Hi, this is Jennifer Colangelo, HPE specialist here at Hewlett Packard Enterprise.
HPE engineer pre-emptive measures into HPE ProLiant Gen10 servers
with Intel Xeon Scalable processors.
Gen10 servers with HPE Integrated Lights Out 5 earn the status as the
world’s most secure industry-standard server.
Today we have Doug Hascall joining us.
He is the manager of HPE iLO Firmware and Smart Update technologist,
and he is going to run down the top ten HPE security recommendations for iLO.
Hey Jennifer, glad to be here.
And I am honored to serve as the manager of the iLO and the Smart Update teams.
My teams are responsible for the iLO firmware, Smart Update managers,
Smart Update tool, iLO Amplifier, Intelligent Provisioning, and the iLO REST tool.
Hmm! Good to know.
I’m excited to hear your top ten recommendations for iLO security.
Well, let’s get started.
Here we go: top ten list of best practices to keep iLO and servers secure,
starting from #10: Disable unused ports.
If you’re not using SSH, if you’re not using SNMP, turn those ports off.
Everything in iLO is configurable; you can turn on what you need and turn off what you’re not using.
#9: Use a dedicated management network.
We offer both the dedicated NIC and the shared network port.
That dedicated management port gives you the ability to create an
isolated management network and is more secure.
#8: Configure the remote console to automatically lock the OS server console.
So when you disconnect from the remote console we can make it so
it automatically locks the server’s console; you don’t have to remember to do that.
It can be configured to lock both Windows, Linux or a custom key sequence – whatever you need.
#7: On Intel platforms we need to keep the management engine firmware update up to date as well.
That’s also known as the 'server platform services firmware’.
#6: Utilize strong encryption ciphers.
We have a wide variety of security profiles:
we have the Production mode, High Security mode, FIPS mode, CNSA mode.
So you can turn on the security that you need and so turn on those stronger encryption ciphers.
#5, very important: Regularly change passwords and use strong passwords.
We had a great conversation with James Morrison with the FBI out at Discover in Las Vegas,
and he told us a story about how their research shows that
almost every password is a word you find in the dictionary, a number – usually 1
or 1, 2, 3 – and a punctuation mark – almost always an exclamation point or a hashtag.
So if that sounds like your password, it’s not a strong password. Go out and change it.
#4: Use a real CA-signed SSL certificate.
So we want to go out and replace that self-signed SSL certificate with a real CA-signed certificate,
otherwise your system will be susceptible to a man-in-the-middle attack.
It doesn’t really matter if you locked the doors if you left the keys on top of the car.
#3: Don’t connect iLO directly to the internet.
Now while we work really hard at our security and we’ve got great security features,
putting it out on the internet is just asking for someone to come attack it.
Make sure there’s a firewall in between your iLO or any device and the internet.
#2: Disable IPMI over LAN.
If you don’t know what IPMI is, turn it off.
If you don’t use IPMI, turn it off.
And, in fact, in the latest versions of our iLO 5, iLO 4, and iLO 3 firmware we’re going to
turn it off for you if you do a reset to default.
The new default value will be for IPMI over LAN to be disabled.
And the #1 security recommendation for iLO is keep your firmware up to date.
We’ve got great new capabilities in our Gen10 servers in conjunction
with Smart Update Manager, iLO Amplifier, OneView, where we can easily update all the software
and firmware that’s part of the SPP.
So keep that firmware up to date.
Thanks, Doug, for these top ten tips.
You bet, Jennifer.
And don’t forget, if people want to have a chat with us,
the email we’ve created is iLOfeedback@hpe.com.