Remote control commands for Dell PowerEdge series servers

Dell PowerEdge Server Remote Control Reference manual

This manual describes remote control commands for Dell PowerEdge series servers.

Remote Control function

The remote control referred to in this article refers to the operation of the remote Access Controller (RAC) based on the motherboard baseboard Management Controller (BMC) or the remotely controlled card, mainly refers to the premise of power on the host, network connectivity, Remote switch, switch the boot media, view the host hardware status, remotely view the console and install the operating system. The functions of the terminal and brush system need to install the Enterprise version of the remote control card, switch and view the hardware status of the BMC can be.

The Dell PowerEdge series servers are equipped with BMC, which means that all servers in the Chinese network support remote switching and viewing of hardware status via the IPMI LAN interface, and all R610 machines come standard with iDRAC6 Express cards, and most R610 machines are equipped with iDRAC6 Enterprise card. Only Enterprise card has a separate network port, and support remote terminal and brush system. Enterprise cards rely on Express cards.

According to Dell reference, if there is a Drac card on the host, the BMC is blocked, the IPMI LAN interface of the Drac card is turned off by default, it needs to be turned on by the Drac command client Racadm, or directly with racadm instead of the generic IPMI command client (such as IPM Itool, FREEIPMI) to implement all of its operations.

Remote Control fault Diagnosis

Some PowerEdge servers such as R410, R510, R710 Standard does not include Express card, if the purchase is configured as Enterprise card, then the channel may be unauthorized exchange of accessories, in the original standard based on the addition of Enterprise card, but such a configuration, Booting will be prompted by the BMC (baseboard Management Controller) instead of the enterprise card, this is because the enterprise card does not work without Express card. A Dell sales or service hotline is required to reissue the Express card accessory for the corresponding model (the price is included in the Enterprise card). Express Card installation refer to the corresponding model of the Hardware Owner's Manual, or by a Dell engineer on behalf of the installation.

Express card only support shared network port, and enterprise card can be used as a separate network port or shared network port, some enterprise card machine may occur with a separate network port but can not connect the situation, at this time to the site or log on to the host system to restore the DRAC Card Factory settings, Then enable the standalone network port.

The IDRAC card supports simple firewall functionality, but only restricts access to one segment, and if the feature is enabled but the restricted network segment is set incorrectly, the remote control channel cannot be used. In addition to the site to restart the machine for configuration, you can log into the host system, using the corresponding version of the local Racadm command to de-qualify, or in a specific network environment to deceive the address of a restricted network segment, thereby obtaining access control. Note that this qualification only affects features such as SSH, remote Racadm, and Web Access, and IPMI LAN is unaffected, and IPMI does not currently support the ability to de-qualify or restore the DRAC extensions such as factory settings.

Remote CONTROL Command Client

There are two types of remote control command-line clients, a standard IPMI client that supports only remote switching machines, switching boot media, viewing host hardware status, and so on, and a Dell DRAC client that supports more features. Both types of clients have local (host system) and remote modes.

IDRAC also supports WEB access and can be accessed with https://idrac_ip. Only the graphical interface supports media mapping. The graphical interface needs to be accessed using Internet Explorer or Firefox, and if you need access to the Virtual Console feature, Internet Explorer needs to install the ActiveX space and Firefox needs Java Web Start support. See "Port innuendo section" for details.

Installation of standard IPMI client Ipmitool

# yum Install OpenIPMI openipmi-tools  # centos AA yum intall ipmitool                  # CentOS 6

Note that only the standard release kernel and the Open interface are required to install the OPENIPMI package (easy to load kernel modules); The System department compiles a static kernel with IPMI support, while the system-trimmed system is preloaded with Dell Srvadmin does not recognize the static kernel, and its instsvcdrv service The/dev/ipmi0 will be deleted at boot time, causing the IPMI open interface to be inaccessible, and the device file can be restored for use.

