Certificates | HP 232664-006 specification

Each directory server that you want RILOE II to connect to must be issued a certificate. If you install an Enterprise Certificate Service, Active Directory can automatically request and install certificates for all of the Active Directory controllers on the network.

Certificates

By default, RILOE II creates a self-signed certificate for use in SSL connections. The self-signed certificate enables RILOE II to work without any additional configuration steps. The security features of RILOE II can be enhanced by importing a trusted certificate.

•Generate Certificate Request—RILOE II can create a CR (in PKCS #10 format), which can be sent to a CA. The certificate request is Base64 encoded. A CA processes the request and returns a response (X.509 certificate) that can be imported into RILOE II.

The CR contains a public/private key pair that is used for validation of communications between the client browser and RILOE II. The generated CR is held in memory until either a new CR is generated, a certificate is imported by this process, or RILOE II is reset, which means you can generate the CR and copy it to the client clipboard, leave RILOE II website to retrieve the certificate, then return to import the certificate.

When submitting the request to the CA, be sure to:

•Use the RILOE II name as listed on the System Status page as the URL for the server.

•Request the certificate be generated in the RAW format.

•Include the Begin and End certificate lines.

RILOE II security 67

Image 67

HP 232664-006 manual Certificates

Contents

HP Remote Insight Lights-Out Edition II User Guide Audience assumptions Contents Riloe II security Directory servicesSystems Insight Manager integration Scripting, command line, and utility options 110 Directory-enabled remote management 103 Troubleshooting the Riloe 173 Acronyms and abbreviations 199 Index 202 Directory Services schema 187Technical support 194 Regulatory compliance notices 195 Operational overview Riloe II kit contentsNew in this release Virtual Power Button cable 4-pin Preparing to install Riloe Installing the Riloe Keyboard/mouse adapter cable configuration Remote Insight cable configuration Installing Riloe II in the server Installing Internal Cables Installing a Remote Insight cable 30-pin Connecting external cables to RiloeInstalling a Virtual Power Button cable 4-pin Installing a Remote Insight cable 16-pin Keyboard/mouse adapter cable connection Monitor cable connection Headless server deployment LAN cable connection AC power adapter connection Powering up the server ROM-Based Setup Utility F8 Configuring the RiloeConfiguration options Remote setup Novell NetWare device driver support Installing Riloe II device driversSmartStart setup of Riloe Microsoft device driver support Linux device driver support Disabling DNS/DHCP Configuring the Riloe II Accessing Riloe II for the first time Using the Riloe Using the Riloe II Managing the user and configuration settings of the Riloe Features of the RiloeUser configurations and settings Modifying an existing users profile Click User Settings on the Administration tabClick Restore User Information Adding authorized users Click Network Settings in the Administration tab Network settings Parameter Default value Definition Administration Click Global Settings Global settings External power connector to the operating system agent Riloe Snmp alerts and settings Disabling Alerts Click Apply Snmp SettingsSnmp Pass-through Status Generating Test Alerts Two-Factor Authentication Settings Riloe II firmware updates Security Settings Using the Remote Console Refresh Using Enhanced Features of the Remote ConsoleRemote Console Information Option Local Cursor Microsoft Windows 2000 settings Recommended client settingsRemote Console Linux settings Recommended server settings Novell NetWare settings Microsoft Windows Server 2003 settingsMicrosoft Windows NT 4.0 and Windows 2000 settings Red Hat Linux and Suse Linux server settings Supported hot keys Click Reset Sequences on the Remote Console tab Video replays of previous server Reset SequencesWindows EMS console Terminal Services Client requirements Terminal Services pass-through option Terminal Services pass-through installation Windows RDP Pass-Through serviceWindows 2000 Terminal Services port change FileImport Enabling the Terminal Services Pass-Through optionTerminal Services Pass-Through status Terminal Services warning message ComputerPropertiesRemoteRemote Desktop Remote Console and Terminal Services clientsTroubleshooting Terminal Services Terminal Services button display ManagementSystem ToolsEvent ViewerApplication Using virtual devices Virtual media Virtual power Select Local Media Drive Riloe II Virtual FloppyClick Connect MS-DOS Virtual Floppy operating systems notes Mounting USB Virtual Media Floppy