Security and Access

User Session

Viewing User Sessions

Procedure

Step 1

From the Navigation Pane, select Security and access > Sessions.

Step 2

You can view the following properties:

Name

Description

Session ID column

A unique identifier assigned to each active web user session for tracking and management purposes.

Username column

The account name associated with the server login session.

IP address column

The network address of the device accessing the server during the session.

Disconnecting a Session

Procedure

Step 1

From the Navigation Pane, select Security and access > Sessions.

Step 2

To disconnect a session, click Disconnect corresponding to the session row you want to disconnect.

LDAP Configuration

Enabling LDAP Authentication

In the Cisco BMC, the SSH, Redfish, Webserver, and Host Console interfaces allow authentication against an LDAP directory. However, the IPMI interface cannot authenticate against LDAP, as it requires the password in clear text during session setup. PAM-based authentication is implemented, ensuring that the authentication flow is the same for both LDAP users and local users.

For LDAP user accounts, there is no LDAP attribute type corresponding to the Cisco BMC privilege roles. The preferred method is to group LDAP user accounts into LDAP groups. Privilege roles can then be assigned to the LDAP group using Redfish and the GUI.

Procedure

Step 1

From the Navigation Pane, select Security and access > LDAP.

Step 2

Under LDAP authentication, update the following properties:

Name

Description

Enable check box

Check the Enable check box to activate LDAP authentication options.

Secure LDAP using SSL A CA certificate and an LDAP certificate are required to enable secure LDAP Enable check box

Enable Secure LDAP over SSL to encrypt LDAP communications. Ensure you have both a CA certificate and an LDAP certificate before enabling this option.

Service Type radio button

Choose the appropriate service type by selecting a radio button:

  • Select OpenLDAP radio button to use OpenLDAP as the directory service.

  • Select Active Directory radio button to use Microsoft's Active Directory service.

Server URI field

Enter the URI for the server.

Bind DN field

Enter the Base Distinguished Name.

Bind Password field

Enter the password for the Bind DN.

Base DN field

Enter the Base Distinguished Name.

User ID Attribute - (optional) field

Enter the attribute for user identification.

Group ID Attribute - (optional) field

Enter the attribute for group identification.

Manage SSL Certificate link

Click Adding a New Certificate for more information.

Step 3

Click Save settings.

Adding Role Group

Group roles determine the first-level authorization for users, establishing whether access to the required interface is permitted. For example, a user should not be able to log in to SSH if they only belong to the webserver group and not to the SSH group. Having group roles within common user management allows different applications to create roles for each other. For instance, an administrative user can create a new user through the webserver, granting them the ability to log in to webserver, Redfish, IPMI, and other interfaces.

Before you begin

Ensure that LDAP authentication is enabled.

Procedure

Step 1

From the Navigation Pane, select Security and access > LDAP.

Step 2

Click Add role group.

Step 3

Update the following:

Name

Description

Group Name field

Enter the name of the role group to identify it within the system.

Group Privilege field

Select the appropriate level of access for the group from the drop-down list:

  • Administrator

  • Operator

  • ReadOnly

User Management

Adding a User

Cisco BMC provides a Web GUI to facilitate effective management of user accounts. This includes tasks such as defining user names, setting and modifying passwords, and configuring privilege levels and channel access. These settings are linked to individual user IDs and are stored as a structured array within the non-volatile storage framework associated with the management controller.

Procedure

Step 1

From the Navigation Pane, select Security and access > User Management.

Step 2

Click Add user.

Add user window is displayed.

Step 3

In the Add user window update the following properties:

Name

Description

Account status radio button

Select Enabled radio button to activate the account immediately.

Select Disabled radio button to create the account without activation.

Username field

Enter the desired username.

Follow the UI instructions for username rules.

User password field

Enter the password for the user.

Follow the UI instructions for password rules.

Confirm user password field

Re-enter the password to confirm.

Privilege drop-down list

From the Privilege drop-down list, choose the appropriate role:

  • Administrator—Full access and control.

  • Operator—Limited operational access.

  • ReadOnly—View-only access.

Step 4

Click Add user.

Editing a User

Procedure

Step 1

From the Navigation Pane, select Security and access > User Management.

Step 2

To edit a user, click the edit icon corresponding to the user row you want to edit.

Edit user window is displayed.

Step 3

In the Edit user window update the following properties:

Name

Description

Account status radio button

Select Enabled radio button to activate the account immediately.

Select Disabled radio button to create the account without activation.

Username field

Enter the desired username.

Follow the UI instructions for username rules.

User password field

Enter the password for the user.

Follow the UI instructions for password rules.

Confirm user password field

Re-enter the password to confirm.

Privilege drop-down list

From the Privilege drop-down list, choose the appropriate role:

  • Administrator—Full access and control.

  • Operator—Limited operational access.

  • ReadOnly—View-only access.

Step 4

Click Save.

Enabling or Disabling a User

Procedure

Step 1

From the Navigation Pane, select Security and access > User Management.

Step 2

To enable/disable a user, check the check box corresponding to the user row you want to enable/disable.

When you check the check box, a new header row with additional options appears at the top of the table.

