Oracle Integrated Lights Out Manager (ILOM) 3.0 Getting Started Guide

---

Logging In to ILOM for the First Time Using the CLI

To log in to the ILOM CLI for the first time, you use the default root user account and its default password changeme. After you set up your network environment, you can establish an Administrative user account using an assigned user account name and password.

To log in to the ILOM CLI for the first time, use SSH and the root user account.

1. To log in to the ILOM CLI using the root user account, type:

$ ssh root@system_ipaddress

If ILOM is operating in a dual-stack network environment, the system_ipaddress can be entered using either an IPv4 or IPv6 address format.

For example:

For IPv4 - 10.8.183.106

or

For IPv6 - [fec0:a:8:b7:214:4fff:5eca:5f7e/64]

The ILOM Login prompt appears.

For more information about entering IP addresses in a dual-stack environment, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide.

2. Type the default user name and password:

<hostname>: root

Password:changeme

The ILOM CLI prompt appears (->).

---

Configuring an IPv4 and IPv6 Network Environment

The following CLI procedure provides instructions for configuring ILOM to operate in a dual-stack IPv4 and IPv6 network environment. For a detailed description about configuring ILOM in the IPv4 and IPv6 network environment, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide.

If you are configuring ILOM to operate in an IPv4-only network environment, as is supported in ILOM 3.0.10 and earlier versions of ILOM, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide.

By default, ILOM will attempt to obtain the IPv4 address using DHCPv4 and the IPv6 address using IPv6 stateless.

1. Log in to the ILOM SP CLI or the CMM CLI.

Establish a local serial console connection or SSH connection to the server SP or CMM.

2. Perform the network configuration instructions that apply to your network environment:

• To configure IPv4 network settings, perform Step 3 through Step 5 in this procedure.
• To configure IPv6 network settings, perform Step 6 to Step 10 in this procedure.

3. For IPv4 network configurations, use the cd command to navigate to the /x/network working directory for the device.

For example:

• For a rackmount server SP type: cd /SP/network
• For a chassis CMM type: cd /CMM/network
• For a chassis blade server SP type: cd /CH/BLn/network
• For a chassis blade server with multiple SP nodes type:
  cd /CH/BLn/Noden/network

4. Type the show command to view the configured IPv4 network settings configured on the device.

5. To set IPv4 network settings for DHCP or static, perform one of the following:

• To configure DHCP IPv4 network settings, set values for the following properties:



Property	Set Property Value	Description
state	set state=enabled	The network state is enabled by default for IPv4. Note - To enable the DHCP network option for IPv4 the state must be set to enabled.
pendingipdiscovery	set pendingipdiscovery=dhcp	The property value for ipdiscovery is set to dhcp by default for IPv4. Note - If the dhcp default property value was changed to static, you will need to set the property value to dhcp.
commitpending=	set commitpending=true	Type set commitpending=true to commit the changes made to the state and ipdiscovery property values.



• To configure static IPv4 network settings, set values for the following properties:



Property	Set Property Value	Description
state	set state=enabled	The network state is enabled by default for IPv4. Note - To enable the static IPv4 network option the state must be set to enabled.
pendingipdiscovery	set pendingipdiscovery=static	To enable a static IPv4 network configuration, you need to set the pendingipdiscovery property value to static. Note - The property value for ipdiscovery is set to dhcp by default for IPv4.
pendingipaddress pendingipnetmask pendingipgateway	set pendingipaddress=<ip_address> pendingipnetmask=<netmask> pendingipgateway=<gateway>	To assign multiple static network settings, type the set command followed by the pending command for each property value (IP address, netmask, and gateway), then type the static value that you want to assign.
commitpending=	set commitpending=true	Type set commitpending=true to commit the changes made to the state, ipdiscovery, and network settings property values.

6. For IPv6 network configurations, use the cd command to navigate to the /x/network/ipv6 working directory for the device.

For example:

• For a rackmount server SP type: cd /SP/network/ipv6
• For a chassis CMM type: cd /CMM/network/ipv6
• For a chassis blade server SP type: cd /CH/BLn/network/ipv6
• For a chassis blade server with multiple SP nodes type:
  cd /CH/BLn/Noden/network/ipv6

7. Type the show command to view the configured IPv6 network settings configured on the device.

For example, see the following sample output values for the IPv6 properties on a server SP device:.

-> show
 
 /SP/network/ipv6
    Targets:
 
    Properties:
        state = enabled
        autoconfig = stateless
        dhcpv6_server_duid = (none)
        link_local_ipaddress = fe80::214:4fff:feca:5f7e/64
        static_ipaddress = ::/128
        ipgateway = fe80::211:5dff:febe:5000/128
        pending_static_ipaddress = ::/128
        dynamic_ipaddress_1 = fec0:a:8:b7:214:4fff:feca:5f7e/64
 
    Commands:
        cd
        show

8. To configure an IPv6 auto-configuration option, use the set command to specify the following auto-configuration property values.

