This short document explain how to resolve the issues arising when trying to update an old (Gen7) HP(E) server to the most recent iLO 3 (HPE Integrated Lights-Out) version, which solves a great number of security and usability issues.
- Can't connect to iLO with a modern browser, for lack of supported TLS protocol version
- solved by using FirefoxPortable version 31
- and in the Firefox31 portable configuration, in the about:config settings, set
security.tls.version.min(the minimum acceptable version of the TLS protocol) to 0 in order to be able to negociate down to TLS 1.0 (even if iLO 3 can do 1.1). Keep in mind your browser is now (even more) vulnerable to a host of attacks, do not connect to any potentially hostile host with it. - alternatively sabotage your regular Firefox security settings (this leaves you very vulnerable on the Internet) : in about:config set
security.tls.version.enable-deprecatedtotrueandsecurity.tls.version.minto0(thanks @edgimar) - in the iLO web console, checking the option "Enforce AES/3DES Encryption" in Administration / Security / Encryption helps by enabling the best iLO 3 got to offer
- Can't connect with a modern OpenSSH in default configuration, because only a ssh-dss key is offered ("Unable to negotiate with w.x.y.z port 22: no matching host key type found. Their offer: ssh-dss")
- enable ssh-dss on the command line, like so:
ssh -oHostKeyAlgorithms=+ssh-dss user@ilo3host - alternatively solved by using PuTTY 0.76 that still supported such keys. More recent versions might also still offer support for this key type by default
- enable ssh-dss on the command line, like so:
- Can't update from 1.55 to the most recent versions, with an unclear error message
- solved by updating to the intermediary iLO 3 version 1.57 first
- then from iLO 3 version 1.57 to iLO 3 version 1.94
- As per HPE, if one was running an even earlier version (before 1.20) they'd have to upgrade to iLO 3 version 1.20 first
Even after upgrading, your should be getting the error ERR_SSL_VERSION_OR_CIPHER_MISMATCH when trying to connect with a modern browser, since the best TLS version iLO 3 can offer is TLS v1.1 that is deprecated and disabled in all modern browsers.
This is not solvable without putting your whole browser security in jeopardy. Some browsers can degrade that security setting but sadly this a a global and not per site setting, and thus pretty dangerous. Digicert has a handy documentation about doing so with various browsers.
I recommand you keep using an older browser dedicated to this usage.
Thanks for this compilation! Regarding the issues post upgrade (ERR_SSL_VERSION_OR_CIPHER_MISMATCH) there is a simple way to handle it without putting your whole browser security in jeopardy, indeed. Firefox Nightly allows to circumvent the security warning by clicking "accept the risk" or so. Assuming one can reserve it for this specific type of browsing, the standard browser is not affected.