Managing HP Servers through Firewalls with Insight Management 7.0

ManualsBrandsHP ManualsSoftwareInsight Software

Table of Contents

Abstract .............................................................................................................................................. 3

Acronyms in text .................................................................................................................................. 3

Introduction ......................................................................................................................................... 5

HP management products ..................................................................................................................... 6

Case 1: Management protocols banned from DMZ ................................................................................. 6

Asset management ........................................................................................................................... 6

Fault management ............................................................................................................................ 7

Deployment and Migration ................................................................................................................ 7

Integrate ......................................................................................................................................... 7

Control ........................................................................................................................................... 7

Case 2: Separate management network ................................................................................................. 7

Asset Management ........................................................................................................................... 9

Fault Management ........................................................................................................................... 9

Deployment and Migration ................................................................................................................ 9

Integrate ......................................................................................................................................... 9

Control ........................................................................................................................................... 9

Case 3: Managing through a firewall using a single network .................................................................. 10

Asset Management ......................................................................................................................... 10

SNMP ....................................................................................................................................... 11

DMI .......................................................................................................................................... 12

WBEM ...................................................................................................................................... 12

WMI ......................................................................................................................................... 12

WS-MAN .................................................................................................................................. 13

SSH .......................................................................................................................................... 13

Fault management .......................................................................................................................... 13

Deployment and Migration .............................................................................................................. 14

Control ......................................................................................................................................... 14

Integrate ....................................................................................................................................... 14

Control ......................................................................................................................................... 14

Configuration Management ............................................................................................................. 15

Version Control .......................................................................................................................... 17

Replicate Agent Settings .............................................................................................................. 17

SSH .......................................................................................................................................... 17

Managing HP Servers through Firewalls with

Insight Management 7.0 White Paper

Summary of content (29 pages)

