- Notes, cautions, and warnings
- Overview
- Built in iDRAC and PowerEdge Security
- Securely Configuring iDRAC Web Server
- Securely Using TLS/SSL Certificate
- Federal Information Processing Standards (FIPS)
- Secure Shell (SSH)
- Network Security Configuration
- Interfaces and Protocols to Access iDRAC
- iDRAC Port Configuration
- IPMI and SNMP Security Best Practices
- Secure Enterprise Key Manager (SEKM) Security
- iDRAC9 Group Manager
- Virtual Console and Virtual Media Security
- VNC Security
- User Configuration and Access Control
- Configuring Local Users
- Disabling Access to Modify iDRAC Configuration Settings on Host System
- iDRAC User Roles and Privileges
- Superroot User
- Recommended Characters in Usernames and Passwords
- Password Strength Policy
- Secure Default Password
- Changing the Default Login Password using Web Interface
- Force Change of Password (FCP)
- Simple 2-Factor Authentication (Simple 2FA)
- RSA SecurID Two Factor Authentication (2FA) iDRAC9 Datacenter
- Active Directory
- LDAP
- Customizable Security Banner
- System Lockdown Mode
- Securely Configuring BIOS System Security
- Secure Boot Configuration
- Securely Erasing Data
- LCD Panel
- Server Inventory, Lifecycle Log, Server Profiles, and Licenses Import and Export
- Security Events Lifecycle Log
- Default Configuration Values
- Network Vulnerability Scanning
- Security Licensing
- Field Service Debug (FSD)
- Best Practices
- Appendix - White papers
iDRAC9 Security Configuration Guide
Remote Syslog with TLS
The default setting in iDRAC continue to be unencrypted RSyslog. This is for backward compatibility. Supporting TLS based Remote Syslog requires uploading trust certificates between the client device (iDRAC) and the server (Syslog server). Multiple steps are required to set up this configuration with external inputs.
Remote Syslog with TLS is supported for Firmware release 6.00.02.00 and above.
With encrypted Remote Syslog, the devices and syslog servers share the same CA certificate. iDRAC supports up to three Remote Syslog servers in the existing cleartext UDP Remote Syslog implementation. But with encrypted Remote Syslog, the usage is normally just one target Syslog server. The open source software used to implement the Remote Syslog protocol also has limitations to support only one secure target server, and does not allow combining multiple CA certificates. Hence iDRAC provides option to select only one secure Remote Syslog target.
The existing unencrypted Remote Syslog feature uses UDP port, default port is 514.
A new iDRAC attribute SecurePort is used to specify the secure Remote Sylog port number, default port being 6514. Secure Syslog uses TCP port.
Simultaneous encrypted and unencrypted targets are not supported. iDRAC user has to select either of the options by changing the value of iDRAC attribute SysLogEnable.
TLS based Remote Syslog servers and clients use the same CA certificate in the configuration settings, which is obtained from a CA server. iDRAC provides user interface to upload this CA certificate and add it to its configuration file and restart the Remote Sylog service.
By default, iDRAC uses anonymous identity for the encrypted Remote Syslog communication. This can be overridden by generating a signed trust certificate to prove iDRAC’s authenticity. iDRAC provides user interface to create a certificate signing request and an option to upload and view the iDRAC trust certificate.
The existing telemetry feature allows only anonymous identity for iDRAC as a syslog client.
iDRAC has user interfaces as part of the Telemetry features to upload CA certificate, and the web server feature has options to generate certificate signing request (CSR) and upload the signed certificate. These user interface templates could be reused in the context of the TLS Remote Syslog feature.
iDRAC web certificate can be used as the iDRAC identity certificate, but normal customer usage is to use separate certificates for web server and Remote syslog. Often a Remote Syslog identity certificate could be generated within the company’s internal certificate signing server setup. Hence iDRAC does not provide option to reuse the web server certificate.
NOTE:Initially the Telemetry feature in iDRAC was using Syslog code. However, later versions of iDRAC changed Telemetry to use a different open source code and no longer have any dependency to the Remote Syslog feature. Also Telemetry uses different configuration of iDRAC attributes.
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\