toggling GlobalComponentIntegrity for iLO6 with Powershell

[ksanders99]

I'm using the latest Powershell module (4.32), but can't find a way to either set the ignore flag for Global Component Integrity on the Security Dashboard, or to enable it in Security, ILO.   Anyone have a scripty way to do that? 

thanks,

Keith

[thutchings]

Hello,

I do not believe the powershell cmdlets have been updated yet in order to allow for ignoring the Global Component Integrity. You can use iLO restful tool or any rest client to issue a raw patch to the iLO's in order to enable the "ignore" option on the security dashboard:

PATCH https://<iLO IP>/redfish/v1/Managers/1/SecurityService/SecurityDashboard/SecurityParams/11

With the following payload:

{
"Ignore": true
}

"Param 11" above is the one that corresponds to the Global Component Integrity.

Regards

[ksanders99]

Thanks thutchings  -  I was dreading the possibility of having to do them manually. 

-Keith

[mrus]

Do you know maybe if there is plan to do it, i mean update powershell module ?

Would love to add this to my scipt, kind of pain in a** to do configuration of ilo and still be forced to go to web gui end toggle it manually. 

[ksanders99]

You can adapt the method that thutchings posted above to do it through powershell.  The syntax is:

$headerJSON = @{ "content-type" = "application/json;odata=verbose"}

$newvalue = @{Ignore = $True} | Convertto-json

invoke-restmethod -uri "https://$iloipaddress/redfish/v1/Managers/1/SecurityService/SecurityDashboard/SecurityParams/11" -Credential $credentials -Authentication Basic -SkipCertificateCheck -Method Patch -Body $newvalue -Headers $headerJSON

Where the number corresponds to the Security Dashboard item that you want to toggle

0,False,Security Override Switch
1,False,IPMI/DCI Over Lan
2,False,Minimum Password Length
3,False,Require Login for iLO RBSU
4,False,Authentication Failure Logging
5,False,Secure Boot
6,False,Password Complexity
7,False,Last Firmware Scan Result
8,False,Require Host Authentication
9,False,SNMPv1
10,False,Default SSL Certificate in Use
11,False,Global Component Integrity

If I remember correctly, this required powershell 7 because of the Basic Auth. 

[SAM1121]

Hope this is useful.

https://support.hpe.com/hpesc/public/docDisplay?docId=a00134576en_us

Not sure if there is any powershell way to do it.

This is for all HPE Gen11 system with iLO 6, the "Global Component Integrity" security parameter gets automatically disabled from an enabled state after the server is reset.

If Global component integrity is in disabled state then you can go to iLO 6 web interface can be manually enabled, you can enable this option on the Access Settings page.

https://support.hpe.com/hpesc/public/docDisplay?docId=a00134576en_us

https://support.hpe.com/hpesc/public/docDisplay?docId=sd00002198en_us&docLocale=en_US&page=GUID-F4DBCF30-2CAD-46ED-9BF2-413CA3AE2F6B.html

https://support.hpe.com/hpesc/public/docDisplay?docId=sd00002007en_us&page=GUID-EBC183E0-5805-4BEE-AFF8-02585DC32C87.html

[ksanders99]

Thanks Sam - I actually just ran in to this issue when I retasked one of our Gen11 blades a couple of days ago. 

Keith