When the HTTP Webserver property is set to Redirect Connection to HTTPS, the service state property for HTTPS Webserver is automatically enabled. These default property values instruct Oracle ILOM to use HTTPS to securely transmit information to the web server.

When the HTTP Webserver property is set to enabled, Oracle ILOM uses HTTP a non-encrypted protocol to transmit information to the web server.

When the HTTP Webserver property is set to disabled, the use of the transmitting information to the web server using HTTP is disabled in Oracle ILOM.

CLI Syntax for HTTP Web Server:

set /SP|CMM/services/http securedirect=enabled|disabled servicestate=disabled|enabled

(http/ port=)

When the HTTP service state is enabled, Oracle ILOM by default, communicates with the web server using HTTP over TCP port 80. If necessary, the default port number can be changed.

CLI Syntax for HTTP Port:

set /SP|CMM/services/http port=<n>

(http/ sessiontimeout=)

The HTTP web session timeout determines how many minutes until an inactive web browser client is automatically logged out. The default HTTP web session timeout is 15 minutes. If necessary, the default session timeout value can be increased or decreased.

CLI Syntax for HTTP Session Timeout:

set /SP|CMM/services/http sessiontimeout=<n>

When the HTTPS Webserver property is set to enabled, Oracle ILOM uses HTTPS to securely transmit information to the web server.

When the HTTPS Webserver property is set to disabled, the use of transmitting information to the web server using HTTPS is disabled in Oracle ILOM.

CLI Syntax for HTTPS Web Server:

set /SP|CMM/services/https servicestate=enabled|disabled

(https/ port=)

When the HTTPS service state is enabled, Oracle ILOM, by default, communicates with the web server using HTTPS over TCP port 443. If necessary, the default port number can be changed.

HTTPS Port CLI Syntax:

set /SP|CMM/services/https port=<n>

(https/sessiontimeout=)

The HTTPS web session timeout determines how many minutes until an inactive web browser client is automatically logged out. The default HTTPS web session timeout is 15 minutes. If necessary, the default session timeout value can be increased or decreased.

CLI Syntax for HTTPS Session Timeout:

set /SP|CMM/services/https sessiontimeout=<n>

The SSLv2 property is disabled by default. If necessary, the default SSLv2 property can be enabled.

CLI Syntax for SSLv2:

set /SP|CMM/services/https sslv2=disabled|enabled

Oracle ILOM by default uses SSLv3 and TLSv1 to enable the strongest secure socket layer encryption. If necessary, the default SSLv3 property can be disabled.

CLI Syntax for SSLv3:

set /SP|CMM/services/https sslv3=enabled|disabled

Oracle ILOM by default uses SSLv3 and TLSv1 to enable the strongest secure socket layer encryption. If necessary, the default TLSv1 property can be disabled.

CLI Syntax for TLSv1:

set /SP|CMM/services/https tlsv1=enabled|disabled

The Weak Ciphers property is disabled by default. It might be necessary to enable weak ciphers to support the use of older web browsers.

CLI Syntax for Weak Ciphers:

set /SP|CMM/services/https weak_ciphers=disabled|enabled

Related Information:

• Resolving Web Browser Security Settings

(certstatus=)

The Certificate Status property is a read-only property. This property indicates which of the following types of SSL certificates is currently in use by the HTTPS web server:

• Default SSL certificate and private self-signed key provided with Oracle ILOM

  - or -

• Custom trusted SSL certificate and private key provided by a trusted Certificate Authority

Note – When the default SSL certificate is in use, users connecting to the Oracle ILOM web interface for the first time are notified of the default self-signed certificate and are prompted to accept its use. The default self-signed SSL certificate ensures that all communication between a web browser client and the Oracle ILOM SP (or CMM) is fully encrypted.

CLI Syntax to Show Certificate Status:

show /SP|CMM/https/ssl

(/custom_certificate)

Note. A valid custom certificate configuration requires the uploading of a custom certificate and a custom private key. Only then will the custom SSL certificate configuration apply and be persistent across system reboots and Backup and Restore operations.

CLI Syntax to Load Custom Certificate:

load_uri=file_transfer_method://host_address/file_path/custom_certificate_filename

For a detailed description of each file transfer method (excluding Paste), see Supported File Transfer Methods.

