HP Integrity rx4640 Server - Manual (Page 80)

13.6 Security Problems
13.13.6.1 After updating my Windows XP system with Service Pack 2, I cannot access HP SIM or HP
Version Control Repository Manager. What happened?
Windows XP Service Pack 2 implements a software firewall that prevents browsers from
accessing the ports required for HP SIM and Version Control Repository Manager access. To
resolve this issue, configure the firewall with exceptions to allow browsers to access the ports
used by HP SIM and Version Control Repository Manager.
HP recommends the following actions:
1. Select Start
→Settings Control Panel.
2. Double-click Windows Firewall to configure the firewall settings.
3. Select Exceptions.
4. Click Add Port.
5. Enter the product name and the port number.
Add the following exceptions to the firewall protection:
Table 13-1 Firewall protection exceptions
Port Number Product
2301 HP SMH Insecure Port:
2381 HP SMH Secure Port:
280 HP SIM Insecure Port:
50000 HP SIM Secure Port:
6. Click OK to save your settings and close the Add a Port dialog box.
7. Click OK to save your settings and close the Windows Firewall dialog box.
This configuration leaves the default SP2 security enhancements intact, but allows traffic over
the ports previously indicated. These ports are required for HP SIM and Version Control
Repository Manager to run. Ports 2301 and 2381 are required for the Version Control
Repository Manager and ports 280 and 50000 are required by HP SIM. The secure and
insecure ports must be added for each product to enable communication with the applications.
13.13.6.2 Why can't I import X.509 certificates directly into HP SMH?
HP SMH generates Certificate Request in Base64-encoded PKCS #10 format. This certificate
request should be supplied to the certificate authority. Most CAs return Base64-encoded PKCS
#7 certificate data that you can import directly into HP SMH by selecting Settings
→HP
System Management Homepage
→Security→Local Server Certificate.
If the CA returns the certificate data in X.509 format, rename the X.509 certificate file as
cert.pem
and place it into the \hp\sslshare directory. When HP SMH is restarted, this
certificate is used.
13.13.6.3 Why is my PKCS #7 cert data not accepted?
When using a Mozilla browser, there can be problems when cutting and pasting cert request
and reply data using Notepad or other editors. To avoid these problems, use Mozilla to open
certificate reply files from your CA. Use the Select All, Cut, and Paste operations supplied by
Mozilla when working with certificates.
13.13.6.4 Why is my private key file not protected by the file system?
If you are using Windows operating systems, you must have the system drive in NTFS format
for the private key file to be protected by the file system.
13.13.6.5 Why do I get errors when I paste my customer-generated certificate PKCS #7 data into the HP
SIM Certificate Data field in Settings
→HP SMH→Security→Trusted Management Servers?
The customer-generated certificate PKCS #7 data is not relevant to the date given in the Trusted
Management Servers
field. The PKCS #7 data should be imported into the Customer Generated
Certificates Import PKCS #7 Data field under Settings
→HP SMH→Security→Local Server
80 Troubleshooting topics