# mknod/dev/ipmi0 C ' awk '/ipmidev/{print $ '/proc/devices ' 0

Installation of the Dell DRAC client

Dell DRAC Client DTK because of the evolution of the Vendor toolkit, the dependencies are confusing and dns1:/export/pxe/dtk_3.0_519_linux/tools/dell-toolkit.rpm is a relatively clean version.

# # also installs compat-libstdc++-33 on CentOS 6# yum--nogpgcheck localinstall dell-toolkit.rpm

The command file is/opt/dell/toolkit/bin/racadm{,3,4,5,6}, different models of the board use different versions of the tool, and RACADM6 seems to only support Enterprise cards, no local client support Express card.

In addition, the Drac client supports SSH access and can ssh into the DRAC address and then use Racadm under the SM-CLP command line (note that help does not display the command).

Command Reference

Note
The support of the RACADM subcommand is related to the specific version;
RACADMX Unified use Racadm to express, no longer distinguish between specific clients, not distinguish between local and remote, remote command Plus-R drac_ip-u Root [-P PASSWORD];
The Ipmitool command uses the Open interface uniformly to indicate that the LAN interface needs to be added with the-i lan-h drac_ip-u root [-f password_file] options;
IPMI LAN address and password see Local management machine/etc/sel.passwd file, note that the file permissions are 0600

Help

# man ipmitool# racadm help# racadm getconfig-h

Host information

# ipmitool Delloem sysinfo# racadm getsvctag# racadm getsysinfo# syscfg--biosver

IPMI LAN feature with DRAC enabled

# racadm Config-g cfgipmilan-o cfgipmilanenable 1

Host Power status/shutdown/Cold restart/Hot Restart/shutdown/boot

# Ipmitool Chassis Power  status/cycle/reset/soft/off/on# racadm serveraction powerstatus/powercycle/hardreset/?/ Powerdown/powerup

Restarting the DRAC card

# Ipmitool MC Reset cold/warm# Racadm Reset

Restore DRAC Card Factory settings

# Racadm Racresetcfg

Remove IP Segment Restrictions

# racadm Config-g cfgractuning-o cfgractuneiprangeenable 0

Setting LAN interface Parameters

The root user number is 2, and the default password is Calvin

# Ipmitool user list 1ID Name callin Link Auth IPMI Msg Channel Priv Limit2 root True True True administrator> racadm getconfig-u root# cfguseradminindex=2cfguseradminusername=root# CfgUserAdminP assword=******** (write-only) cfguseradminenable=1cfguseradminprivilege=0x000001ffcfguseradminipmilanprivilege= 4cfguseradminipmiserialprivilege=4cfguseradminsolenable=1# ipmitool User Set password 2 xxx# ipmitool delloem LAN Set ded icated# Ipmitool LAN Set 1 ipaddr 172.24.0.x# ipmitool LAN set 1 netmask 255.255.255.0# ipmitool LAN set 1 DEFGW ipaddr 17 2.24.0.230# ipmitool LAN print# racadm config-u root-g cfguseradmin-o cfguseradminpassword xxx# racadm config-g CfgLan Networking-o cfgnicenable # racadm config-g cfglannetworking-o cfgnicipv4enable # racadm config-g cfgLanNetworking- o cfgnicselection racadm config-g cfglannetworking-o cfgnicipaddress x.x.x.x# racadm config-g cfglannetworking-o CF Gnicnetmask 255.255.255.0# racadm conFig-g Cfglannetworking-o Cfgnicgateway x.x.x.x 

Set the boot media for the next boot (it doesn't seem to be effective?) ）

# Ipmitool Chassis Bootdev pxe# racadm config-g cfgserverinfo-o Cfgserverfirstbootdevice PXE

Set boot order and retry

# syscfg--bootseq  # View Boot order # syscfg--bootseq=hdd.emb.0,nic.emb.1# syscfg--bootseqretry=enable

LCD Display Control

# ipmitool Delloem LCD status# ipmitool delloem LCD set mode userdefined XXX

Export/Compare IPMI configuration

# yum Install freeipmi# bmc-config--checkout > bmc.conf# bmc-config--diff--file bmc.conf# ipmi-chassis-config--chec Kout > chassis.conf# ipmi-chassis-config--diff--file chassis.conf

Note that FREEIPMI only supports the IPMI specification, does not support vendor extension features, and Ipmitool has some support.