Step 3

Click Enable/Disable.

Managing Account Policy Settings

Procedure

Step 1

From the Navigation Pane, select Security and access > User Management.

Step 2

Click Account policy settings.

Account policy settings window is displayed.

Step 3

In the Account policy settings window update the following properties:

Name

Description

Max failed login attempts field

Enter a value between 0 and 65535.

User unlock method radio button

Select one of the following options:

  • Manual—Choose the Manual radio button to require manual intervention for unlocking.

  • Automatic After Timeout—Choose the Automatic After Timeout radio button to unlock automatically after a specified timeout.

Timeout duration (seconds) field

If Automatic After Timeout is selected, enter the duration from the Timeout Duration (seconds).

Step 4

Click Save.

Deleting a User

You cannot delete a root user.

Procedure

Step 1

From the Navigation Pane, select Security and access > User Management.

Step 2

To delete a user, check the check box corresponding to the user row you want to delete.

When you check the check box, a new header row with additional options appears at the top of the table.

Step 3

Click Delete.

Updating Policies

Enabling or Disabling BMC Shell through SSH

The BMC Health Monitor in Cisco BMC tracks and reports the health status of the BMC, providing real-time updates on its operational status. This feature monitors key indicators such as temperature, voltage, fan speed, and hardware health events. It assists administrators in ensuring the proper functioning of the BMC by offering necessary monitoring and alert mechanisms. By delivering comprehensive real-time health reports, it enables administrators to quickly identify and resolve issues, enhancing system maintenance and reliability.

Procedure

Step 1

From the Navigation Pane, select Security and access > Policies.

Step 2

Use the BMC Shell (via SSH) toggle button to enable or disable access to shell sessions through port 22 on the BMC.

Enabling or Disabling Network IPMI

Procedure

Step 1

From the Navigation Pane, select Security and access > Policies.

Step 2

Use the Network IPMI (Out-of-Band IPMI) toggle button to enable or disable remote management via IPMI.

Managing Certificates

Viewing Certificate Details

Certificate management allows easy replacement of existing certificate and private key files with alternatives, which may be issued by a Certification Authority (CA). This feature enables you to deploy both server and client certificates seamlessly. Through the GUI, you can update certificates using unencrypted .pem-formatted certificate and private key files, integrating the private key with the corresponding signed certificate.

Procedure

Step 1

From the Navigation Pane, select Security and access > Certificates.

Step 2

Under Certificates, you can view the following properties:

Name

Description

Certificate column

Displays the name or identifier of the certificate.

Issued by column

Shows the authority or entity that issued the certificate.

Issued to column

Indicates the recipient or entity to which the certificate was issued.

Valid from column

Start date of the certificate validity period.

Valid until column

End date of the certificate validity period.

Adding a New Certificate

Procedure

Step 1

From the Navigation Pane, select Security and access > Certificates.

Step 2

Click Add new certificate.

Add new certificate window is displayed.

Step 3

In the Add new certificate window update the following properties:

Name

Description

Certificate type drop-down list

Select one of the following:

  • LDAP Certificate—Use for LDAP-related authentication.

  • CA Certificate—Use for Certificate Authority purposes.

Add file button

Click Add file to browse and select the certificate file from the client.

Step 4

Click Add.

Replacing a Certificate

Procedure

Step 1

From the Navigation Pane, select Security and access > Certificates.

Step 2

To replace a certificate, click the replace icon corresponding to the row you want to replace.

Replace certificate window is displayed.

Step 3

In the Replace certificate window, update the following properties:.

Name

Description

Certificate type field

You cannot change the certificate type.

Add file button

Click Add file to browse and select the certificate file from the client.

Step 4

Click Replace.

Deleting a Certificate

Procedure

Step 1

From the Navigation Pane, select Security and access > Certificates.

Step 2

To delete a delete certificate, click the delete icon corresponding to the row you want to delete.

Step 3

Click Delete to confirm.

Generating a Certificate Signing Request

Procedure

Step 1

From the Navigation Pane, select Security and access > Certificates.

Step 2

Click Generate CSR.

Generate a Certificate Signing Request (CSR) window is displayed.

Step 3

In the Generate a Certificate Signing Request (CSR) window update the following properties:

Name

Description

Certificate Type drop-down list

From the drop-down menu, choose one of the following options:

  • HTTPS Certificate—Use for securing web communications.

  • LDAP Certificate—Use for LDAP-related authentication.

Country/Region drop-down list

Select the country or region from the drop-down menu.

State field

Enter the state name.

City field

Enter the city name.

Company Name field

Enter the name of the company.

Company Unit field

Enter the unit within the company.

Common Name field

Enter the common name for the certificate.

Contact Person (optional) field

Enter the name of the contact person.

Email Address (optional) field

Enter the email address.

Alternate Name (optional) field

Enter alternate names separated by spaces.

Private Key

Key Pair Algorithmdrop-down list

From the drop-down menu, choose one of the following:

  • EC—Elliptic Curve cryptography for higher security with shorter keys.

  • RSA—Rivest-Shamir-Adleman algorithm for a widely-used encryption method.

Step 4

Click Generate CSR to create the Certificate Signing Request.