Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Premier Sign In Partner Program Sign In
Contact Us

iDRAC9 Security Configuration Guide

PDF

Secure Enterprise Key Manager (SEKM) Security

The OpenManage SEKM enables you to use an external Key Management Server (KMS) to manage keys that can then be used by iDRAC to lock and unlock storage devices on a Dell PowerEdge server. iDRAC requests the KMS to create a key for each storage controller, and then fetches and provides that key to the storage controller on every host boot so that the storage controller can then unlock the SEDs. The advantages of using SEKM over Local Key Management (LKM) are:

  • In addition to the LKM–supported “Theft of an SED” use case, SEKM protects from a “Theft of a server” use case. Because the keys used to lock and unlock the SEDs are not stored on the server, attackers cannot access data even if they steal a server.
  • Centralized key management at the external Key Management Server.
  • SEKM supports the industry standard OASIS KMIP protocol thus enabling use of any external third-party KMIP server.

For more information, see Enable OpenManage Secure Enterprise Key Manager (SEKM) on Dell PowerEdge Servers

You can configure SEKM from iDRAC Settings page. Click iDRAC Settings > Services > SEKM Configuration.

NOTE:When Security (Encryption) mode is changed from None to SEKM, Real-Time job is not available. But it is added to Staged job list. However, Real-Time job is successful when the mode is changed from SEKM to None.

Verify the following when changing the value of the Username Field in Client Certificate section on the KeySecure server (for ex: Changing the value from Common Name (CN) to User ID (UID))

  1. While using an existing account:
    • Verify in the iDRAC TLS/SSL certificate that instead of the Common Name field, the Username field now matches the existing username on the KMS. If they do not, then you must set the username field and regenerate the TLS/SSL certificate again, get it signed on the KMS, and reupload to iDRAC.
  2. While using a new user account:
    • Ensure the Username string matches the username field in the iDRAC TLS/SSL certificate.
    • If they do not match, then you must reconfigure the iDRAC KMS attributes Username and Password.
    • Once the certificate is verified to contain the username, then the only change that must be made is to change the key ownership from the old user to the new user to match the newly created KMS username.

While using Vormetric Data Security Manager as KMS, ensure that the Common Name (CN) field in iDRAC TLS/SSL certificate matches with the hostname added to Vormetric Data Security Manager. Otherwise, the certificate may not import successfully.

NOTE:Rekey option is disabled when racadm sekm getstatus reports as Failed.
NOTE:SEKM only supports Common name, User ID, or Organization Unit for Username field under Client certificate.
NOTE:If you are using a third-party CA to sign the iDRAC CSR, ensure that the third-party CA supports the value UID for Username field in Client certificate. If it is not supported, use Common Name as the value for Username field.
NOTE:If you are using Username and Password fields, ensure that KMS server supports those attributes.

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\