Security Checklist for Server Deployment

Language:

To determine which Oracle ILOM security practices might be best when planning the deployment of a new server, system administrators should consult the list of security tasks recommended in the following Figure 1, Table 1, Checklist - Configuring Oracle ILOM Security at Server Deployment .

Table 1 Checklist - Configuring Oracle ILOM Security at Server Deployment

Security Task	Applicable Firmware Version(s)	For details, see:
Establish a secure dedicated management connection to Oracle ILOM.	All firmware versions	Securing the Physical Management Connection
Decide whether FIPS 140-2 security compliance is required at or after deployment; or, not at all.	Firmware versions 3.2.4 and later	Choosing Whether to Configure FIPS Mode At Deployment Unupported Features When FIPS Mode Is Enabled
Set Password Policy for All Local User Accounts	Firmware version 3.2.5 and later	Set Password Policy Restrictions for All Local Users (3.2.5 and later)
Modify the default password provided for the preconfigured Administrator `root`account.	All firmware versions	Avoid the Creation of Shared User Accounts Modify Default Password for root Account at First Login
Decide whether the preconfigured Oracle ILOM services and their open network ports are applicable for your target environment.	All firmware versions	Securing Services and Open Network Ports
Configure user access to Oracle ILOM.	All firmware versions	Securing Oracle ILOM User Access Create Local User Accounts With Role-Based Privileges
Decide whether access to the host operating system should be locked upon exiting a remote KVMS session.	Firmware versions 3.0.4 and later	Lock Host Access Upon Exiting a KVMS Session
Decide whether to limit other SP users from viewing remote KVMS sessions launched from the SP.	Firmware versions 3.2.4 and later	Limit Viewable KVMS Sessions for Remote System Console Plus (3.2.4 or later)
Decide whether to display a security banner message at user login or immediately following user login.	Firmware versions 3.0.8 and later	Secure System Access With Login Banner (3.0.8 and later)
Ensure that the proper security properties are set for all Oracle ILOM user interfaces.	All firmware versions	Configuring Oracle ILOM Interfaces for Increased Security
For ASR Client configurations, choose to keep the preinstalled SSL Certificate or upload a user-specified SSL Certificate.	Firmware versions 4.0.x and later.	Securing the Automatic Service Request (ASR) Endpoint Connection
Ensure that the `servicetag`protocol is properly configured to use HTTPS and a passphrase.	Firmware versions 4.0.x and later.	Figure 6, Table 6, Impact of Services When Enabled or Disabled