Jephe Wu - http://linuxtechres.blogspot.com
Objective: get the HP Proliant server IP address online or offline
Environment: Windows and/or Linux
Steps:
1. hponcfg
search google 'HP Lights-Out Online Configuration Utility for Windows' or 'HP Lights-Out Online Configuration Utility for Linux' to access the following site:
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareIndex.jsp?lang=en&cc=us&prodNameId=1135772&prodTypeId=18964&prodSeriesId=1146658&swLang=8&taskId=135&swEnvOID=1005
C:\Program Files\HP\hponcfg>hponcfg /w iLo.xml
This will export the current settings from ILO, you can modify it then import it:
C:\Program Files\HP\hponcfg>hponcfg /f ilo.xml
2. web interface
Install HP PSP on Windows/Linux, access it through http://localhost:2301 or https://localhost:2381, management processor part to find out the IP address and link status.
3. Reboot the server and press the F8 key when the server is booting and displays the HP integrated Lights Out text.
4. References:
a. http://www.itaspirin.com/node/10 - Reconfigure iLo network settings using HPONCFG
b. HP Lights-Out Online Configuration Utility for Linux
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=15351&prodSeriesId=1121486&swItem=MTX-da4fdbec8db549b8a98de5d9c3&mode=4&idx=1
c. HP Lights-Out Online Configuration Utility for Windows Server 2003/2008
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=18964&prodSeriesId=1146658&prodNameId=1135772&swEnvOID=1114&swLang=8&mode=2&taskId=135&swItem=MTX-ea306043175c40bcb35952a862
How to get HP ILO ip address?
How to expand array under Linux for HP Proliant server
Jephe Wu - http://linuxtechres.blogspot.com
Environment: HP Proliant DL360G6, CentOS 5.4 64bit, 6x300G hard disk with RAID5 (one for spare), hot added 2 more 300G hard disk, default disk partition layout by OS installation.
Objective: expand the existing RAID5 array with 2 more new added hard disk online
Steps:
1. Install HP Proliant support pack for RHEL 5
2. start up HP array configuration utility online for Linux
cd /opt/compaq/cpqacuxe/bld
./cpqacuxe -R
note: after finishing online configuration utility, you should stop it by running
./cpqacuxe -stop
3. expand array and logical drive
access https://log.domain.com:2381 then click on array configuration utility link
click on expand array, this will take long time to finish, after that, another button which is 'expand logical drive' will appear, come back to click on that also after finishing expanding array
4. make Linux kernel to recognize the new size of hardware raid5
reboot Linux server until the 'fdisk -l /dev/cciss/c0d0' shows the new size.
You can try 'partprobe' or 'sfdisk -R /dev/cciss/c0d0' first.
5. enlarge partition with fdisk
fdisk /dev/cciss/c0d0 (you might conside to use fdisk -u /dev/cciss/c0d0 to use sector instead of cyclinder)
p
press d then 2 to remove partition
press n then primary partition to use the full space
Make sure the old and new partition start at the same cylinder or sector position, otherwise, data will be destroyed.
press t to change partition type to LVM
w
q
note: you need to reboot again
6. resize physical volume size, logical volume size and file system online increase
after reboot, check again the new size
[root@log ~]# fdisk -l /dev/cciss/c0d0
Disk /dev/cciss/c0d0: 1799.7 GB, 1799797127168 bytes
255 heads, 63 sectors/track, 218812 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/cciss/c0d0p1 * 1 13 104391 83 Linux
/dev/cciss/c0d0p2 14 218813 1757509959+ 8e Linux LVM
[root@log ~]# pvresize /dev/cciss/c0d0p2
Physical volume "/dev/cciss/c0d0p2" changed
1 physical volume(s) resized / 0 physical volume(s) not resized
note: use vgdisplay -v to check the number of free PE, let's say it's 17879.