The following information is relevant to the IPv6 autoconfig options:

• IPv6 auto-config options take affect after they are set. You do not need to commit these changes under the /network target.
• IPv6 auto-config addresses learned for the device will not affect any of the active ILOM sessions to the device. You can verify the newly learned auto-configured addresses under the /network/ipv6 target.
• As of ILOM 3.0.14 or later, you can enable the stateless auto-config option to run at the same time as when the option for dhcpv6_stateless is enabled or as when the option for dhcpv6_stateful is enabled. However, the auto-config options for dhcpv6_stateless and dhcpv6_stateful should not be enabled to run at the same time.

9. To set a pending static IPv6 address, specify the following property values:

10. To commit the pending IPv6 static network parameters, perform the following steps:

a. Use the cd command to change the directory to the device network target.

For example:

• For rackmount server type: cd /SP/network
• For chassis CMM type: cd /CMM/network
• For chassis blade server SP type: cd /CH/BLn/network
• For chassis blade server SP with multiple nodes type:
  cd /CH/BLn/Noden/network

b. Type the following command to commit the changed property values for IPv6:

set commitpending=true

To test the IPv4 or IPv6 network configuration from ILOM use the Network Test Tools (Ping and Ping6). For details, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide.

---

Adding User Accounts or Configuring a Directory Service

After you log in to ILOM using the root user account, you can choose either to create a local user account or to configure a directory service. For detailed information about ILOM user accounts and directory services, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide.

1. Log in to the ILOM CLI.

2. Type the following command and your password to add a local user account:

--> create /SP/users/username password=password

For example:

-> create /SP/users/user5
Creating user...
Enter new password: ********
Enter new password again: ********
Created /SP/users/user5

3. Type the following command to assign roles to a user account:

--> set /SP/users/username role=aucr

For example:

-> set /SP/users/user5 role=aucr
Set ’role’ to ’aucr’

For a description of the user account roles, see Add User Account and Assign Privileges.

1. Log in to the ILOM CLI using the root user account.

2. Use the show command to view the top-level properties. Type:

-> cd /SP/clients/activedirectory
/SP/clients/activedirectory
 
-> show
 
 /SP/clients/activedirectory
    Targets:
        admingroups
        alternateservers
        cert
        customgroups
        dnslocatorqueries
        opergroups
        userdomains
 
    Properties:
        address = 10.5.121.321
        defaultrole = Administrator
        dnslocatormode = enabled
        logdetail = trace
        port = 0
        state = disabled
        strictcertmode = disabled
        timeout = 4
 
    Commands:
        cd
        set
        show

3. Use the show command to view information in the tables. Type:

-> show /SP/clients/activedirectory/name/n

Where n is 1 through 5, and where name is one of the following:

• admingroups (for Admin Groups properties)
• opergroups (for Operator Groups properties)
• customgroups (for Custom Groups properties)
• userdomains (for User Domains properties)
• alternateservers (for Alternate Servers properties)
• dnslocatorqueries (for DNS Locator Queries properties)
• cert (for certificate properties - cert is not a table; therefore the value of 1 through 5 for n does not apply)

You can use the show command to retrieve the certificate properties:

-> show /SP/clients/activedirectory/cert
 /SP/clients/activedirectory/cert
    Targets:
 
    Properties:
        certstatus = certificate not present
        clear_action = (none)
        issuer = (none)
        load_uri = (none)
        serial_number = (none)
        subject = (none)
        valid_from = (none)
        valid_until = (none)
        version = (none)

You can also use the show command to retrieve the alternate server certificate properties:

-> show /SP/clients/activedirectory/alternateservers/1/cert
 /SP/clients/activedirectory/alternateservers/1/cert
    Targets:
 
    Properties:
        certstatus = certificate not present
        clear_action = (none)
        issuer = (none)
        load_uri = (none)
        serial_number = (none)
        subject = (none)
        valid_from = (none)
        valid_until = (none)
        version = (none)

4. Use the set command to configure top-level properties.

For example:

-> set address=10.5.121.321
Set ’address’ to 10.5.121.321
->set ...etc. for defaultrole, dnslocator, logdetail, port, state, stricmode, timeout

5. Use the set command to load a certificate or to modify properties.

For example:

• To load an Active Directory certificate:


-> set /SP/clients/activedirectory/cert load_uri=tftp://10.6.143.192/sales/cert.cert Set ’load_uri’ to ’tftp://10.6.143.192/sales/cert.cert’


• To load an Alternate Server certificate:


