hardware:guides:reset_ilo4_pw [DokuWiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== HPE iLO 4 Password Recovery via Local Linux Host OS ======

This guide outlines how to safely recover administrative access to an **HPE iLO 4** management processor using a local Linux host operating system after a motherboard replacement or lost credentials.

===== Context & Problem =====

When an HPE system board is replaced, the default iLO login credentials printed on the server chassis' physical pull-out tag no longer match the replacement hardware. 
  * **The Trap:** Performing a standard iLO factory reset will only revert the system to the unknown default password printed on the replacement motherboard's internal sticker, locking you out permanently.
  * **The Solution:** Because you have root/administrator privileges on the local host operating system, you can leverage the internal PCIe system bus to communicate directly with the iLO hardware via IPMI, bypassing remote authentication completely.

===== Prerequisites & Environment =====

This method works on virtually any modern Linux-based host operating system (Debian, Ubuntu, RHEL/CentOS, Proxmox, TrueNAS SCALE, etc.).

  * **Uncomplicated Environments (TrueNAS SCALE, Proxmox VE, etc.):** Storage and hypervisor appliances typically come with the core utility ''ipmitool'' pre-installed in the base OS image, making this an immediate out-of-the-box solution.
  * **Standard Linux Distros (Ubuntu/Debian/RHEL):** You may need to install the package first via your standard package manager:
<code bash>
# For Debian / Ubuntu:
sudo apt update && sudo apt install ipmitool

# For RHEL / CentOS / Rocky Linux:
sudo dnf install epel-release && sudo dnf install ipmitool
</code>

===== ⚠️ CRITICAL: Password Rules & Bash Pitfalls ⚠️ =====

Before injecting a password via the host command line, you must adhere to two strict rules to avoid silent corruption and Web UI lockouts:

  * **1. The Bash History Expansion Trap (Special Characters):** If your password contains special characters (especially ''!'', ''$'', or ''*''), **never wrap the password in double quotes (`"..."`)** in your terminal. Bash interprets these symbols as shell expansions or history shortcuts, silently mangling the string before writing it to the hardware. **Always wrap the password in single quotes (`'...'`)** to force the shell to treat it as literal text.
  * **2. The Length Rule:** Passwords must be **between 8 and 20 characters** long, containing a mix of uppercase, lowercase, and numbers. The underlying IPMI protocol has a maximum hard limit of 20 characters. Passwords longer than 20 characters are **silently truncated** by ''ipmitool'', meaning subsequent Web UI login attempts using the full password will fail.

> **Pro Tip:** If you want a password with complex special characters or a length exceeding 20 characters, use a simple alphanumeric password via ''ipmitool'' first to gain access, then change it to your final complex password directly inside the iLO Web UI settings (which bypasses the Linux shell entirely).

===== Step-by-Step Recovery =====

==== Step 1: Load the IPMI Kernel Modules ====
Many modern operating systems turn off host-to-hardware IPMI communication by default to reduce background overhead. Run these commands to manually load the required Linux kernel drivers:

<code bash>
sudo modprobe ipmi_si
sudo modprobe ipmi_devintf
</code>

==== Step 2: Audit the Active iLO Accounts ====
iLO stores its credentials using numeric Index IDs rather than just text strings. Query the user map on channel 2 to check the existing configuration on the motherboard:

<code bash>
sudo ipmitool user list 2
</code>

Expected output will list the User IDs alongside their privilege levels. For a replacement board, you will likely see the official factory account plus leftover profiles from the board's previous deployment:
<code text>
ID  Name            Callin  Link Auth  IPMI Msg    Channel Priv Limit
1   Administrator   true    false      true        ADMINISTRATOR
2   admin           true    false      true        ADMINISTRATOR
3   (Empty User)    true    false      false       NO ACCESS
</code>

==== Step 3: Choose an Authentication Path ====
Depending on your security and administrative preferences, choose **Option A** to clean and overwrite the existing structure, or **Option B** to safely add a new user without touching existing accounts.

=== Option A: Reclaim & Secure (Recommended) ===
This approach targets the standard HPE account name while shutting down security loopholes left by previous owners or tests.

**1. Reset the Default HPE Administrator Account (ID 1)**\\ 
Overwrite the unknown password for the official HPE account name. Ensure your new password adheres to the single-quote and 8-20 character rules.
<code bash>
sudo ipmitool user set password 1 'SecurePass123'
</code>

**2. Disable Leftover Legacy Accounts (ID 2)**\\ 
Leaving a rogue administrator account active from a previous deployment poses a security risk. Disable the leftover ''admin'' account completely to close the loophole:
<code bash>
sudo ipmitool user disable 2
</code>

=== Option B: Create a Brand-New User Account (Conservative) ===
If you prefer a conservative approach that leaves existing accounts completely untouched to avoid breaking potential external monitoring tools or automated scripts, you can provision an entirely new user account in an empty slot (e.g., **ID 3**).

Unlike overwriting an existing profile, a brand-new user starts with zero permissions. You must run a full 4-step sequence to name, password-protect, enable, and privilege-elevate the slot:

**1. Set the Custom Username**
<code bash>
sudo ipmitool user set name 3 your_new_username
</code>

**2. Set the Password**\\ 
Ensure your new password adheres to the single-quote and 8-20 character rules.
<code bash>
sudo ipmitool user set password 3 'SecurePass123'
</code>

**3. Enable the Account**
<code bash>
sudo ipmitool user enable 3
</code>

**4. Grant Full Administrator Privileges**\\ 
The integer ''4'' tells iLO to grant this slot full administrative tokens. Without this step, you will log into the web UI but see a blank screen with no access rights.
<code bash>
sudo ipmitool user priv 3 4
</code>

===== Quick Reference Table =====

^ Action ^ Target ID ^ Command ^
| Option A: Reset Default | ID 1 | ''sudo ipmitool user set password 1 'NewPassword''' |
| Option A: Disable Legacy | ID 2 | ''sudo ipmitool user disable 2'' |
| Option B: Full New User Setup | ID 3 | ''sudo ipmitool user set name 3 <user>''\\ ''sudo ipmitool user set password 3 'pass'''\\ ''sudo ipmitool user enable 3''\\ ''sudo ipmitool user priv 3 4'' |

> **Note:** Changes take effect instantly with zero server reboots or downtime required. If the Web UI continues to show an "Unauthorized" error due to aggressive security lockouts or an active software cache, force an iLO-only hardware restart by running: ''sudo ipmitool mc reset cold''. This will not affect the host operating system or running storage arrays.