[root@log ~]# lvextend -l +17879 /dev/VolGroup00/LogVol02
Extending logical volume LogVol02 to 1.60 TB
Logical volume LogVol02 successfully resized
[root@log ~]# resize2fs /dev/VolGroup00/LogVol02
resize2fs 1.39 (29-May-2006)
Filesystem at /dev/VolGroup00/LogVol02 is mounted on /data; on-line resizing required
Performing an on-line resize of /dev/VolGroup00/LogVol02 to 430276608 (4k) blocks.
The filesystem on /dev/VolGroup00/LogVol02 is now 430276608 blocks long.
Configure virtual media through vsp and boot up for HP Proliant server
Objective: configure virtual media through vsp and boot up for HP Proliant server
Environment: server1: 10.0.0.1 server2: 10.0.0.2 server2_ILO: 192.168.0.2, ILO2 ssh to server2_ILO, RIPLinux 9.3 non-X.iso
Steps:
1. ssh into the HP ILO2 ip address 192.168.0.2 and use vm command to configure virtual media as follow:
hpiLO-> vm cdrom insert http://10.0.0.1/riplinux93.iso
hpiLO-> vm cdrom set boot_once
hpiLO-> vm cdrom get
hpiLO->vsp
login as root, then issue 'reboot' command
Note:
1) you must make sure the server ILO2 ip address 192.168.0.2 is able to wget the iso file from 10.0.0.1. Not the server2 ip address 10.0.0.2
Installing hardware monitoring system for HP Proliant servers
Jephe Wu - http://linuxtechres.blogspot.com
Environment: HP Proliant server with CentOS 5.3 x86_64 OS
Objective: Enable hardware monitoring for the server
Steps summary only for sending out SNMP trap
1. configure sendmail to be able to send out email through mailrelay host
2. configure ILO as below:
| SNMP/Insight Manager Settings |  |
| Configure and Test SNMP Alerts |
| SNMP Alert Destination(s): | |
| iLO 2 SNMP Alerts: | Enabled Disabled |
| Forward Insight Manager Agent SNMP Alerts: | Enabled Disabled |
| SNMP Pass-thru: | Enabled Disabled |
give snmp trap server for alert destination. and enable all of above options. Then you don't have to configure snmp trap setting in /etc/snmp/snmp.conf
Part I:
Steps: after using NFS method to install OS through ILO virtual media, then vi /etc/hosts to put the server real IP address as hostname as follows:
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
10.0.0.1 logserver.domain.com logserver
1. download the Proliant Support Package file from HP website for your server model such as Proliant DL360G6 x86_64
2. untar the file
3. change /etc/redhat-release file content from 'CentOS release 5.3 (Final)' to 'Red Hat Enterprise Linux Server release 5.3'
4. run ./install.sh to install it
5. point your browser to http://serverip:2301/, use your root user password to login
6. vi /opt/hp/hp-snmp-agents/cma.conf trapemail line
trapemail /bin/mail -s 'logserver HP Insight Management Agents Trap Alarm' root
note: this is for sending out email notification for any snmp trap, but if I reboot server, it won't send out any email according to my test. Also, please remember to configure /etc/aliases to enable root user email aliases
7. add the following to /etc/snmp/snmpd.conf to enable insight management agents to talk to snmp trap server. If configured this, the point 6 is basically not needed actually.
trapcommunity public
trapsink snmptrapserveripaddressorhostname
Part II: setup another server as SNMP trap server
1. setup snmp trap server, make /etc/snmp/snmptrapd.conf as follows:
[root@jephe snmp]# more snmptrapd.conf
traphandle default /usr/bin/perl /usr/bin/traptoemail -s localhost -f hpsnmptrap@domain.com jephe.wu@domain1.com
traphandle default /usr/bin/perl /usr/bin/traptoemail -s localhost -f hpsnmptrap@domain.com anotheruser@domain1.com
2. start up snmptrapd services and make it automatic for next restart, that's it.
note: You can configure to send out email as well from snmp trap server after generating snmp trap, just use above Part I step 6 to configure it.
note:
1. to start the HP Array Configuration Utility, go to /opt/compaq/cpqacuxe/bld/, run cpqacuxe , then you can see the utility option in system management homepape at https://serverip:2381/ , but you can only use the https://127.0.0.1:2381 to use the utility for security reason. So you might need to ssh into the server with -X option, then run firefox to open browser locally.