-> set /SP/clients/activedirectory/alternateservers/1/cert load_uri=tftp://10.6.143.192/sales/cert.cert Set ’load_uri’ to ’tftp://10.6.143.192/sales/cert.cert’


• To modify Admin Groups Table properties:


-> set /SP/clients/activedirectory/admingroups/1 name=CN=spSuperAdmin,OU=Groups,DC=sales,DC=oracle,DC=com Set 'name' to 'CN=spSuperAdmin,OU=Groups,DC=sales,DC=oracle,DC=com'


• To modify Operator Groups table properties:


-> set /SP/clients/activedirectory/opergroups/1 name=CN=spSuperOper,OU=Groups,DC=sales,DC=oracle,DC=com Set 'name' to 'CN=spSuperOper,OU=Groups,DC=sales,DC=oracle,DC=com'


• To modify Custom Groups Table properties:

-> set /SP/clients/activedirectory/customgroups/1 name=CN=spSuperCust,OU=Groups,DC=sales,DC=oracle,DC=com
Set 'name' to 'CN=spSuperCust,OU=Groups,DC=sales,DC=oracle,DC=com'
-> set /SP/clients/activedirectory/customgroups/1 roles=au
Set ‘roles’ to au

• To modify User Domains Table properties:


-> set /SP/clients/activedirectory/userdomains/1 domain=username@sales.oracle.com Set 'domain' to 'username@sales.oracle.com'


• To modify Alternate Servers Table properties:


-> set /SP/clients/activedirectory/alternateservers/1 address=ip_address


• To modify DNS Locator Queries table properties:


-> set /SP/clients/activedirectory/dnslocatorqueries/1 service=_ldap._tcp.gc._msdcs.<DOMAIN>.<PORT:3269>

The DNS Locator service query identifies the named DNS service. The port ID is generally part of the record, but it can be overridden by using the format <PORT:636>. Also, named services specific for the domain being authenticated can be specified by using the <DOMAIN> substitution marker.

1. Log in to the ILOM CLI.

2. Use the set command to enter the proxy user name and password.

For example:

--> set /SP/clients/ldap binddn="cn=proxyuser, ou=people, ou=sales, dc=oracle, dc=com" bindpw=password

3. Enter the IP address or DNS name of the LDAP server. Type:

--> set /SP/clients/ldap address=ldap_ipaddress|DNS_name

4. (Optional) Assign the port used to communicate with the LDAP server; the default port is 389. Type:

--> set /SP/clients/ldap port=ldap_port

5. Enter the Distinguished Name of the branch of your LDAP tree that contains users and groups. Type:

--> set /SP/clients/ldap searchbase="ou=people, ou=sales, dc=oracle, dc=com" 

This is the location in your LDAP tree that you want to search for user authentication.

6. Set the state of the LDAP service to enabled. Type:

--> set /SP/clients/ldap state=enabled

7. To verify that LDAP authentication works, log in to ILOM using an LDAP user name and password.

LDAP/SSL offers enhanced security to LDAP users by way of Secure Socket Layer (SSL) technology. Certificates are optional if Strict Certificate Mode is used.

Follow these steps to configure ILOM for LDAP/SSL:

1. Log in to the ILOM CLI.

2. Use the show command to view top-level properties. Type:

-> cd /SP/clients/ldapssl
/SP/clients/ldapssl
 
-> show
 
 /SP/clients/ldapssl
    Targets:
        admingroups
        alternateservers
        cert
        customgroups
        opergroups
        userdomains
 
    Properties:
        address = 10.5.121.321
        defaultrole = Administrator
        logdetail = trace
        port = 0
        state = disabled
        strictcertmode = disabled
        timeout = 4
 
    Commands:
        cd
        set
        show

3. Use the show command to view information in the tables. Type:

-> show /SP/clients/ldapssl/name/n

Where n is 1 through 5, and where name is one of the following:

• admingroups (for Admin Groups properties)
• opergroups (for Operator Groups properties)
• customgroups (for Custom Groups properties)
• userdomains (for User Domains properties)
• alternateservers (for Alternate Servers properties)
• cert (for certificate properties - cert is not a table; therefore the value of 1 through 5 for n does not apply)

You can use the show command to retrieve the certificate properties:

-> show /SP/clients/ldapssl/cert
 /SP/clients/ldapssl/cert
    Targets:
 
    Properties:
        certstatus = certificate not present
        clear_action = (none)
        issuer = (none)
        load_uri = (none)
        serial_number = (none)
        subject = (none)
        valid_from = (none)
        valid_until = (none)
        version = (none)

You can also use the show command to retrieve the alternate server certificate properties:

-> show /SP/clients/ldapssl/alternateservers/1/cert
 /SP/clients/ldapssl/alternateservers/1/cert
    Targets:
 
