跳转至主要内容
退出

欢迎访问戴尔

我的帐户
  • 快速、轻松地下订单
  • 查看订单并跟踪您的发货状态
  • 创建并访问您的产品列表
  • 使用“Company Administration”（公司管理），管理Dell EMC站点、产品和产品级联系人。
登录 创建帐户 登录Premier 合作伙伴计划登录
联系我们

您的 Dell.com 购物车

文章编号: 000189996

iDRAC8 firmware version 2.81.81.81: HTTP or HTTPS FQDN Connection Failures

摘要: The Dell EMC Integrated Dell Remote Access Controller 8 (iDRAC9) firmware version 2.81.81.81 blocks HTTP or HTTPS access through Fully Qualified Domain Name (FQDN) when the FQDN is not defined as the iDRAC RAC Name. ...

本文可能已自动翻译。如果您对其质量有任何反馈，请使用此页面底部的表单告知我们。

文章内容

症状

The Dell EMC Integrated Dell Remote Access Controller 8 (iDRAC8) firmware version 2.81.81.81 introduced HTTP or HTTPS connection changes that may impact user connections when specifying Fully Qualified Domain Name (FQDN) address. Due to these changes,  iDRAC9 users may encounter connection errors, redirection, or '400 - Bad Request' errors. These connection sightings occur when the specified FQDN does not match the iDRAC 'DNSRacName' or 'DNSDomainName' values.

Browser Error Example:

iDRAC8-Mozilla-Unable2Connect.png

Curl Error Example: 

	root@rhel7-vm:~$ curl -k https://iR630-A.dell.com/
	<!DOCTYPE html>
	<head>
	    <title>Bad Request</title>
	    <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">
	</head>
	<body>
	<h2>Access Error: 400 -- Bad Request</h2>
	<pre></pre>
	</body>
</html>

原因

The webserver in iDRAC8 firmware version 2.81.81.81 enforces an HTTP or HTTPS Host Header check by default. Additional information is available in the Dell Security Advisory: DSA-2021-041: Dell iDRAC 8 Security Update for a host header injection vulnerability.

解决方案

By default, iDRAC8 checks the HTTP or HTTPS Host Header and compares it to the defined 'DNSRacName' and 'DNSDomainName'. When the values do not match, the iDRAC refuses the HTTP or HTTPS connection. In iDRAC8 2.81.81.81, this Host Header enforcement can be disabled with the following RACADM command:

#Disable host header check
racadm set idrac.webserver.HostHeaderCheck 0

Note: Only set the HostHeaderCheck value to '0' when manual Host Record exists within DNS environment.

When the HTTP or HTTPS Host Header check is enabled (more secure), iDRAC can be accessed using the IPv4or IPv6 address, the RAC Name, or the defined iDRAC FQDN (DNSRacName.DNSDomainName). If end user is accessing with hostnames that iDRAC may not be aware of (such as a manual DNS entry added in DNS records), iDRAC8 2.81.81.81 firmware version introduced a new attribute 'ManualDNSEntry'. This new setting can be updated with up to four IP addresses, host names, or FQDNs to provide an allow-list of Host Headers. This ensures that incoming requests are not dropped when the HTTP or HTTPS Host Header carries one of the entries in the 'ManualDNSEntry' setting.
 
# Add manual entry to allow list
racadm set idrac.webserver.ManualDNSEntry 192.168.20.30
racadm set idrac.webserver.ManualDNSentry 192.168.20.30,idrac.mydomain.com

This additional configuration is required in cases when:

  • End user is using manual DNS configuration to access iDRAC (Manual DNS Host Record.
  • Subject Alternative Name or Wild-card certificate is used to access the iDRAC.
  • Accessing iDRAC using host IP address directly (by ISM).
Note: To resolve ISM connection issues, disabling the host header check feature is the only mitigation. Manual DNS Entries do not resolve ISM connections. 

文章属性

受影响的产品

iDRAC8 with Lifecycle Controller version 2.81.81.81

上次发布日期

11 1月 2022

版本

11

文章类型

Solution

返回页首