2. for configuring 'Accept SNMP packets from these hosts', the host list should be separated with semi-column ;
FAQ
1. when using PSP 8.0.0, the cma.log filling up, you will see a lot of messages like this:
netsnmp_assert 1 == _access_interface_init failed if-mib/data_access/interface.c:151 netsnmp_access_interface_container_load()
netsnmp_assert 1 == _access_interface_init failed if-mib/data_access/interface.c:199 netsnmp_access_interface_index_find()
netsnmp_assert 1 == _access_interface_init failed if-mib/data_access/interface.c:199 netsnmp_access_interface_index_find()
netsnmp_assert 1 == _access_interface_init failed if-mib/data_access/interface.c:279 netsnmp_access_interface_entry_create()
Solution=>
1)/opt/compaq/nic/etc/cmanicd stop
2)Add 'cmanicd' to the exclude line in the /opt/compaq/cma.conf so that it won't run after next reboot/shutdown.
How to login from serial port under Linux
Jephe Wu - http://linuxtechres.blogspot.com
Environment: HP Proliant server A with one com port which is com1, CentOS 5
Objective: enable login through com1 using null modem cable from another machine B which can be Windows or Linux. Also, we will try to login from ILO vsp to display kernel bootup message, BIOS and GRUB
Steps:
Part I - physically connect to com1 interface at the back side of the HP Proliant server and login to Linux server
1. connect null modem cable between A and B at com1 port (ttyS0), if it's com2, it's ttyS1
2. on Linux server A, vi /etc/inittab and append the followin line:
s0:2345:respawn:/sbin/agetty 115200 ttyS0 vt100
3. If machine B is Linux, use minicom to configure the serial port speed as 115200, then connect.
If your laptop doesn't have serial port, you can use 'usb to RS232 converter' cable (one side is usb interface, anther end of the cable is the male DB9 interface.
use 'lsusb' and dmesg to confirm Linux is using /dev/ttyUSB0 after inserting cable to Linux pc.
Configure minicom to use /dev/ttyUSB0 as com port and connect. If udev is running (such as ubuntu), then you don't have to create /dev/ttyUSB0, it will be automatic.
[root@jephe dev]# ./MAKEDEV ttyUSB0
[oracle@jephe dev]$ ls -l ttyUSB0
crw-rw---- 1 root uucp 188, 0 Nov 6 05:08 ttyUSB0
[root@jephe dev]# ./MAKEDEV ttyUSB1
[root@jephe dev]# ls -l ttyUSB1
crw-rw---- 1 root uucp 188, 1 Nov 6 05:08 ttyUSB1
4. If machine B is Windows, use putty to directly connect to serial port, set speed as 115200, then login
5. you can also use kermit to connect to serial port as follows:
kermit
set line /dev/ttyS0
set carrier-watch off
connect
FAQ:
a. how to change speed? - best practise.
vi /etc/inittab , for example, change 115200 to 9600, then comment out the line first, run 'init q' to re-read file, after that, uncomment it, issue 'init q' again.
b. how to enable root login through serail ports?
Just add both ttyS0 and ttyS1 or both into /etc/securetty.
s1:2345:respawn:/sbin/agetty 115200 ttyS1 vt100
then run 'init q' to enable it, after that, you can use vsp command to connect to this serial port login.
use ssh connect to ILO ip address:(if there's firewall in between, enable port 22)
for ILO version 1, just run 'REMCONS'.
for ILO2 , type 'vsp' to connect to ttyS0 or ttyS1 to get console screen.
According to http://blog.nachotech.com/?p=92 ,
A new feature crept in unannounced in the recent iLO 2 v1.77 firmware update from HP: You can now kill / terminate Virtual Serial Port (VSP) sessions that are open or hung. This is a very useful when you need to connect to the VSP but you (or someone else) is already connected from another location.