    Properties:
        certstatus = certificate not present
        clear_action = (none)
        issuer = (none)
        load_uri = (none)
        serial_number = (none)
        subject = (none)
        valid_from = (none)
        valid_until = (none)
        version = (none)

4. Use the set command to configure top-level properties.

For example:

-> set address=10.5.121.321
Set ’address’ to 10.5.121.321
->set ...etc. for defaultrole, logdetail, port, state, strictmode, timeout

5. Use the set command to load a certificate or to modify properties.

For example:

• To load an LDAP/SSL certificate:


-> set /SP/clients/ldapssl/cert load_uri=tftp://10.6.142.192/sales/cert.cert Set ’load_uri’ to ’tftp://10.6.142.192/sales/cert.cert’


• To load an Alternate Server certificate:


-> set /SP/clients/ldapssl/alternateservers/1/cert load_uri=tftp://10.6.142.192/sales/cert.cert Set ’load_uri’ to ’tftp://10.6.142.192/sales/cert.cert’


• To modify Admin Groups properties:


-> set /SP/clients/ldapssl/admingroups/1 name=CN=spSuperAdmin,OU=Groups,DC=sales,DC=oracle,DC=com Set 'name' to 'CN=spSuperAdmin,OU=Groups,DC=sales,DC=oracle,DC=com'


• To modify Operator Groups properties:


-> set /SP/clients/ldapssl/opergroups/1 name=CN=spSuperOper,OU=Groups,DC=sales,DC=oracle,DC=com Set 'name' to 'CN=spSuperOper,OU=Groups,DC=sales,DC=oracle,DC=com'


• To modify Custom Groups properties:

-> set /SP/clients/ldapssl/customgroups/1 name=CN=spSuperCust,OU=Groups,DC=sales,DC=oracle,DC=com
Set 'name' to 'CN=spSuperCust,OU=Groups,DC=sales,DC=oracle,DC=com'
-> set /SP/clients/ldapssl/customgroups/1 roles=au
Set ‘roles’ to au

• To modify User Domains properties:

-> set /SP/clients/ldapssl/userdomains/1 name=<USERNAME>@uid=<USERNAME>,OU=people,DC=oracle,DC=com
Set 'domain' to 'uid=<USERNAME>,OU=people,DC=oracle,DC=com’

• To modify Alternate Servers properties:


-> set /SP/clients/ldapssl/alternateservers/1 address=ip_address

1. Log in to the ILOM CLI.

2. To display the properties of RADIUS, type:

-> show /SP/clients/radius

For example:

-> show /SP/clients/radius
/SP/clients/radius
   Targets:
 
   Properties:
		address = 0.0.0.0
		defaultrole = Operator
		port = 1812
		secret = (none)
		state = disabled

3. Use the set command to modify properties.

For example:

-> set /SP/clients/radius ipaddress=1.2.3.4 port=1812 state=enabled defaultrole=administrator secret=changeme

For a description of the RADIUS settings, see Configure ILOM for RADIUS.

Use this procedure to log in to ILOM to verify that the non-root user account is functioning properly.

Follow these steps to log in to ILOM as a non-root account user:

1. Using a Secure Shell (SSH) session, log in to ILOM by specifying your user name and IP address of the server SP or CMM.

$ ssh root@system_ipaddress

Or

$ ssh -l username ipaddress

If ILOM is operating in a dual-stack network environment, the system_ipaddress can be entered using either an IPv4 or IPv6 address format.

For example:

For IPv4 - 10.8.183.106

or

For IPv6 - [fec0:a:8:b7:214:4fff:5eca:5f7e/64]

The ILOM Login prompt appears.

For more information about entering IP addresses in a dual-stack environment, and for diagnosing connection issues, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide.

2. Type the user name and password for the user account.

<hostname>: <assigned_username>

Password: <assigned_password>

The ILOM CLI prompt appears (->).

  At the command prompt, type:

-> exit

---

What Next?

You can now continue to customize your ILOM configuration for your system and data center environment. Before you configure ILOM for your environment, refer to the Oracle Integrated Lights Out Manager 3.0 Concepts Guide for an overview of the new ILOM 3.0 features and functionality. Knowing how the new ILOM features will affect your environment will help you configure ILOM settings so that you can access all of ILOM’s capabilities in your system and data center.

Also refer to the Oracle ILOM 3.0 Procedures Guides for descriptions of how to perform ILOM tasks using a specific user interface and to your platform ILOM Supplement or platform Administration guide for platform-specific configuration instructions.

The ILOM 3.0 Documentation Collection can be found at:

http://docs.sun.com/app/docs/prod/int.lights.mgr30#hic

Oracle Integrated Lights Out Manager (ILOM) 3.0 Getting Started Guide

820-5523-12

Copyright © 2010, Oracle and/or its affiliates. All rights reserved.