gen8 HP server has a "medium" risk level of vulnerability, so they are asking to solve this issue as soon as possible, to avoid potential attacks.

I enclose the "medium" risk entries of the report: all the problems are connected with the 443/tcp port, it seemed I should update the version of SSL protocol to improve cipher, encription and certificate... however I have just updated also OpenSSL to Version : 1.0.1e Release : 57.el6 but the problem persists.

Is anybody able to help me in this respect?

Thank you very much in advance!

Mauro

[Oscar A. Perez]

Nessus is warning you that your iLOs still have those "untrusted" default Self-Signed SSL Certificates that iLO generates automatically.  You need to replace them with new "trusted" SSL Certificates issued by the University's Certification Authority.

The other two issues can be resolved by enabling in iLO an option called "Enforce AES Encryption"

[parnassus]

Exposing iLO4 on public Internet address of your University also doesn't help WTR...by the way HPE iLO4 2.54 (July, 7th 2017) is already out (no "security" related fixes...but won't hurt stay update).