PAGE 1
Managing HP Servers through Firewalls with Insight Management 7.0 White Paper Table of Contents Abstract .............................................................................................................................................. 3 Acronyms in text .................................................................................................................................. 3 Introduction ..................................................................................................
PAGE 2
Best Practices ................................................................................................................................. 17 HP Insight Management Installer ...................................................................................................... 18 HP Systems Insight Manager ........................................................................................................ 18 HP Insight Control.........................................................................
PAGE 3
Abstract This paper identifies possible ways of managing HP servers with HP Insight Management deployed in the area of the network that is considered more secure than the standard production network. This is not a best practices document. This document provides information that can enable system administrators to create management solutions appropriate for specific computing environments. Insight Control is a product in the HP Insight Management family of products that can be downloaded from the Internet.
PAGE 4
SNMP Simple Network Management Protocol TCP/IP Transmission Control Protocol / Internet Protocol UDP User Datagram Protocol WBEM Web-Based Enterprise Management WMI Windows Management Instrumentation WS-Management Web Services for Management XML Extensible Markup Language 4
PAGE 5
Introduction Managing systems in a secure environment is a challenge that most system administrators face. It requires a careful balance between critical security requirements and the need to effectively manage and maintain the systems. Within Internet connected architecture, there is typically a more secure zone, commonly referred to as the demilitarized zone (DMZ). This zone is positioned between the corporate servers and the Internet, usually separated from both by firewalls that restrict traffic flow.
PAGE 6
HP management products The following HP products are possible management options for HP servers deployed in the DMZ: • HP Insight Control Environment (ICE)-Linux • HP System Management Homepage (SMH) • HP Insight Management Agents (Agents) • HP Insight Management WBEM Providers for Windows (Insight Providers) • HP Infrastructure Orchestration (HPIO) • HP Insight Control Power Management (ICPM) • HP Smart Update Manager (HP SUM) • HP Systems Insight Manager (HP SIM) • HP WEBM Services for HP-UX • HP Insight
PAGE 7
operating system file share. As a second option, administrators can browse to the web-based System Management Homepage (https://servername:2381/) and manually view the asset information. Fault management Administrators can configure ProLiant servers to send an email (through SMTP) when a hardware problem occurs. In Microsoft Windows operating systems, the Agent Event Notifier provides this optional feature. Administrators can set up and configure the Agent Event Notifier during the agent deployment.
PAGE 8
(primary) network maintains security. Configuring a separate management network using HP Systems Insight Manager allows secure access to the systems in the DMZ. The secondary network can also be used for other operations that would be inappropriate for the primary network, such as tape backups, deployments using Insight Control Server Deployment, or application maintenance. Note: Do not connect the management network to the corporate (internal) network.
PAGE 9
Asset Management With HP Systems Insight Manager installed on the secondary management network, system administrators can collect system asset information from a ProLiant server on that management network through the iLO 2 pass-through. As a second option, administrators can browse to the System Management Homepage (https://servername:2381/) and manually view the asset information. Appendix A: Configuring a separate management network describes the procedure for configuring a separate management network.
PAGE 10
Case 3: Managing through a firewall using a single network In other computing environments, a firewall commonly separates the central management server (CMS) and the managed server. In such an environment (Figure 3), two networks are given different levels of trust. For example, the managed server may be in a DMZ, while the CMS resides in a more trusted portion of the intranet. The firewall is used to control traffic between these two networks.
PAGE 11
Next, the CMS will attempt to identify a number of management protocols such as SNMP, HTTP, and WBEM. The protocols used for asset management depend on the types of systems being managed (Table 1): • ProLiant servers provide management data through SNMP, giving complete coverage of the hardware instrumentation. Integrity servers running Windows also provide this SNMP instrumentation.
PAGE 12
that change a device's configuration, can be encrypted to prevent their contents from being exposed on the wire. Also, the group-based administrative model allows different users to access the same SNMP agent with varying access privileges. DMI DMI is similar in design to SNMP.
PAGE 13
Figure 4 WMI Mapper on managed Windows system behind firewall The WMI Mapper is included with the Windows version of HP SIM but can also be used with other versions. It is available with the HP SIM software or from the HP website at http://www.hp.com/go/hpsim. The mapper can be installed on a Windows system to allow WBEM access to that system.
PAGE 14
2 In Out In Y Y Y Y Y 1 Out Y 162 SNMP (UDP) SNMP Trap 25 SMTP SMTP E-mail 50004 HTTPS/HTTP WBEM event receiver (configurable) All ports are for TCP and UDP The CMS will normally have all managed system ports open, as the CMS is a managed system itself. Firewalls may be configured to block these ports if the CMS is not to be managed from another system.
PAGE 15