IDRAC Port Mapping Configuration

Sadly, IPMI does not have a firewall feature, and IDRAC HTTPS only supports restricting access to single-segment networks, although it also supports the frequency limit for password heuristics. Our hardware detects IPMI (the management machine walks the Open Interface). For security reasons, the Chinese network of IDRAC in addition to the management machine MGR1 and MRG2 placed in the intranet. No direct access to the IDRAC network, either from the company's exports or from other trusted public networks, means that its Virtual Console functionality cannot be used, unless port mapping is done.

IDRAC features	Port	Description
IDRAC Web	tcp/443	Https://idrac_ip
IDRAC Virtual Screen	tcp/5900	In the IDRAC Web point "Virtual Console", the Firefox version will download a JNLP file (including session information, the use will be invalidated), Java Web Start based on the file download client, the client will connect 5900 Port open Virtual Console
IDRAC SSH	Tcp/22	SSH idrac_ip can use racadm command after login
Ipmi	udp/623	Ipmitool-i lan-h Idrac_ip

Forwarding port on SSH client

SSH clients such as SECURECRT, Putty, and X-shell both support local port forwarding, which is the establishment of the SOCKS5 proxy port on this machine when logging in to the relay, which is equivalent to accessing the target resource on the transfer machine (such as IDRAC in the intranet). An SSH connection can enable multiple SOCKS5 agents at the same time. The configuration of local port forwarding varies by client, with SSH (1) as an example,

SSH some_host-d 127.0.0.1:443-d 127.0.0.1:5900

It is important to note that the SOCKS5 agent should listen on 127.0.0.x to avoid security issues. This enables simultaneous access to multiple intranet IDRAC

SSH some_host-d 127.0.0.1:443-d 127.0.0.1:5900-d 127.0.0.2:443-d 127.0.0.2:5900

Mapping ports on a transit machine

If IDRAC uses an intranet, these ports may be mapped to IPMI udp/623 and Idrac tcp/{22,443,5900}, taking gw50 as an example:

# ip addr Add 172.24.0.230 dev eth1 # All intranet IDRAC Gateways # IP addr Add 0.0.0.0 dev eth3 # Public network Mapping Portal # Arping-i ETH 3-c 3-u 0.0.0.0 # notify Router # # net.ipv4.ip_forward=1 # Enable gateway feature # IPTABLES-T nat-l-NV # View existing rules # IP  Tables-t filter-l-nv# iptables-t nat-i prerouting-i eth3-d 0.0.0.0-p tcp--dport 443-j DNAT--to 172.24.0.50 # Public network incoming HTTPS traffic # iptables-t nat-i prerouting-i eth3-d 0.0.0.0-p tcp--dport 5900-j DNAT--to 172.24.0.50 # Public network come in virtual Console traffic # iptables-t nat-i prerouting-i eth3-d 0.0.0.0-p UDP--dport 623-j DNAT--to 172.24.0.50 # Public network incoming IPMI traffic (optional) # iptables-t nat-i output-d 0.0.0.0-p tcp-m multiport--dports 22,443,5900-j DNAT--to 172.24.0.50 # Gateway-generated traffic (optional) # IP Tables-t nat-i output-d 0.0.0.0-p UDP--dport 623-j DNAT--to 172.24.0.50 # Gateway-generated traffic (optional) # iptables-t N At-i prerouting-i eth3-d 0.0.0.0-p ICMP--icmp-type 3-j DNAT--to 172.24.0.50 # Path mtu# iptables-t nat-i postrout Ing-o eth3-s 172.24.0.0/24-j SNAT--to 0.0.0.0 # Intranet out of traffic # iptables-t filter-i forward-d 172.24.0.0/24-j ACCEPT # Forwarding Traffic Filter, can be added to the specific public network source IP limit

Note that the above 0.0.0.0 can only be mapped to an intranet address at the same time. To make a request from the gateway to the public access IP, special attention should be paid to confirm that the Nat/output has set the firing rules, otherwise the actual access is the gateway host instead of the IDRAC system.

