Users Guide

With the new password hash feature:
● You can generate your own SHA256 hashes to set iDRAC user passwords and BIOS passwords. This allows you to have the
SHA256 values in the server configuration profile, RACADM, and WSMan. When you provide the SHA256 password values,
you cannot authenticate through SNMPv3 and IPMI.
NOTE: Remote RACADM or WSMan or Redfish cannot be used for Hash password Configuration / Replacement for
IDRAC. You can use SCP for Hash Password Configuration / Replacement on Remote RACADM or WSMan or Redfish.
● You can set up a template server including all the iDRAC user accounts and BIOS passwords using the current plain text
mechanism. After the server is set up, you can export the server configuration profile with the password hash values. The
export includes the hash values required for SNMPv3 and IPMI authentication. After importing this profile, you must use the
the latest Dell IPMI tool, if you use an older tool, the IPMI authentication fails for the users who have the hashed password
values set.
● The other interfaces such as IDRAC GUI will show the user accounts enabled.
You can generate the hash password with and without Salt using SHA256.
You must have Server Control privileges to include and export hash passwords.
If access to all accounts is lost, use iDRAC Settings Utility or local RACADM and perform reset iDRAC to default task.
If the password of the iDRAC user account is set with the SHA256 password hash only and not the other hashes (SHA1v3Key or
MD5v3Key or IPMIKey), then authentication through SNMP v3 and IPMI is not available.
Hash password using RACADM
To set hash passwords, use the following objects with the set command:
● iDRAC.Users.SHA256Password
● iDRAC.Users.SHA256PasswordSalt
Use the following command to include the hash password in the exported server configuration profile:
racadm get -f <file name> -l <NFS / CIFS share> -u <username> -p <password> -t
<filetype> --includePH
You must set the Salt attribute when the associated hash is set.
NOTE: The attributes are not applicable to the INI configuration file.
Hash password in server configuration profile
The new hash passwords can be optionally exported in the server configuration profile.
When importing server configuration profile, you can uncomment the existing password attribute or the new password hash
attribute(s). If both are uncommented an error is generated and the password is not set. A commented attribute is not applied
during an import.
Generating hash password without SNMPv3 and IPMI authentication
Hash password can be generated without SNMPv3 and IPMI authentication with or without salt. Both require SHA256.
To generate hash password with salt:
1. For the iDRAC user accounts, you must salt the password using SHA256.
When you salt the password, a 16-bytes binary string is appended. The Salt is required to be 16 bytes long, if provided. Once
appended, it becomes a 32 character string. The format is "password"+"salt", for example:
Password = SOMEPASSWORD
Salt = ALITTLEBITOFSALT—16 characters are appended
52
Setting up managed system