Manage system in DMZ with SIM 5

[Sean Madden]

I have several windows boxes in our dmz that I am trying to manage from our intranet. SIM sees the boxes (name resolution, ip address) but, is not communicating with the agents. In the product description section, the management protocol says "SSH:Access Denied: Ssh Operation failed for node:192.xx). How can I properly configure SSH?

[Daniel Gräntz]

Hi!

I think you should take a look at this document:
ftp://ftp.compaq.com/pub/products/servers/management/hpsim/ManagingHPServers-withHPSIM.pdf

It describes in detail what you need to configure in your FW for different functions to work.

[Sean Madden]

In regards to port 22. Do i need to have that open both ways? Also, as dmz does not know about any of the domain account info, how do I configure SSH on the CMS to talk to SSH in the DMZ. NOTE I have configure SSH on the DMZ system to use the local admin account.

[Ferry Steenvoorde]

Concerning SSH, I guess opening port 22 TCP from the HPSIM-server to the Managed System only should work, but I am not sure about that. You might still need that both ways.

For managing systems that are not part of a domain AND are behind a Firewall, you need:

Ports on the firewall:
-ICMP (ping, echo ping, only from HPSIM to Managed System)
-22 SSH
-280 Status Change (both ways)
-443 ILO-board (both ways)(maybe port 80 as well)
-2301 HTTP (both ways)
-2381 HTTPS (both ways)

To manage systems in other domains or Workgroups:
-use Certificates.
--Export the HPSIM server Certificate on the HPSIM-server (Options, Security, Certificates, Server Certificate, Export).
--On the Managed System, start the Systems Management Homepage, Settings, Security, Trust Mode, Trust By Certificate, Trusted Certificate, Import the certificate from the HPSIM-server (Copy/Paste the plain ASCII contents of the Export-file from the HPSIM-server).
--If you are still on the Managed System/Security Settings, change the "Local/Anonymous Access"-settings to "Local Access" for Administrators.

[Sean Madden]

Instead of using SNMP(to much of a security risk), is it possible to us WBEM in a windows environment(port 5989)? If so, is this used in concert with SSH?