The new command to terminate VSP sessions is:
stop /system1/oemhp_vsp1Before now, the only way to clear a hung VSP session was to reboot the iLO (a very intrusive action that takes 30-60 seconds), so this is a major improvement in usability of Virtual Serial Port sessions.vsp
or
start /system1/oemhp_vsp1
FAQ:
a. if you used ttyS0 and init q already, after that, you realize you should use ttyS1 for HP VSP serial port 2 which is 0x2F8.
You have to comment that line first, then int q, after that, change ttyS0 to ttyS1, otherwise, the ttyS0 is still listening , use ps ax to find out, please.
1. Enabling kernel console output so that you can view Linux server booting up messages on virtual console ttyS1 through vsp, then you should do this: (comment out splashimage and add two console options at kernel line for /etc/grub.conf)
default=0
timeout=5
#splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.18-164.el5)
root (hd0,0)
kernel /vmlinuz-2.6.18-164.el5 ro root=/dev/VolGroup01/LogVol00 rhgb quiet console=tty0 console=ttyS1,115200
initrd /initrd-2.6.18-164.el5.img
Note:This will send the console output to the serial port ttyS1 at a baud rate of 115200 as well as send the output to the regular console or "screen" tty0.
Remember: you have to put console=tty0 first then console=ttyS1 so that HP VSP can display those OK messages. Otherwise, those [OK] messages won't display on VSP.
2. Configure and use GRUB over Serial Console (redhat knowledge base)
The system's BIOS, bootloader (GRUB), Xen, Linux, and login access must each be individually configured for serial console access. It is not strictly necessary to have each component fully functional, but it can be quite useful.
Enabling GRUB serial console output neither enables nor disables Xen or Linux serial capabilities, but may make remote management of the system more convenient by displaying GRUB prompts, menus, and actions over serial port and allowing remote GRUB management.
serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1 terminal --timeout=10 serial consoleFAQ.
a. How to capture Linux installation screen
You can add the following to linux prompt when you boot from Redhat/CentOS installation CD:
linux kernel console=ttyS0, 115200 console=tty0then you minicom or putty from another machine to connect to serial port at the same baud rate, you should be able to see and capture the screens.
Part IV: BIOS over serial redirection (vsp, hyper terminal or minicom)
under 'system option', set embedded serial port as com1 and virtual serial port as com2
under 'BIOS serial console & EMS', set BIOS serial console port as Auto(auto choose vsp or physical com1), and BIOS serial console band rate as 115200
You can user a null modem calbe to physically connect a PC/server to this HP Proliant server, and use Windows hyper terminal or minicom from Windows or Linux to connect to com1 to get BIOS over serial redirection or use gtkterm, cutecom etc GUI terminal program
or
use HP Virtual Serial Port (VSP) after ssh into ILO2 from Xshell or putty, then type in 'vsp'.
It will display the following message at the end of the bootup screen:
For access via BIOS Serial Consoleller
Press "ESC+1" to continue
Press "ESC+9" for ROM-Based Setup Utility
Press "ESC+0" for System Maintenance Menu
Press "ESC+@" for Network Boot
for ESC+9, you can use 'show config script' or 'show config options' under rbsu> (Rom-Based Setup Utility) prompt.
Refer to part IV
2. /etc/grub.conf (for showing kernel message and GRUB on serial console)
default=0
timeout=8
#splashimage=(hd0,0)/grub/splash.xpm.gz
serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1 terminal --timeout=10 serial console
title Linux Boot (2.4 custom)
root (hd0,0)
kernel /vmlinuz-2.4.cust ro root=LABEL=/ rhgb quiet console=tty0 console=ttyS0,115200 initrd /initrd-2.4.cust.img
note:
a. --unit=0 or --unit=1 (0 is for ttyS0 and 1 is for ttyS1 )
b. remove out 'rhgb quiet' will display all kernel hardware detecting messages.
