The Lights Out Management feature allows you to remotely manage the power state and serial console to Safeguard for Privileged Passwords using the baseboard management controller (BMC). When a LAN interface is configured, this allows the Appliance Administrator to power on an appliance remotely or to interact with the Recovery Kiosk.

The Appliance Administrator can enable and configure the Lights Out Management feature. When Lights Out Management is enabled, the Appliance Administrator can set or change the password and modify the network information for the baseboard management console (BMC). When disabled, SPP immediately resets the password to a random value and resets the network settings to default values.

Lights Out Management is only available using hardware (not a virtual machine):

LAN interface required

This feature requires a LAN interface to be enabled and configured. One Identity Safeguard for Privileged Passwords's BMC supports the following LAN interfaces to provide this functionality:

  • SSH
  • IPMI v2
  • Web
  • Serial over Lan

It is strongly recommended that the LAN interface only be enabled in trusted environments.

To enable Lights Out Management

A static IP address will need to be assigned and a network cable will need to be connected to the IPMI ethernet port on the back of the appliance. This is in addition to the standard X0 network interface.

  2. Navigate to Lights Out Management (BMC).
  3. Click the Enable Lights Out Management toggle to enable or disable this feature. Set toggle on or toggle off.
  4. Once enabled, enter the following information about the BMC:
    1. IP address: The IPv4 address of the host machine.
    2. Netmask: The network mask IPv4 address.
    3. Default Gateway: The default gateway IPv4 address.

  5. Use Set BMC Admin Password to set the password for the host machine.

    Maximum password length: 20 characters.

    NOTE: If this feature was previously enabled, you will see an Update BMC Admin Password button instead. Optionally, click the Update BMC Admin Password button to reset the password for the host machine.

  6. Click OK to save the settings on the host machine.

Accessing the BMC

Once Lights Out Management is enabled in SPP, you can access the BMC via:

  • SSH to connect to the IPMI port to remotely manage the power state and serial console to SPP
  • Web browser

SSH connection

The SPP Kiosk Console can be accessed via Putty, Linux command line, or your preferred SSH Client.

  1. Connect to the IP assigned to the IPMI interface and login with the Admin user. (Default credentials are ADMIN/admin)
  2. At the prompt run: start /system1/sol1. There may be a delay. Please wait for the connection. A message like the following gives you the instructions to proceed:
    ->start /system1/sol1
    press <Enter>, <Esc>, and then <T> to terminate session
    (press the keys in sequence, one after the other)

  3. On the menu shown below, navigate using the arrow keys. Press the right arrow to select a menu option, press the left arrow to return to the menu list, press up or down to select a different menu option.

    Appliance Information >

    Power Options >

    Backups >

    Admin Password Reset >

    Factory Reset >

    Support Bundle >

  4. If the screen freezes, or displays distorted information, you can press CTRL+R or CTRL+D to refresh the screen.

  5. To exit the Kiosk press Enter, then press ESC, then press SHIFT+T. At the prompt, type in exit.

If the appliance is in Quarantine, please generate a Quarantine Bundle from the Kiosk menu and copy the file to a network share. After the bundle is retrieved, perform a Reboot via the Kiosk, to see if the appliance will recover on its own. If it remains in Quarantine, a Factory Reset will likely be necessary. For more information, see Performing a factory reset.

Web browser interface

If you experience difficulty logging in through SSH, web access is also available.

  1. In your browser, go to the IP address of your IPMI interface. (that is, https://10.10.10.10), and login with your BMC admin account. The default is ADMIN/admin.
  2. You can attempt to fix the SSH connection, by navigating to Maintenance > Unit Reset > Select Reset. After 60 seconds re-attempt the SSH connection.
  3. Login to the Kiosk via the web by navigating to Remote Control > Select Launch SOL. (Java is required for this method, the Kiosk will launch in a JNLP window.)
  4. Use the cursor keys and return to navigate. Page Up is used for backspace. It is not possible to copy and paste when using the Java viewer.

Rebooting

A reboot from the BMC web browser interface is only a hardware level reboot.

If you need to reboot using the web browser interface:

  1. Log into the BMC web browser interface.
  2. Open the Serial over Lan emulator, which opens the Kiosk interface.
  3. Select reboot from the menu.

See KB 263835: How to remotely access the Kiosk via the Lights Out Management / BMC / IPMI interface.