computing environment, the administrator has to allow the protocols required to communicate between the systems through the connected firewall. Selecting the protocols that must be enabled through the firewall depends on the types of system to be managed. Issues associated with each protocol are discussed in the following paragraphs. Ideally, BEM will be used to manage servers located through a firewall.
PAGE 16
40420 VMM Y 50000 HTTPS HP SIM Web server (configurable ) Y 50001 HTTPS HP SIM SOAP Y 50002 HTTPS HP SIM SOAP with client certificate authentication Y 50003 HTTP HP SIM SOAP 50004 HTTPS/HTTP WBEM event receiver (configurable7) Y 50005 WBEM WBEM Events Y 50006 PostgreSQL PostgreSQL Y 50008 SIM JMS JMS port Y 50009 SIM JNDI JNDI port 50010 DMI 50013 RMI Web Services RMI Loader 50014 JRMP JRMP Invoker 50015 Pooled invoker Pooled invoker Y Y Y Y 5 6 DMI Y
PAGE 17
Inbound (in) – Request or response received by a server is called inbound 1 All ports are for TCP (except ICMP and SNMP). The CMS will normally have all managed system ports open, as the CMS is a managed system itself. Firewalls may be configured to block these ports if the CMS is not to be managed from another system. 2 RMI port is used within the CMS for inter-process communication. Connections from outside the CMS are not accepted, and firewalls may block this port.
PAGE 18
HP Insight Management Installer The HP Insight Management installer integrates installation of HP management software. The installer will install or upgrade individual product as well as suites.
PAGE 19
Y Y 2381 Y HTTPS 5432 Web agent Web server ProstgreSQL Server database Y Y 5988 HTTP WBEM service Y Y 5989 HTTPS WBEM service Y 50000 HTTPS HP SIM Web server (configurable ) Y 50001 HTTPS HP SIM SOAP Y 50002 HTTPS HP SIM SOAP with client certificate authentication Y 50003 HTTP HP SIM SOAP 50004 HTTPS/HTTP WBEM event receiver (configurable7) Y 50005 WBEM WBEM Events Y 50006 PostgreSQL PostgreSQL Y 50008 SIM JMS JMS port Y 50009 SIM JNDI JNDI port 50010 DMI
PAGE 20
Y Y 443 SSL 1780 Communication with iLO hpvmmsvc service Y Y 69 UDP PXE Client Y Y 1758 UDP PXE Client Y Y 1759 UDP (Multi cast) PXE Client Y Y 67 UDP PXE Client Y Y 68 UDP PXE Client Y Y 4011 UDP PXE Client Y Y 405 TCP PXEConfig Y Y 406 TCP PXECfg Service Y Y 407 TCP PXE Server and PXE MTFTP Y Y 8081 HTTP DSWeb Y Y 8080 HTTP DSWeb,Console Manager Y Y 505 TCP Win32 console,Axengine,PXEManager Y Y 402 TCP/UDP Agents, PXE Server, Data Manag
PAGE 21
Y Y Y Y Y Y HTTPS HTTPS WBEM, WBEM Service on EVA Command View Server, BNA port to connect SPM 5988 HTTP WBEM service HTTPS Used by web agents 2381 Y 20,21 Y 443 Y Y Y Y Y Y 2460024616 22 Y Y Y Y FTP - Used for upload and configuration backup from CLI SSL Graphical User Interface HTTPS Used for Web Management Interface Used by the Distributed Task Facility (DTF) 9143 OpenSSL Used by Application Discovery 9617,9 618 TCP Global Workload Manager uses on CMS 280 HTTP Web
PAGE 22
access the host server. This will allow servers running VMWare or other virtualization platforms to update their iLO without the need to reboot their server or migrate their VMs to other servers. 1 Y Y 50116 TCP This is port is used in CMS Y Y 51268 TCP This port is used in target machine Y Y 6100061007 These ports are used from the target server back to the system running HP Smart Update Manager.
PAGE 23
available one is used by HP Smart Update Manager to pass information between processes on the local workstation where HP Smart Update Manager is executed, and the next available one is used to receive messages from remote servers. Y 1 Y 62000 and 62001 These ports (or the first two ports available after 62000) are used for internal process communications on the system running HPSUM on each target Y 62286 This port is the default for some internal communications.
PAGE 24
HP Onboard Administrator Ports This section is based on the assumption that HP Onboard Administrator is behind the firewall with the CMS.
PAGE 25
Policies required for IM DVD Installation The following security policies are mandatorily to be enabled before proceeding with the DVD Installation. If the below policies are enabled and proceed with the installation then DVD installation will complete successfully. Table 10 Security Policies required for IM DVD Installation User rights assignments Security Options Why it’s required Bypass traverse checking Everyone, LOCAL SERVICE, NETWORK SERVICE, For to fetch the details from the IIS server manager.
PAGE 26
users who are logged on locally to the computer can shut down the operating system using the Shut Down command. Misuse of this user right can result in a denial of service. Conclusion This has paper identified various options available for managing HP systems in a secure environment. The solutions explained here are intended only as a framework for exploring the options. Each system administrator can and should tailor a solution for his network based on these options.
PAGE 27
Appendix A: Configuring a separate management network To configure a separate management network using HP Systems Insight Manager, install HP Systems Insight Manger on the secondary network by completing the following steps: 1. Configure SNMP to accept packets only from the IP addresses used on the management network, or bind SNMP to the secondary network interface (if the operating system allows this): • On Windows systems: From the Control Panel, open the Services menu.
PAGE 28
Appendix B: Modifying default ports To modify the default port 50000 used by HP System Insight Manger to different port, install HP System Insight Manger and complete the following steps: 1. Modify the default port value to the required port value from the following lines in server.xml file under \jboss\server\hpsim\deploy\jbossweb.deployer PAGE 29
For more information For additional information, refer to the resources listed below. Source Hyperlink ProLiant server management http://h18013.www1.hp.com/products/servers/management/index.html HP Systems Insight Manager http://www.hp.com/go/hpsim Understanding HP Systems Insight Manager Security http://h10018.www1.hp.com/wwsolutions/misc/hpsimhelpfiles/HPSIM_53_Security.pdf WBEM Providers for HP SIM www.hp.