HP iLO local account rotation

Rotate the password of a local account on HP Integrated Lights-Out (iLO), the management interface of HP servers, on a schedule. Infisical generates a new password, sets it on the iLO, and stores the account’s username and password in the Infisical secrets you choose. The rotation works with either of two app connections: an HPE iLO connection, which changes the password through the iLO’s Redfish API over HTTPS, or an SSH connection, which runs iLO commands over SSH. To decide which one to use, see Choose an app connection.

Rotation Type: Single-PhaseThis rotation updates one set of credentials in place, so the previous password stops working as soon as the rotation finishes. Clients that still use the previous password can’t sign in until they read the new password from Infisical. An iLO account has only one password, so Infisical can’t keep the previous password valid during a rotation.

iLO password lengthHP iLO accepts passwords of at most 39 characters. The default password requirements for this rotation (39 characters, no symbols) fit that limit. If you change the password requirements, keep Password Length at 39 or lower.

Choose an app connection

If your server has iLO 7, use an HPE iLO connection, because Infisical can’t rotate iLO 7 passwords over SSH.

SSH connection
HPE iLO connection (Redfish API)

Infisical signs in to the iLO over SSH and runs the iLO command that sets the target account’s password. Rotation Method decides which account signs in:

Login As Root: Infisical signs in with the SSH connection’s credentials and changes the target account’s password
Login As Target: Infisical signs in as the target account with the account’s current password, and the account changes its own password

After the change, Infisical signs in over SSH as the target account with the new password to check that the password works, then saves the username and password to the mapped secrets.

Prerequisites

A project with secrets configured
An iLO local account for the app connection, separate from the account you rotate
Permission for the app connection’s account to change the rotated account’s password (not needed if you use an SSH connection with Login As Target)
Network access from Infisical to the iLO, directly or through a Gateway, if network restrictions apply: HTTPS for an HPE iLO connection, or SSH for an SSH connection

Create an HP iLO local account rotation

Infisical UI
API

In your Secrets Manager project, open the dashboard and select Add Secret Rotation from the actions dropdown.

Then, select the HP iLO Local Account option. Select HP iLO Local Account

Under Configuration, choose the app connection and when the rotation runs:

Environment: The project environment the rotated secrets are stored in
Connection: The HPE iLO connection or SSH connection the rotation uses (the dropdown groups the connections by type)
Rotation Interval (In Days): The number of days between rotations
Rotate At (Local Time): The time of day the rotation runs
Auto-Rotation Enabled: When enabled, the password rotates on the schedule; turn it off to rotate manually only

To create a new connection, select Create HPE iLO Connection or Create SSH Connection in the Connection dropdown, then fill in the form as described in HPE iLO connection or SSH connection. Infisical returns you to the rotation form with the new connection selected. Rotation Configuration

Because this rotation changes a single password, an automatic rotation can interrupt clients that use the previous password. If you need to avoid interruptions, turn off Auto-Rotation Enabled and rotate manually.

Then select Continue.

Under Parameters, choose the iLO account to rotate. The fields depend on the type of connection you selected:

HPE iLO connection
SSH connection

Target Username: The iLO username of the account whose password Infisical rotates

Under Password Requirements, set the rules for generated passwords:

Password Length: The length of the generated password (39 at most)
Digit Count: The minimum number of digits
Lowercase Character Count: The minimum number of lowercase characters
Uppercase Character Count: The minimum number of uppercase characters
Symbol Count: The minimum number of symbols
Allowed Symbols: The symbols a generated password can contain

Then select Continue.

Under Mappings, choose the names of the Infisical secrets that hold the rotated values:

Username: The name of the secret that holds the iLO username
Password: The name of the secret that holds the rotated password

Then select Continue.

Give the rotation a Name and an optional Description. The name must be slug-friendly. Rotation Details

Then select Continue.

Review your HP iLO Local Account Rotation configuration, then select Create secret rotation. Review and Create

The rotated credentials are now available through the mapped secrets. If auto-rotation is enabled, the password rotates on your configured schedule.

