Two-Factor Authentication Settings - HP Integrated Lights-Out User Manual

Two-Factor Authentication Settings

This page displays the configuration of two-factor authentication settings and the trusted CA certificate
information. It also provides a method of changing the configuration and importing or deleting a trusted
CA certificate.
The Enforce Two-Factor Authentication setting controls whether two-factor authentication will be used for
user authentication during login. Selecting Yes for this setting will require two-factor authentication. The
No value will disable this feature and allow login with user name and password only. iLO will not allow
this setting to be changed to Yes if a trusted CA certificate has not been configured. Changing this setting
causes iLO to reset for the change to take effect. To provide the necessary security, the following
configuration changes will also be made when two-factor authentication is enabled:
Remote Console Data Encryption: Yes (Disables telnet access)
Enable Secure Shell (SSH) Access: No
Serial Command Line Interface Status: Disabled
If telnet, SSH, or Serial CLI access is required, re-enable these settings after two-factor authentication is
enabled. However, because these access methods do not provide a means of two-factor authentication,
only a single factor is required to access iLO with telnet, SSH or Serial CLI.
When two-factor authentication is enabled, access with the CPQLOCFG utiltiy is disabled, because
CPQLOCFG does not supply all authentication requirements. However, the HPONCFG utility is functional,
because administrator privileges on the host system are required to execute this utility.
The Check for Certificate Revocation setting controls whether iLO uses the certificate CRL distribution
points attribute to download the latest CRL and check for revocation of the client certificate. If the client
Configuring iLO 33