HP Integrated Lights-Out 2 User Guide

Login security
iLO 2 provides several login security features. After an initial failed login attempt, iLO 2 imposes
a delay of five seconds. After a second failed attempt, iLO 2 imposes a delay of 10 seconds. After
the third failed attempt, and any subsequent attempts, iLO 2 imposes a delay of 60 seconds. All
subsequent failed login attempts cycles through these values. An information page appears during
each delay. This continues until a valid login is completed. This feature assists in defending against
possible dictionary attacks against the browser login port.
The iLO 2 firmware saves a detailed log entry for failed login attempts, which imposes a delay of
60 seconds.
SSH key administration
The iLO 2 firmware enables you to authorize up to four SSH keys at one time on the SSH Key tab.
The SSH Key tab also displays the owner (if any keys are authorized) of each authorized SSH key.
Multiple keys can belong to a single user.
To add an authorized key to iLO 2, the public key path must be submitted to iLO 2. The key file
must contain the user name after the end of the key. iLO 2 associates each key with a local user
account. If the local account does not exist or if it is deleted, the key is invalid (the key is not listed
if the local account does not exist).
Alternatively, you can authorize SSH keys for an HP SIM server by running the mxagentconfig tool
from the HP SIM server and specifying the address and user credentials for iLO 2. See your HP
SIM documentation for more details.
To authorize a new key:
1. In the iLO 2 interface, click Administration>Security>SSH Key.
2. Click Browse, and locate the key file.
3. Click Authorize Key.
You can view or delete any previously authorized key by selecting the key, and clicking View
Selected Key or Delete Selected Key. The View Selected Key and Delete Selected Key buttons only
appear when SSH keys are installed.
SSL certificate administration
The iLO 2 firmware enables you to create a certificate signing request (CSR) with custom subject
information or default settings, import a certificate, and view certificate administration information
associated with a stored certificate. Certificate information is encoded in the certificate by the CA
and is extracted by iLO 2.
By default, iLO 2 creates a self-signed certificate for use in SSL connections. This certificate enables
iLO 2 to work without any additional configuration steps. The security features of the iLO 2 can
be enhanced by importing a trusted certificate. For more information on certificates and certificate
services, see “Introduction to certificate services” (page 132) and “Installing certificate services”
(page 132).
To access certificate information, click Administration>Security>SSL Certificate. The SSL Certificate
tab displays the following information:
• The Issued To field lists the entity to which the certificate was issued.
• The Issued By field lists the CA that issued the certificate.
• The Valid From field lists the first date that the certificate is valid.
• The Valid Until field lists the date that the certificate will expire.
• The Serial Number field lists the serial number assigned to the certificate by the CA.
• The Domain Name button to choose between the fully qualified domain name and the
shortname as CSR Common Name (CN).
44 Configuring iLO 2