3. serial console login (/etc/inittab)s0:2345:respawn:/sbin/agetty 115200 ttyS0 vt100
s1:2345:respawn:/sbin/agetty 115200 ttyS1 vt100
4. enable direct serial port login
add ttyS0 and ttyS1 to /etc/securetty
Part VI: Windows EMS and VSPThe following is from http://www.netexpertise.eu/en/windows/hp-ilo-console.html
Emergency Management Services (EMS), you can get a command line prompt and run some basic basic such as configuring IP address and reboot Windows server. You can modify boot.ini file as follows
right click on 'my computer', advanced, startup and recovery, click on settings, 'edit' to add the following to boot loader part:redirect=COM2
redirectbaudrate=115200
and append /redirect to the partition part
The example configuration is something like this:
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
redirect=COM2
redirectbaudrate=115200
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows xxxxxx Edition" \ /noexecute=optout /fastdetect /redirect
then you can use ssh into ILO, then vsp to get EMS > prompt
note: Please check Windows operating system version for correct syntax for enabling EMS. referring to
http://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/EMS.doc
it might be EMSPort and EMSBandRate instead of redirect and redirectbandrate
For example, server A and B, when you try to login server B serial console from A, you need to comment out the line in /etc/inittab on server A, then run 'init q', then use minicom to connect to server B serial console. The same way for server A.
When you enable serial console login for Linux server, after init q, you should be seeing the following from ps command before you try to connect to it using minicom.
5617 ttyS0 Ss+ 0:00 /sbin/agetty 115200 ttyS1 vt100
If you are seeing something like this:
5617 ttyS0 Ss+ 0:00 /bin/login --
You should kill 5617 process first, make sure it's showing 5617 ttyS0 Ss+ 0:00 /sbin/agetty 115200 ttyS1 vt100, which means it's waiting for minicom connection, otherwise, it will not see login prompt from minicom
This way, you can use minicom to login server A and server B each other, as long as the client (login from) is not using ttySx in /etc/inittab, and the server(the one minicom tries to login) is using ttySx in /etc/inittab and it's waiting for connection (ps | grep tty - shows it's waiting )
1. HP Proliant server VSP documentation (bios serial console redirection, etc
http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00263709/c00263709.pdf
2. Redhat knowledgebase - How do I set up a serial terminal and/or console in Red Hat Enterprise Linux?
http://kbase.redhat.com/faq/docs/DOC-7213
3. HP support website document - HP Integrated Lights-Out 2 (iLO 2) - Unable to Use Virtual Serial Port (VSP) http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&taskId=110&prodSeriesId=1146658&prodTypeId=18964&objectID=c01702793
4. HP BIOS Serial Console user guide - http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00440332/c00440332.pdf
note: Check above guide for vt100 special keys (such as using ESC + 8 for F8 )
5. HP ROM-Based Setup Utility User Guide (RBSU) - http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00191707/c00191707.pdf
6. Setup a serial console - http://www.howtoforge.com/setting_up_a_serial_console
7. http://www.linux.org/docs/ldp/howto/Remote-Serial-Console-HOWTO/index.html
8. iLo2 / VSP on RHEL5 missing console messages- http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1284427257960+28353475&threadId=1436569
note: put console=tty0 first then console=ttyS1, 115200 to display OK messages in VSP
9. How do I setup serial terminal and serial console for my xen kernel? (Reaht knowledge base DOC-9979)
kernel /boot/xen.gz-2.6.18-6.el5fvfix com1=9600,8n1
module /boot/vmlinuz-2.6.18-6.el5fvfixxen ro root=LABEL=RHEL5_x86_64 console=tty0 console=ttyS0,9600n8
module /boot/initrd-2.6.18-6.el5fvfixxen.img
For example, here is the /etc/grub.conf:
#boot=/dev/sda default=0 timeout=15 #splashimage=(hd0,0)/grub/splash.xpm.gz hiddenmenu serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1 terminal --timeout=10 serial console title Red Hat Enterprise Linux Server (2.6.17-1.2519.4.21.el5xen) root (hd0,0) kernel /xen.gz-2.6.17-1.2519.4.21.el5 com1=115200,8n1 module /vmlinuz-2.6.17-1.2519.4.21.el5xen ro root=/dev/VolGroup00/LogVol00console=tty0 console=ttyS0,115200n8module /initrd-2.6.17-1.2519.4.21.el5xen.img
10. Useful commands:
a. setserial -a /dev/ttyS0
b. setserial /dev/ttyS0 uart 16550A port 0x0408 irq 4
how to setup hardware montoring for HP Proliant server under RHEL 5
note: this article is obsolete, please refer to http://linuxtechres.blogspot.com/2009/09/installing-hardware-monitoring-system.html
Objective: After installing RHEl 5 on HP Proliant server, whenever there's hardware failure, especially hard disk failure and server operating system restart, we will be notified by email.
