Oracle ILOM Security

Oracle ILOM provides server control and monitoring functions to system administrators on Oracle x86-based servers and on some Oracle SPARC-based servers.

Use a dedicated internal network for the service processor (SP) to separate it from the general network. Depending on the authorization level granted to the administrators, these functions might include the ability to power off the server, create user accounts, mount remote storage devices, and so on. Therefore, to maintain the most reliable and secure environment for Oracle ILOM, the dedicated network management port or the sideband management port on the server must always be connected to an internal trusted network or a dedicated secure management/private network.

Limit the use of the default Administrator account (root) to the initial Oracle ILOM login. This default Administrator account is provided only to aid with the initial sever installation. To ensure the most secure environment, change the default Administrator password (changeme) during the initial setup of the system. In addition to changing the password for the default Administrator account, new user accounts with unique passwords and assigned authorization levels should be established for each new Oracle ILOM user.

The Oracle Integrated Lights Out Manager (ILOM) 3.1 Security Guide provides security information specific to Oracle ILOM.

Refer to Oracle ILOM documentation to understand more about setting up passwords, managing users, and applying security-related features, including Secure Shell (SSH), Secure Socket Layer (SSL), and RADIUS authentication. For security guidelines specific to Oracle ILOM, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.1 Security Guide, which is part of the Oracle ILOM 3.1 documentation library. You can find the Oracle ILOM 3.1 documentation at http://www.oracle.com/goto/ILOM/docs.

The Sun Server X2-8 uses Oracle ILOM 3.0, not Oracle ILOM 3.1. However, most of the information in the Oracle Integrated Lights Out Manager (ILOM) 3.1 Security Guide is relevant to Oracle ILOM 3.0, with the following exceptions:

• Web Interface Timeout: In Oracle ILOM 3.1, the administrator can set the timeout for all sessions and it can not be overridden in individual sessions. In Oracle ILOM 3.0, the timeout can be set for each session. The default is 15 minutes.

• Event Log and Audit Log: Oracle ILOM 3.1 has both an event log and an audit log. Oracle ILOM 3.0 has only an event log, however the Oracle ILOM 3.0 event log contains the same entries as the Oracle ILOM 3.1 event log and audit log.

• Ethernet-over-USB: Oracle ILOM 3.0 does not support a high-speed Ethernet-over-USB connection.