To create an HP iLO Local Account Rotation, make an API request to the Create HP iLO Local Account Rotation endpoint.Set connectionId to the ID of an HPE iLO connection or an SSH connection. parameters.rotationMethod applies only to SSH connections: leave it out for an HPE iLO connection, because Infisical rejects login-as-target for HPE iLO connections. For login-as-target, also send the target account’s current password in temporaryParameters.password.

Sample request

The following request creates a rotation that uses an SSH connection with Login As Root.

Request

curl --request POST \
--url https://us.infisical.com/api/v2/secret-rotations/hp-ilo-local-account \
--header 'Content-Type: application/json' \
--data '{
    "name": "my-hp-ilo-rotation",
    "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "description": "my HP iLO local account rotation",
    "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "environment": "dev",
    "secretPath": "/",
    "isAutoRotationEnabled": false,
    "rotationInterval": 30,
    "rotateAtUtc": {
        "hours": 0,
        "minutes": 0
    },
    "parameters": {
        "rotationMethod": "login-as-root",
        "username": "ilouser",
        "passwordRequirements": {
            "length": 39,
            "required": {
                "digits": 2,
                "lowercase": 2,
                "uppercase": 2,
                "symbols": 2
            },
            "allowedSymbols": "-_.~!*"
        }
    },
    "secretsMapping": {
        "username": "ILO_USERNAME",
        "password": "ILO_PASSWORD"
    }
}'

Because this rotation changes a single password, an automatic rotation can interrupt clients that use the previous password. If you need to avoid interruptions, set isAutoRotationEnabled to false and rotate manually.

Sample response

In the response, connection.app is hpe-ilo for an HPE iLO connection and ssh for an SSH connection.

Response

{
    "secretRotation": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "my-hp-ilo-rotation",
        "description": "my HP iLO local account rotation",
        "secretsMapping": {
            "username": "ILO_USERNAME",
            "password": "ILO_PASSWORD"
        },
        "isAutoRotationEnabled": false,
        "activeIndex": 0,
        "folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "createdAt": "2023-11-07T05:31:56Z",
        "updatedAt": "2023-11-07T05:31:56Z",
        "rotationInterval": 30,
        "rotationStatus": "success",
        "lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
        "lastRotatedAt": "2023-11-07T05:31:56Z",
        "lastRotationJobId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "nextRotationAt": "2023-11-07T05:31:56Z",
        "connection": {
            "app": "ssh",
            "name": "my-ssh-connection",
            "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
        },
        "environment": {
            "slug": "dev",
            "name": "Development",
            "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
        },
        "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "folder": {
            "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
            "path": "/"
        },
        "rotateAtUtc": {
            "hours": 0,
            "minutes": 0
        },
        "lastRotationMessage": null,
        "type": "hp-ilo-local-account",
        "parameters": {
            "rotationMethod": "login-as-root",
            "username": "ilouser",
            "passwordRequirements": {
                "length": 39,
                "required": {
                    "digits": 2,
                    "lowercase": 2,
                    "uppercase": 2,
                    "symbols": 2
                },
                "allowedSymbols": "-_.~!*"
            }
        }
    }
}

Recover after an outside password change

If a rotation uses an SSH connection with Login As Target and someone changes the target account’s password outside Infisical, the next rotation can’t sign in as the target account. To get the rotation working again, reconcile it:

In your project’s dashboard, select Reconcile Secret on the rotation. Reconcile Option

In the confirmation dialog, select Reconcile. Reconcile Confirmation

Infisical signs in with the SSH connection’s credentials, sets a new password on the target account, and saves the password to the mapped secrets. A rotation that uses an HPE iLO connection or Login As Root always signs in with the connection’s account, so a password change outside Infisical doesn’t stop the next rotation.

Get started

Manage secrets

Integrations

Secret rotation

Dynamic secrets

Honey tokens

Agent proxy

HP iLO local account rotation

Choose an app connection

Prerequisites

Create an HP iLO local account rotation

Sample request

Sample response

Recover after an outside password change

Next steps

HPE iLO

Overview

​Choose an app connection

​Prerequisites

​Create an HP iLO local account rotation

​Sample request

​Sample response

​Recover after an outside password change

​Next steps

HPE iLO

Overview

Choose an app connection

Prerequisites

Create an HP iLO local account rotation

Sample request

Sample response

Recover after an outside password change

Next steps