- Notes, cautions, and warnings
- Overview
- Built in iDRAC and PowerEdge Security
- Securely Configuring iDRAC Web Server
- Securely Using TLS/SSL Certificate
- Federal Information Processing Standards (FIPS)
- Secure Shell (SSH)
- Network Security Configuration
- Interfaces and Protocols to Access iDRAC
- iDRAC Port Configuration
- IPMI and SNMP Security Best Practices
- Secure Enterprise Key Manager (SEKM) Security
- iDRAC9 Group Manager
- Virtual Console and Virtual Media Security
- VNC Security
- User Configuration and Access Control
- Configuring Local Users
- Disabling Access to Modify iDRAC Configuration Settings on Host System
- iDRAC User Roles and Privileges
- Superroot User
- Recommended Characters in Usernames and Passwords
- Password Strength Policy
- Secure Default Password
- Changing the Default Login Password using Web Interface
- Force Change of Password (FCP)
- Simple 2-Factor Authentication (Simple 2FA)
- RSA SecurID Two Factor Authentication (2FA) iDRAC9 Datacenter
- Active Directory
- LDAP
- Customizable Security Banner
- System Lockdown Mode
- Securely Configuring BIOS System Security
- Secure Boot Configuration
- Securely Erasing Data
- LCD Panel
- Server Inventory, Lifecycle Log, Server Profiles, and Licenses Import and Export
- Security Events Lifecycle Log
- Default Configuration Values
- Network Vulnerability Scanning
- Security Licensing
- Field Service Debug (FSD)
- Best Practices
- Appendix - White papers
iDRAC9 Security Configuration Guide
Auto Config
The Auto Config feature configures and provisions all the components in a server in a single operation. These components include BIOS, iDRAC, and PERC. Auto Config automatically imports a Server Configuration Profile (SCP) XML or JSON file containing all configurable parameters. The DHCP server that assigns the IP address also provides the details for accessing the SCP file.
SCP files are created by configuring a gold configuration server. This configuration is then exported to a shared NFS, CIFS, HTTP, or HTTPS network location that is accessible by the DHCP server and the iDRAC of the server being configured. The SCP file name can be based on the Service Tag or model number of the target server or can be given as a generic name. The DHCP server uses a DHCP server option to specify the SCP file name (optionally), SCP file location, and the user credentials to access the file location.
NOTE:The user credentials to the network share are sent in plaintext as part of the DHCP response message, so care must be taken when using this Auto Config on an unsecure network that the credentials cannot be used for anything other than accessing the network share.
When the iDRAC obtains an IP address from the DHCP server that is configured for Auto Config, iDRAC uses the SCP to configure the server’s devices. Auto Config is invoked only after the iDRAC gets its IP address from the DHCP server. If it does not get a response or an IP address from the DHCP server, then Auto Config is not invoked. HTTP and HTTPS file sharing options are supported for iDRAC firmware 3.00.00.00 or later. Details of the HTTP or HTTPS address must be provided. In case the proxy is enabled on the server, the user must provide further proxy settings to allow HTTP or HTTPS to transfer information.
If autoconfig is not needed, it is a recommended security configuration to disable this feature to limit potential attack surface. If required, auto config should use HTTPS as a security best practice.
To configure Auto Config using iDRAC GUI:
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\