Unsolved
This post is more than 5 years old
2 Posts
0
7542
October 23rd, 2017 04:00
How to disable ssh/web on idrac7 with Basic Management (no idrac license)?
I have a Dell R320 Server. I need to disable ssh/web access to this server becase of PCI DSS compliance.
It isn't a IDRAC Enterprise and it doesn't allow to use rcadm command to disable the web / ssh servers. Altough they are not useful, it is Basic Managment without license, when a scan is performed with Nessus several vulnerabilities are displayed because of this.
I have seen that there is a tool for a trial license of 30 days, but it needs to stop the server: boot from a CD-ROM and restart the server.
Some options?
No Events found!
Daniel My
12 Elder
•
6.2K Posts
0
October 23rd, 2017 13:00
Hello
The iDRAC7 BMC does not have the web server or SSH features. The iDRAC8 basic management has these features. The iDRAC7 and 8 started sharing the same firmware around version 2.0/2.1, so the web server may have been added as a feature to the BMC licensed iDRAC7. What firmware version are you at?
Can you connect to the GUI or SSH? There are other features that may be triggering your scan. Check to see if any network features are enabled in the iDRAC/BMC during boot. Features like IPMI-over-LAN or remote enablement may be what is detected.
Thanks
jlrgarcia
2 Posts
0
October 26th, 2017 05:00
The IDRAC basic has a ssh and web server:
- The ssh server isn't functional, but it is listening and there is problems with security scans.
- The web server only allows to upgrade the firmware.
This is the output a ssh server. As you can see there is a ssh server on iDRAC that can't be disallowed.
pc1$ ssh root@10.191.74.25
root@10.191.74.25's password:
X11 forwarding request failed on channel 0
License Violation: "SSH"
Connection to 10.191.74.25 closed.
I had the version 1.57 and I have upgraded to version 2.50 (in both versions ssh and web server are started).
It has fixed the ssh and ssl vulnerabilities, but I have a remaining problem: I can't upload a new certificate. The SSL certificate of iDRAS is self-signed, and it isn't valid for PCI scan with Nessus.
This question remains:
How can I disable the web server with a iDRAC basic? or how can I upload new certiicate using iDRAC basic?
Note: racadm command doesn't work. It says: not valid license.
Blaine E
1 Message
0
August 27th, 2018 09:00
Not sure if this helps, but OMSA 8 or 9 allows racadm commands to disable ssh:
[root@test-1 ~]# racadm get iDRAC.SSH.Enable
[Key=iDRAC.Embedded.1#SSH.1]
Enable=Enabled
[root@test-1 ~]# racadm set iDRAC.SSH.Enable 0
[Key=iDRAC.Embedded.1#SSH.1]
Object value modified successfully
[root@test-1 ~]# racadm get iDRAC.SSH.Enable
[Key=iDRAC.Embedded.1#SSH.1]
Enable=Disabled
[root@test-1 ~]# racadm set iDRAC.SSH.Enable 1
[Key=iDRAC.Embedded.1#SSH.1]
Object value modified successfully
[root@test-1 ~]# racadm get iDRAC.SSH.Enable
[Key=iDRAC.Embedded.1#SSH.1]
Enable=Enabled
[root@test-1 ~]#
If the racadm command gives you an unsupported error, install the srvadmin-idracadm7 rpm and try again.