Home / server / Questions / 489865
In Process
Greg Bray
Asked: 2013-03-21 14:52:45 +0800 CST

Batch reset all iLO passwords via command line

  • 772

I would like to batch reset all the iLO passwords on our HP Blade chassis without having to login to each one via the HTTPS website. How can I reset the root and administrator iLO passwords via the SSH command line?

password

3 Answers

  1. You could set everything in one place from the HP Onboard Administrator.

    Through the GUI, the HPOA has password-less access to the individual server ILO interfaces.

    Through the CLI, you can HPONCFG ALL HTTP://some.host.ip/iloconfig.xml to take care of all devices using one iloconfig.xml file.

    • 4

  2. I simplified the script and changed all our iLO passwords with: 

    IPs=`echo 10.0.0.{1..254}`

for ip in $IPs
do
    echo Starting $ip 
    sshpass -p 'PWOLD' ssh -o StrictHostKeyChecking=no -l Administrator $ip "set /map1/accounts1/Administrator password=PWNEW"
done

    Works like a charm! Many thanx for the inspiring example! (Typo with IPs is corrected!)

    • 4

  3. I found the fastest way was to use a combination of SSHPASS and the iLO command line interface. The bash script below creates two aliases for using SSHPASS called oldlogin and newlogin and then uses those to login to the iLO, reset the root account, then login with the new password and reset the administrator account. 

    alias oldlogin="sshpass -p 'OldP@ssword' ssh -o StrictHostKeyChecking=no -l root "
alias newlogin="sshpass -p 'NewP@ssword' ssh -o StrictHostKeyChecking=no -l root "

IPs=`echo 10.0.0.{100..125}` #$IPs is a list of IP addresses from 10.0.0.100-125

for ip in $IPs #Run command to update root login to new password
do
   echo Starting $ip
   oldlogin $ip "set /map1/accounts1/root password=NewP@ssword"
done

for ip in $IPs #Run command to login with new root password and update administrator account
do
   echo Starting $ip
   newlogin $ip "set /map1/accounts1/administrator password=NewP@ssword"
done

    I saw a reference to /map1/accounts/ instead of /map1/accounts1/ but that did not work on my systems. You can login via SSH and use show map1 to see a list of all available targets. The output should look something like this:

    root@localhost /usr/bin
$ for ip in $IPs
> do
>    echo Starting $ip
>    oldlogin $ip "set /map1/accounts1/root password=NewP@ssword"
> done
Starting 10.0.0.100
set /map1/accounts1/root password=NewP@ssword
status=0
status_tag=COMMAND COMPLETED

... omitted ...

Starting 10.0.0.125
set /map1/accounts1/root password=NewP@ssword
status=0
status_tag=COMMAND COMPLETED



root@localhost /usr/bin
$ for ip in $IPs 
> do
>    echo Starting $ip
>    newlogin $ip "set /map1/accounts1/administrator password=NewP@ssword"
> done
Starting 10.0.0.100
set /map1/accounts1/administrator password=NewP@ssword
status=0
status_tag=COMMAND COMPLETED

... omitted ...

Starting 10.0.0.125
set /map1/accounts1/administrator password=NewP@ssword
status=0
status_tag=COMMAND COMPLETED
    • 3