Steps:
- install RHEL 5.1 remotely and disklessly, pls refer to another article - http://linuxtechres.blogspot.com/2009/01/how-to-use-hp-ilo-to-do-nfs-diskless.html
- download HP Proliant system management RPM packages HPSMH(system management homepage) and HPASM(HP system health application and insight management agents) from HP website
- rpm -ivh hpasm* and hpsmh*
- hpasm activate
- setup snmp trap server, make /etc/snmp/snmptrapd.conf as follows:
traphandle default /usr/bin/perl /usr/bin/traptoemail -s localhost -f hpsnmptrap@domain.com jephe.wu@domain1.com
traphandle default /usr/bin/perl /usr/bin/traptoemail -s localhost -f hpsnmptrap@domain.com jephe.wu@domain2.com
- start up snmptrapd services and make it automatic for next restart
You can configure to send out email as well after generating snmp trap:
- go to /opt/compaq to edit cma.conf trapemail line
- that's it.
How to use HP ILO to do NFS diskless installation of RHEL 5.1 remotely
Objective: install RHEL 5.1 OS for one of HP server in datacenter remotely from office with DVD ISO file and NFS method, it won't require you to have any disk from office.
Steps:
- download RHEL 5.1 DVD ISO file, put it on the one of datacenter NFS server, can be different network segment from the destination server. (In this case, during installation, you might need to set default gateway properly so that the destination sever can talk to this NFS server)
- configuring NFS server export, in /etc/exports, put this:
- put rhel-5.1-server-i386-dvd.iso to /sourcefile/rh51 folder
- mount this iso somewhere to copy out boot.iso to your local Windows PC in office which will be used for HP ILO virtual CDROM media image for booting up RHEL installation
- startup NFS server - service portmap start; service nfs start
- use IE to access HP ILO address
- go to virtual media to mount this boot.iso image
- use virtual power to reset the server
- press enter to boot up OS installation virtual boot.iso disk
- untick high performance mouse, and close the virutal media window to make USB mouse to work
- continue to install until finish
- that's it, done.
HP ILO2 Authentication through OpenLDAP on HP DL385G2
Jephe Wu http://linuxtechres.blogspot.com
Many companies are using HP servers because of the easier management of ILO(Integrated Lights-Out). After you deployed a large number of HP servers, you'll find one problem which is to manage all the ILO administrator password. Since the ILO provides the directory setting which you can use the centralized LDAP database for authentication, but HP doesn't documented how to configure it through OpenLDAP.
This articles guides you to configure a openldap server specially for doing HP ILO2 authentication. I'm using RedHat Enterprise Linux 4 update 5 and OpenLDAP. It's only being tested on HP DL385G2 server although it might be working for other models too.
The following is the some important concept for enabling ilo2 authentication through openldap.