(/custom_certicate clear_action=true)

CLI Syntax to Remove Certificate:

set /SP|CMM/services/https/ssl/custom_certificate clear_action=true

When prompted, type y to delete or n to cancel action.

(/custom_key)

Note. A valid custom certificate configuration requires the uploading of a custom certificate and a custom private key. Only then will the custom SSL certificate configuration apply and be persistent across system reboots and Backup and Restore operations.

CLI Syntax to Load Custom Private Key:

load_uri=file_transfer_method://host_address/file_path/custom_key_filename

For a detailed description of each file transfer method (excluding Paste), see Supported File Transfer Methods.

(/custom_key clear_action=true)

CLI Syntax to Remove Certificate Private Key:

set /SP|CMM/services/https/ssl/custom_key clear_action=true

When prompted, type y to delete or n to cancel the action.

(state=)

The SNMP State property is enabled by default. When this property is enabled, and the properties for one or more user accounts or communities for SNMP are configured, the SNMP management service in Oracle ILOM is available for use.

When the SNMP State property is disabled, the SNMP port is blocked, prohibiting all SNMP communication between Oracle ILOM and the network.

CLI Syntax for SNMP State:

set /SP|CMM/services/snmp state=enabled|disabled

(port=)

Oracle ILOM, by default, uses TCP port 161 to transmit SNMP communication between an Oracle ILOM SP (or Oracle ILOM CMM) and the network. If necessary, the default port property number can be changed.

CLI Syntax for SNMP Port:

set /SP|CMM/services/snmp port=n

This ID is unique to each Oracle ILOM SNMP enabled-system. Although the Engine ID is configurable, the ID should always remain unique across the data center for each Oracle ILOM system. Only experienced SNMP users who are familiar with SNMP v3 security should modify the SNMP Engine ID property.

The Set Requests property is disabled in Oracle ILOM by default.

When the Sets Requests property is disabled, the following SNMP MIBs are available for monitoring purposes:

• SUN-HW-TRAP-MIB – Use this MIB to monitor trap notifications for hardware-related events such as faults.

• SUN-PLATFORM-MIB – Use this MIB to poll hardware-related information such as inventory and health.

When the Set Requests property is enabled, the MIBs described above are available for monitoring purposes and the following MIBs are available for management purposes:

• SUN-HW-CTRL-MIB – Use this MIB to configure hardware policies such as power management.

• SUN-ILOM-CONTROL-MIB – Use this MIB to configure Oracle ILOM features such as creating users and configuring services.

CLI Syntax for Set Requests:

set /SP|CMM/services/snmp sets=disabled|enabled

Related Information:

• Oracle ILOM 3.1 Protocol Management Reference, Server Management Using SNMP

Oracle ILOM, by default, enables the use of SNMP v3 and disables the use of SNMP v1 and v2c.

SNMPv1 and v2c do not support encryption and use community strings as a form of authentication. SNMPv3 uses encryption to provide a secure channel and uses individual user names and passwords that are stored securely on the SNMP management station.

If necessary, the default SNMP Protocol property value is configurable.

CLI Syntax to Modify Default Protocol:

set /SP|CMM/services/snmp v1|v2c|v3=enabled|disabled

SNMP communities apply only to SNMP v1 or v2c to control user access and authorization levels in Oracle ILOM. When the Protocols property for SNMP v1 or v2c is enabled, the properties for SNMP communities are configurable in Oracle ILOM.

The following rules apply when configuring communities:

• Community name – Up to 35 characters in length, must start with an alphabetic character, and must not contain any spaces

• Save (web interface only) – All changes made within the SNMP Add SNMP User dialog must be saved

CLI Syntax to Create SNMP Communities:

create /SP|CMM/services/snmp/communities name=community_name permission=rw|ro

show /SP|CMM/services/snmp/communities public|private

delete /SP|CMM/services/snmp/communities community_name

(/users)

SNMP Users apply only to SNMP v3 to control user access and authorization levels in Oracle ILOM. When the Protocol property for SNMP v3 is enabled, the properties for SNMP users are configurable in Oracle ILOM.

The following rules apply when configuring SNMP users:

• User name – Up to 35 characters in length, must start with an alphabetic character, and must not contain any spaces

• Authentication or privacy password – Up to 16 characters in length, case-sensitive, no colons, no spaces, and password must be confirmed

• Save (web interface only – All changes made within the SNMP Add SNMP User dialog must be saved.

