HP "Secure" Web Console Command Line Client

[Steve Bonds]

We have a few K-class systems that have their consoles accessible via the HP Secure Web Console boxes. Does anyone know of a command line client that could be used to connect to these, bypassing the whole GUI based Java/Web interface?

The SWC connects using the TELNET protocol and I've verified that the quality Caeser-cipher "encryption" employed by these is unchanged in the latest firmware available (A2.0). For more information about this horrific misuse of the word "secure", refer to this BugTraq thread:

http://www.securityfocus.com/archive/1/36887/1999-11-29/1999-12-05/0

It would be straightforward to modify a telnet client to be able to connect directly. Has anyone already done this, thereby saving me the effort? ;-)

What products would you folks suggest for allowing a secure console connection? (My ideal would be an embedded device that accepted SSH2 connections and connected to the consoles via RS232.)

-- Steve

[Michael Steele_2]

You can dial in and establish a remote console session:

REMOTE CONSOLE SETUP
To enable remote console on the "K" series system, do the following from the local console:
[CTRL]B
CM> er (enable remote)
The following will be displayed:
Current remote console access configuration:
Remote CS: Disabled
Mode: Multiple
Password:
Password faults:
Do you wish to change the configuration (Y[N]) (Enter Y)
Remote console access is now enabled
To change the parameters reply yes to the change request.
â ¢ Mode: This can be set to single or multiple.
o In single mode the system will allow you to connect to the remote console once then revert to the session mode.
o In multiple you need to turn off the remote console to secure this option.
â ¢ Password: You can set a password of up to 20 characters.
â ¢ Password Faults: You can set the number of password attempts before the modem will shutdown.
To disable remote console access proceed as follows:
[CTRL]B
CM> dr (Remote console access disabled.)

Return to Contents

REMOTE CONSOLE SESSION
To dial in using the remote console you would connect with the modem as with any normal dialup. When the modems connect you will see the following:
@
Remote console enabled
To gain access to the console you must send a break from the remote terminal. For the operator to get access back while the session is still connected send a break from the console. While the remote console is active you have full control of the system to reboot, run offline diagnostics, and evaluate the system using the Access Port commands. Also, when you are using the remote console, all work will be echoed on the local console and when the local console is used, information will be echoed on the remote.
When you want to disconnect from the remote console type:
[CTRL]B
CM> di
This will disconnect the remote console and return the control to the local console. You must still disable remote console ([CTRL]B CM>dr) to secure the

[Steve Bonds]

The Secure Web Console provides console access over a LAN rather than by modem. Dialup access to the system doesn't really help me since we don't have an analog line to use for it.

Are you aware of any products that allow LAN-to-RS232 like the "Secure" Web Console, only using a more secure and less proprietary interface on the LAN side?

-- Steve

[Angus Crome]

Sure,

Avocent, Black Box, Cybex (or whoever bought them out) all make appliances to do this. It usually costs more to get one with ssh2 or some other security protocol installed. I think they tend to go toward SSL and IPSec more than SecureShell, but I believe I remember seeing SecureShell on the support documents for Avocent, at least.

I believe just about all the KVM makers have some type of network to Serial devices that could help you out. Even the old Emulex terminal servers were updated near the end of supported lifespan, to support IPSec.