HP Integrated Lights-Out 2 User Guide

necessary security, the following configuration changes are made when two-factor authentication isenabled:• Telnet Access: Disabled• Secure Shell (SSH) Access: Disabled• Serial Command Line Interface Status: DisabledIf telnet, SSH, or Serial CLI access is required, re-enable these settings after two-factor authentication isenabled. However, because these access methods do not provide a means of two-factor authentication,only a single factor is required to access iLO 2 with telnet, SSH, or Serial CLI.When two-factor authentication is enabled, access with the CPQLOCFG utility is disabled becauseCPQLOCFG does not supply all authentication requirements. However, the HPONCFG utility is functionalbecause administrator privileges on the host system are required to execute the utility.A trusted CA certificate is required for two-factor authentication to function. You cannot change the Two-Factor Authentication Enforcement setting to Enabled if a trusted CA certificate has not been configured.Also, a client certificate must be mapped to a local user account if local user accounts are used. If iLO 2is using directory authentication, client certificate mapping to local user accounts is optional.To change two-factor authentication security settings for iLO 2:1. Log in to iLO 2 using an account that has the Configure iLO 2 Settings privilege. ClickAdministration>Security>Two-Factor Authentication.2. Change the settings as needed by entering your selections in the fields.3. After completing any parameter changes, click Apply to save the changes.The Certificate Revocation Checking setting controls whether iLO 2 uses the certificate CRL distributionpoints attribute to download the latest CRL and verify for revocation of the client certificate. If the clientcertificate is contained in the CRL or if the CRL cannot be downloaded for any reason, access is denied.The CRL distribution point must be available and accessible to iLO 2 when Certificate RevocationChecking is set to Yes.The Certificate Owner Field setting specifies which attribute of the client certificate to use whenauthenticating with the directory. If SAN is specified, iLO 2 extracts the User Principle Name from theSubject Alternative Name attribute and then uses the User Principle Name when authenticating with thedirectory (for example, username@domain.extension). If Subject is specified, iLO 2 derives the user'sdistinguished name from the subject name attribute. For example, if the subject name is/DC=com/DC=domain/OU=organization/CN=user, iLO 2 will deriveCN=user,OU=organization,DC=domain,DC=com.The Certificate Owner Field setting is only used if directory authentication is enabled. Configuration of theCertificate Owner Field depends on the version of directory support used, the directory configuration, andthe certificate issuing policy of your organization.Setting up two-factor authentication for the first timeWhen setting up two-factor authentication for the first time, you can use either local user accounts ordirectory user accounts. For more information on two-factor authentication settings, see the "Two-FactorAuthentication (on page 38)" section.Setting up local user accounts1. Obtain the public certificate from the CA that issues user certificates or smart cards in yourorganization.2. Export the certificate in Base64-encoded format to a file on your desktop (for example, CAcert.txt).3. Obtain the public certificate of the user who needs access to iLO 2.4. Export the certificate in Base64-encoded format to a file on your desktop (for example, Usercert.txt).5. Open the file CAcert.txt in Notepad, select all of the text, and copy it by pressing the Ctrl+C keys.Configuring iLO 2 39