Problems with the IDRAC web

Note: Idrac's use of the default certificate may cause a certificate conflict sec_error_reused_issuer_and_serial, which requires the removal of all Dell IDRAC-related certificates, including the IDRAC server certificate and the Dell Inc IDR in the certificate authority. AC Root certificate (IDrac uses self-signed certificate, so it is classified into this class)

In addition, the lower version of Idrac will encounter two issues: 1) The use of IE browser to close the IDRAC interface without logging off, may not be able to log in again, 2) Fireforx Browser can not open the Virtual Console, performance is unable to save the JNLP file.

Defective version (Wuhan)    device type     iDRAC6         hardware version     0.01         firmware version     1.70 (Build)     firmware update     Fri APR 1 17:07:41 2011 Repair Version (Dongguan)    device type     iDRAC6         hardware version     0.01         firmware version     1.80 (Build)     firmware update     Tue Nov 8 14:49:22 2011     

Question 1) There is no workaround.

Problem 2) can be bypassed. This problem may be due to the generated JNLP file contains a Chinese code, causing Firefox cannot save the boot file.

>>> decodeuricomponent ("=idrac-fwkl33x%2c+poweredge+r610%2c+%u7528%u6237%uff1aroot") urierror:malformed URI sequence   

is actually "title=idrac-fwkl33x,+poweredge+r610,+ User: Root"

Log the original request through Firebug, then use OpenSSL to get the complete JNLP content, change the%u7528%u6237%uff1a to user%3a, and then double-click the JNLP file to activate Java Webstart to download and launch the Virtual Console. Note that the token used by the JNLP is invalidated once, and using the failed JNLP will prompt "Login failed, possibly the network is too slow, please retry" and the new JNLP content must be "started" at the HTTPS interface point.

# OpenSSL S_client-connect 0.0.0.0:443...GET/VIEWER.JNLP ([email protected] @idrac-fwkl33x%2c+poweredge+r610% 2c+%u7528%u6237%[email protected]) http/1.1host:0.0.0.0user-agent:mozilla/5.0 (Windows NT 6.1; rv:18.0) Gecko/ 20100101 Firefox/18.0accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8accept-language: Zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3accept-encoding:gzip, Deflatereferer:https://0.0.0.0/syssummarydata.html?cat =c00&tab=t00&id=p00cookie: _appwebsessionid_=8f5ec0e255d7552abb915fde55cc25f5; Batteriesicon=status_normal; Fansicon=status_normal; Intrusionicon=status_normal; Powersuppliesicon=status_normal; Removableflashmediaicon=status_normal; Temperaturesicon=status_normal; voltagesicon=status_normalconnection:keep-alivehttp/1.1 Okdate:mon, 08:55:35 gmtserver: Mbedthis-appweb/2.4.2content-type:application/x-java-jnlp-filecontent-length:3242connection: KEEP-ALIVEKEEP-ALIVE:TIMEOUT=60, Max=2000cache-control:max-age=604800laSt-modified:mon Jan 08:55:35 2013<?xml version= "1.0" encoding= "UTF-8"? 

Resources

http://support.dell.com/support/edocs/software/smdrac3/idrac/
http://support.dell.com/support/edocs/systems/
Http://stuff.mit.edu/afs/athena/dept/cron/documentation/dell-server-admin/en/DRAC_5/racugc1j.htm

After updating Java version, my application stops working.
Http://java.com/en/download/help/clearcache_upgrade.xml

Java Network Launch Protocol (JNLP) support
Http://www.oracle.com/technetwork/java/javase/index-142562.html

Http://www.frozentux.net/iptables-tutorial/iptables-tutorial.html#TRAVERSINGOFTABLES

Remote control commands for Dell PowerEdge series servers