| Both sides previous revision Previous revision | |
| hardware:guides:reset_ilo4_pw [2026/07/20 14:00] – fabricio | hardware:guides:reset_ilo4_pw [2026/07/20 14:23] (current) – avoid bash expansion in setting pw fabricio |
|---|
| </code> | </code> |
| |
| ===== ⚠️ CRITICAL: Password Length Limitations ⚠️ ===== | ===== ⚠️ CRITICAL: Password Rules & Bash Pitfalls ⚠️ ===== |
| |
| Before injecting a password, you must adhere to a strict character limit rule to avoid locking yourself out of the Web UI: | Before injecting a password via the host command line, you must adhere to two strict rules to avoid silent corruption and Web UI lockouts: |
| * **The Rule:** Passwords must be **between 8 and 20 characters** long, containing a mix of uppercase, lowercase, and numbers. | |
| * **The Danger:** The IPMI protocol has a maximum limit of 20 characters. If you pass a password longer than 20 characters to ''ipmitool'', it will accept it with zero errors but will **silently truncate** the password to the first 20 characters. When logging into the iLO Web UI later, entering your full untruncated password will fail. | * **1. The Bash History Expansion Trap (Special Characters):** If your password contains special characters (especially ''!'', ''$'', or ''*''), **never wrap the password in double quotes (`"..."`)** in your terminal. Bash interprets these symbols as shell expansions or history shortcuts, silently mangling the string before writing it to the hardware. **Always wrap the password in single quotes (`'...'`)** to force the shell to treat it as literal text. |
| | * **2. The Length Rule:** Passwords must be **between 8 and 20 characters** long, containing a mix of uppercase, lowercase, and numbers. The underlying IPMI protocol has a maximum hard limit of 20 characters. Passwords longer than 20 characters are **silently truncated** by ''ipmitool'', meaning subsequent Web UI login attempts using the full password will fail. |
| | |
| | > **Pro Tip:** If you want a password with complex special characters or a length exceeding 20 characters, use a simple alphanumeric password via ''ipmitool'' first to gain access, then change it to your final complex password directly inside the iLO Web UI settings (which bypasses the Linux shell entirely). |
| |
| ===== Step-by-Step Recovery ===== | ===== Step-by-Step Recovery ===== |
| |
| **1. Reset the Default HPE Administrator Account (ID 1)**\\ | **1. Reset the Default HPE Administrator Account (ID 1)**\\ |
| Overwrite the unknown password for the official HPE account name. Ensure your new password adheres to the 8-20 character rule. | Overwrite the unknown password for the official HPE account name. Ensure your new password adheres to the single-quote and 8-20 character rules. |
| <code bash> | <code bash> |
| sudo ipmitool user set password 1 "SecurePass123!" | sudo ipmitool user set password 1 'SecurePass123' |
| </code> | </code> |
| |
| |
| **2. Set the Password**\\ | **2. Set the Password**\\ |
| Ensure your new password adheres to the 8-20 character rule. | Ensure your new password adheres to the single-quote and 8-20 character rules. |
| <code bash> | <code bash> |
| sudo ipmitool user set password 3 "SecurePass123!" | sudo ipmitool user set password 3 'SecurePass123' |
| </code> | </code> |
| |
| |
| ^ Action ^ Target ID ^ Command ^ | ^ Action ^ Target ID ^ Command ^ |
| | Option A: Reset Default | ID 1 | ''sudo ipmitool user set password 1 "NewPassword"'' | | | Option A: Reset Default | ID 1 | ''sudo ipmitool user set password 1 'NewPassword''' | |
| | Option A: Disable Legacy | ID 2 | ''sudo ipmitool user disable 2'' | | | Option A: Disable Legacy | ID 2 | ''sudo ipmitool user disable 2'' | |
| | Option B: Full New User Setup | ID 3 | ''sudo ipmitool user set name 3 <user>''\\ ''sudo ipmitool user set password 3 <pass>''\\ ''sudo ipmitool user enable 3''\\ ''sudo ipmitool user priv 3 4'' | | | Option B: Full New User Setup | ID 3 | ''sudo ipmitool user set name 3 <user>''\\ ''sudo ipmitool user set password 3 'pass'''\\ ''sudo ipmitool user enable 3''\\ ''sudo ipmitool user priv 3 4'' | |
| |
| > **Note:** Changes take effect instantly with zero server reboots or downtime required. You can immediately navigate to the iLO web interface in your web browser and log in using the newly configured credentials. | > **Note:** Changes take effect instantly with zero server reboots or downtime required. If the Web UI continues to show an "Unauthorized" error due to aggressive security lockouts or an active software cache, force an iLO-only hardware restart by running: ''sudo ipmitool mc reset cold''. This will not affect the host operating system or running storage arrays. |