On OpenLDAP:
- Adding ‘memberOf’ attribute and ‘user’ objectclass into openldap (details later)
- Allow version 2 binding in /etc/openldap/slapd.conf which is ‘allow bind_v2’
- Slapd must also listen on port 636(ldaps)
- Using schema-free configuration in ILO
- Specify port 636 and OpenLDAP servername or IP address
- Configuring user context and group DN
Special schema for ilo auth in /etc/openldap/slapd.conf
[root@repo openldap]# grep -e ilo.schema -e bind_v2 /etc/openldap/slapd.confinclude /etc/openldap/schema/ilo.schema
allow bind_v2
[root@repo openldap]# grep TLS /etc/openldap/slapd.conf
TLSCACertificateFile /usr/share/ssl/certs/ca-bundle.crt
TLSCertificateFile /usr/share/ssl/certs/slapd.pem
TLSCertificateKeyFile /usr/share/ssl/certs/slapd.pem
Note: must enable TLS for listening on port 636 for ilo ldaps connection
[root@repo openldap]# more /etc/openldap/schema/ilo.schema
attributetype ( 1.3.6.1.4.1.15959.9.1.1
NAME 'memberOf'
DESC 'Group which user belongs to'
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
objectclass ( 1.3.6.1.4.1.15959.9.2.1
NAME 'memberOf'
SUP top AUXILIARY
DESC 'Required by Integrated Lights-Out for OpenLDAP '
MUST ( memberOf )
)
objectclass ( 1.3.6.1.4.1.15959.9.2.2
NAME 'user'
SUP top AUXILIARY
DESC 'Required by Integrated Lights-Out for OpenLDAP '
)
Import ldif
Note: replace ou=linuxtechres and dc=blogspot,dc=com with your organization ones.[root@repo ldif]# more base.ldif
dn: dc=blogspot,dc=com
dc: blogspot
description: Root LDAP entry
objectClass: dcObject
objectClass: organizationalUnit
ou: rootobject
dn: ou=linuxtechres,dc=blogspot,dc=com
objectclass: top
objectclass: organizationalunit
ou: linuxtechres
dn: ou=groups,ou=linuxtechres,dc=blogspot,dc=com
objectclass: top
objectclass: organizationalunit
ou: groups
dn: ou=users,ou=linuxtechres,dc=blogspot,dc=com
objectclass: top
objectclass: organizationalunit
ou: users
[root@repo ldif]# more user.ldif
dn: cn=jephe.wu,ou=users,ou=linuxtechres,dc=blogspot,dc=com
cn: jephe.wu
uid: jephe.wu
sn: Wu
uidnumber: 1000
homedirectory: /home/jephe.wu
objectClass: top
objectClass: posixAccount
objectClass: shadowAccount
objectclass: inetorgperson
objectClass: memberOf
objectClass: user
shadowLastChange: 13650
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
gidNumber: 100
displayname: Jephe Wu
userPassword: {SSHA}7znBGbK5/GMGWVryUuunxgQ87N8L38/b
memberOf: cn=iloadmin,ou=groups,ou=linuxtechres,dc=blogspot,dc=com
[root@repo ldif]# more groups.ldif
dn: cn=iloadmin,ou=groups,ou=linuxtechres,dc=blogspot,dc=com
cn: iloadmin
objectClass: top
objectClass: groupofnames
member: cn=jephe.wu,ou=linuxtechres,dc=blogspot,dc=com
ILO Configuration
Enable the following options on ILO2 (Administration-Security- Directory Settings)Use Directory Default Schema
Local User Accounts Enabled
Directory Server Address: FQDN of openldap server or ip address
Directory Server LDAP Port 636
Directory User Context 1 ou=users,ou=linuxtechres,dc=blogspot,dc=com
Then go to ‘Administrator Groups’:
Security Group Distinguished Name cn=iloadmin,ou=groups,ou=linuxtechres,dc=blogspot,dc=com
Administer Group Accounts Allowed
Remote Console Access Allowed
Virtual Power and Reset Allowed
Virtual Media Allowed
Configure iLO 2 Settings Allowed
That's it. Now you can login ILO2 as jephe.wu with your openldap entry password for every HP servers in your data center which are configured with openldap authentication.
Posts
