HP OneView manual Best practices for maintaining a secure appliance

•Operating-system-level users are not allowed to access the appliance, with the following exceptions:

◦A special pwreset command used only if the Infrastructure administrator password is lost or forgotten. This command requires that you contact your authorized support representative to obtain a one-time password. For more information, see the online help.

◦A setting that enables an authorized support representative to obtain a one-time password so that they can log in to the appliance console (and only the console) to perform advanced diagnostics.

You can either enable or disable access with this setting.

•HP closely monitors security bulletins for threats to appliance software components and, if necessary, issues software updates.

3.2Best practices for maintaining a secure appliance

The following is a partial list of security best practices that HP recommends in both physical and virtual environments. Differing security policies and implementation practices make it difficult to provide a complete and definitive list.

•HP recommends a strict separation of the management LAN and production LAN, using VLAN or firewall technology (or both) to maintain the separation:

◦Management LAN

All management processor devices (including Onboard Administrators and virtual connections through an Onboard Administrator, iLOs, and iPDUs) are connected to the management LAN.

Grant management LAN access to authorized personnel only: Infrastructure administrators, Network administrators, and Server administrators.

◦Production LAN

All NICs for managed devices are on the production LAN.

•The appliance is preconfigured so that nonessential services are removed or disabled in its management environment. Ensure that you continue to minimize services when you configure host systems, management systems, network devices (including network ports not in use) to significantly reduce the number of ways your environment could be attacked.

•Ensure that a process is in place to determine if software and firmware updates are available, and to install updates for all components in your environment on a regular basis.

•Ensure that the security policies and processes address the virtual environment:

◦

◦

Educate administrators about changes to their roles and responsibilities in a virtual environment.

Restrict access to the appliance console to authorized users. For more information, see “Restricting console access” (page 54).

◦If you use an Intrusion Detection System (IDS) solution in your environment, ensure that the solution has visibility into network traffic in the virtual switch.

◦Turn off promiscuous mode in the hypervisor and encrypt traffic flowing over the VLAN to lessen the effect on any VLAN traffic sniffing.

NOTE: In most cases, if promiscuous mode is disabled in the hypervisor, it cannot be used on a VM (Virtual Machine) guest. The VM guest can enable promiscuous mode, but it will not be functional.

46 Understanding the security features of the appliance