in Linux Virtual Floppy screenUploading a diskette image to the remote server Submit Changes Changing Virtual Floppy drive settings Diskette Image Utility Copying files on the host server to the Virtual Floppy drive Using the Riloe II Using the Riloe II Select Local CD-ROM Drive Riloe II Virtual CD-ROM Virtual Media CD-ROM operating system notes Mounting USB Virtual Media CD-ROM in Linux Creating Riloe II disk image filesClick Create Disk Image Riloe II Virtual Media privilege Resetting the Riloe II to the factory default settingsVirtual Media applet timeout Cancel Getting help Pocket PC access with Riloe Using the Riloe II Using the Riloe II Using the Riloe II Encryption Password guidelinesRiloe II security General security guidelines Click View/Modify Click Add a certificate Two-factor authenticationSetting up two-factor authentication for the first time Setting up local user accounts Setting up directory user accounts Two-factor authentication user certificatesClick View/Modify Two-factor authentication login Introduction to certificate services Certificates Select FinishCloseOK Installing certificate servicesVerifying directory services Configuring Automatic Certificate Request Securing Rbsu Integrating Riloe II with Systems Insight Manager Systems Insight Manager integrationSystems Insight Manager functional overview Systems Insight Manager status Systems Insight Manager identification and associationSystems Insight Manager links Systems Insight Manager systems lists Configuring Systems Insight Manager identification Systems Insight Manager port matching Receiving Snmp alerts in Systems Insight Manager Systems Insight Manager integration Overview of directory integration Directory servicesBenefits of directory integration HP Extended schema Schema-freeHow directory integration works Active Directory preparation Setup for Schema-free directory integrationSchema-free browser-based setup Schema-free scripted setup Maximum Login Flexibility Schema-free HPLOMIG-based setup Schema-free setup optionsMinimum Login Flexibility Better Login Flexibility Features supported by HP schema directory integration Setting up HP schema directory integrationSetting up directory services Schema required software Directory services support Schema Preview Schema installerSetup Directory services Results Management snap-in installerDirectory services for Active Directory Active Directory installation prerequisites Directory services preparation for Active Directory Snap-in installation and initialization for Active Directory NewHPObject Directory services Active Directory snap-ins Directory services objects Active Directory role restrictions Directory services Active Directory Lights-Out management EDirectory installation prerequisites Directory services for eDirectorySnap-in installation and initialization for eDirectory Directory services Directory services Directory Services objects for eDirectory Members Role managed devices EDirectory Role Restrictions Enforced client IP address or DNS name accessTime restrictions Lights-Out Management User login using directory services Directory settings Name or multi-host DNS name. If an IP address is Group administration Directory tests Click Test Directory Settings Creating roles to follow organizational structure Directory-enabled remote managementIntroduction to directory-enabled remote management Using existing groups Using multiple roles Role address restrictions How directory login restrictions are enforcedRestricting roles Role time restrictions User address restrictions User restrictionsHow user time restrictions are enforced Creating multiple restrictions and roles Using bulk import tools Directory-enabled remote management Cpqlodos general guidelines Scripting, command line, and utility optionsCommand line arguments Overview of the Lights-Out DOS utility Virtfloppy Ribcl XML Commands for Cpqlodos Adduser parameters Cpqlodos runtime errorAdduser runtime errors Cpqlodos parameter Lights-Out directories migration utilities Pre-migration checklistCompatibility Hpqlomig operation HP Lights-Out directory packageFinding management processors 16.100.225.20RILOEII1.20RILOE2DBuserpasswordDefault Schema Upgrading firmware on management processors Selecting a directory access method Naming management processors Configuring directories when HP Extended schema is selected Scripting, command line, and utility options Setting up management processors for directories Hpqlomgc operation Directory is updated Launching Hpqlomgc using application launchFirmware version is validated and updated if necessary Management processor directory settings are updated RILOE2CONFIG Hpqlomgc command language RILOE2CONFIG Lights-Out Configuration Utility Create a customized list Create a custom commandCreate a task Select Management Processor and click OK Application Launch