CLI Syntax to Create SNMP Users:

create /SP|CMM/services/snmp/[new_username] authenticationprotocol=[MD5|SHA] authenticationpassword=[changeme] permission=[ro|rw] privacyprotocol=AES|DES|none privacypassword=[user_password]

show /SP|CMM/services/snmp/users

delete /SP|CMM/services/snmp/username

(/mibs dump_uri=)

(state=)

The SSH Server State property is enabled by default.

When the SSH Server State property is enabled, the SSH server uses server-side keys to permit remote clients to securely connect to the Oracle ILOM SP (or Oracle ILOM CMM) using a command-line interface.

When the SSH Server State property is disabled or restarted, all CLI SP or CLI CMM sessions running over SSH are automatically terminated.

Note. Oracle ILOM automatically generates the SSH Server side keys on the first boot of a factory default system.

Web interface: Changes to the SSH Server State in the web interface do not take affect in Oracle ILOM until you click Save.

CLI Syntax for SSH Server State:

set /SP|CMM/services/ssh state=enabled|disabled

(restart_sshd_action=)

Restarting the SSH server will automatically: (1) terminate all connected SP or CMM CLI sessions, as well as (2) activate newly pending server-side key(s).

CLI Syntax for Restart:

set /SP|CMM/services/ssh restart_sshd_action=true

(generate_new_key_type=rsa generate_new_key_action= true)

CLI Syntax for Generate RSA Key:

set /SP|CMM/services/ssh generate_new_key_type=rsa generate_new_key_action=true

CLI Syntax for Generate DSA Key:

set /SP|CMM/services/ssh generate_new_key_type=dsa generate_new_key_action=true

(state=)

The State property for IPMI v2 is enabled by default.

When the IPMI State property is enabled, Oracle ILOM permits remote IPMItool clients to securely connect to the Oracle ILOM SP (or Oracle ILOM CMM) using a command-line interface.

When the IPMI State property is disabled, all IPMItool clients connected to the SP or CMM through the Oracle ILOM CLI are automatically terminated.

Web interface: Changes to the IPMI State in the web interface do not take affect in Oracle ILOM until you click Save.

CLI Syntax for IPMI State:

set /SP|CMM/services/ipmi state=enabled|disabled

(timeout=)

The CLI Session Timeout property determines how many minutes until an inactive CLI session is automatically logged out.

By default, there is no CLI timeout configured. If the Oracle ILOM CLI is used on a shared console, network administrators are recommended to set the CLI session timeout value to 15 minutes or less.

Web interface: Changes to the CLI session timeout properties in the web interface do not take affect in Oracle ILOM until you click Save.

CLI Syntax for CLI Session Timeout:

set /SP|CMM/cli timeout=enabled|disabled minutes=value

(state=)

The WS-Man web service State property is enabled by default. If necessary, the WS-Man web service state can be disabled.

Web interface: Changes to the WS-Man state in the web interface do not take affect in Oracle ILOM until you click Save.

CLI Syntax for WS-Man State:

set /SP|CMM/services/wsman state=enabled|disabled

Related Information:

(mode=http)

The Mode property is set to HTTP by default. To improve security, this default property value can be set to HTTPS.

CLI Syntax for WS-Man Mode:

set /SP|CMM/services/wsman mode=http|https

(http_port=)

When the State property is enabled and the Mode property is set to HTTP, Oracle ILOM uses TCP port 8889 for the WS-Man web service.

If necessary, the default port property value can be changed.

CLI Syntax for WS-MAN HTTP Port:

set /SP|CMM/services/wsman http_port=n

(https_port=)

When the State property is enabled and the Mode property is set to HTTPS, Oracle ILOM uses TCP port 8888 for the WS-Man web service.

If necessary, the default port property value can be changed.

CLI Syntax for WS-Man HTTPS Port:

set /SP|CMM/services/wsman https_port=n

(connect_message=)

CLI Syntax to Set Connect Message:

set /SP/preferences/banner connect_message=<content>

(login_message=)

CLI Syntax to Set Login Message:

set /SP/preferences/banner login_message=<content>

(login_message_acceptance=)

Set the Login Banner Acceptance property to enabled to display the banner message.

CLI Syntax for Login Message Acceptance:

set /SP/preferences/banner login_message_acceptance=disabled|enabled