using Systems Insight ManagerQuery definition in Systems Insight Manager Click QueriesDevice Lights-Out Configuration Utility parameters Batch processing using the Lights-Out Configuration Utility XML enhancements Using Perl with the XML scripting interface Opening an SSL connection Readloop Sending the XML header and script body Scripting, command line, and utility options Hponcfg requirements Hponcfg supported operating systems Linux server installation Installing HponcfgUsing Hponcfg Windows server installation Hponcfg command line parameters Using Hponcfg on Linux servers Obtaining an entire configuration Using Hponcfg on Windows servers Obtaining a specific configuration Setting a configuration Remote Insight command languageRibcl sample scripts Ribcl general guidelines Data types XML headerResponse definitions Ribcl LoginRibcl runtime errors Login parameters Adduser Login runtime errorsUserinfo runtime error Userinfo Adduser parameters Deleteuser parameter Adduser runtime errorsDeleteuser runtime errors Deleteuser Getuser return messages Getuser runtime errorsGetuser Getuser parameter Moduser Parameters Moduser Getallusers Moduser runtime errors Getallusers return messages Getallusers runtime errorsGetalluserinfo Getallusers parameters Getalluserinfo return messages Getalluserinfo runtime errorsRibinfo Getalluserinfo parameters Getnetworksettings Resetrib Getnetworksettings Runtime Errors Getnetworksettings ParametersGetnetworksettings Return Messages Modnetworksettings Parameters Modnetworksettings Scripting, command line, and utility options Getglobalsettings runtime errors GetglobalsettingsModnetworksettings Runtime Errors Getglobalsettings parameters Modglobalsettings parameters Modglobalsettings Scripting, command line, and utility options Cleareventlog UpdateribfirmwareModglobalsettings runtime errors Cleareventlog Runtime Errors Getfwversion Hotkeyconfig parameters Hotkeyconfig Dirinfo Getdirconfig Getdirconfig return messages Getdirconfig runtime errors Dirinfo Login Ribcl Moddirconfig Moddirconfig parameters Serverinfo Resetserver Ejectvirtualfloppy Resetserver parametersInsertvirtualfloppy Runtime Errors Insertvirtualfloppy Getvfstatus Copyvirtualfloppy Getvfstatus Return Messages Getvfstatus Runtime ErrorsSetvfstatus Getvfstatus Parameters Sethostpower Gethostpowerstatus Getvpbcablestatus Getallcablesstatus Parameters GettwofactorsettingsGetallcablesstatus Runtime Errors Getallcablesstatus Gettwofactorsettings return messages ModtwofactorsettingsGettwofactorsettings parameters Gettwofactorsettings runtime errors Importing a CA and a user certificate example Example of enabling Two-Factor Authentication Modtwofactorsettings runtime errors Modtwofactorsettings parameters Supported client operating systems and browsers Troubleshooting the RiloeSupported hardware and software USB Server PCI Slot and Cable Matrix PCI Inability to connect to the board through the NIC Network connection problems NetWare initialization errors Alert and trap problemsWeb browser not connecting to the Riloe II IP address Inability to reboot the server Miscellaneous problemsNetWare error message table Accessing System Partition Utilities Incorrect time or date of entries in the event log Inability to upgrade the Riloe II firmwareInterpreting LED indicators Switch settings SW3 to force ROM upgrade Virtual Floppy media applet is unresponsive Login name and password problemsRemote Console mouse control issue Resetting the Riloe II to Factory Default Settings Information logs Troubleshooting the host serverVideo Problems Additional information on the state of the host server Event Log Entries Integrated Management Log Not connect to the specified IP address Subsystem Failure Codes Restarting the host server Directory Services errors Invalid Directory Server address or port Directory Server timeoutDirectory Server connect failed Invalid credentials HP Management Core Ldap OID classes and attributes Directory Services schema HpqRole Core attributesCore class definitions HpqTarget HpqRoleMembership HpqRoleIPRestrictionDefaultCore attribute definitions HpqPolicyDN HpqRoleIPRestrictions HpqRoleTimeRestriction HpqLOMv100 Lights-Out Management classesLights-Out Management attributes Lights-Out Management class definitions HpqLOMRightVirtualMedia HpqLOMRightLoginLights-Out Management attribute definitions HpqLOMRightRemoteConsole HpqLOMRightLocalUserAdmin HpqLOMRightServerResetHpqLOMRightConfigureSettings Before you contact HP Technical supportHP contact information Class B equipment Regulatory compliance noticesFederal Communications Commission notice Class a equipment Class a equipment Canadian notice Avis CanadienEuropean Union regulatory notice Modifications France Italy Bsmi notice Japanese notice ILO Acronyms and abbreviations IML Ribcl Index 77, 78, 81, 83, 85, 92, 99, 106, 114 16, 20, 21 Index