Inspur NF5280M5 User manual

Inspur server security configuration Guide
1/ 42
Inspur Server Security Configuration
Guide (M5 Platform)
Ver1.0
2019-11

Inspur server security configuration Guide
2/ 42
Dear users:
Copyright © Inspur Electronic Information Industry Co., Ltd. 2019.All rights reserved
No part of this document may be reproduced, modified or transmitted in any form or by any
means without the prior written consent of the company.
Trademark statement
Inspur and the Inspur logo are trademarks or registered trademarks of Inspur
Group.
All other trademarks or registered trademarks mentioned in this document are the property of their
respective owners.
Remarks
The products, services or features you purchase shall be subject to the commercial contracts and
terms of Inspur Electronic Information Industry Co., Ltd. All or part of the products, product
safety services or features described in this document may not be covered by your purchase or use.
Unless otherwise agreed by the contract, Inspur Electronic Information Industry Co., Ltd. makes
no representations or warranties, express or implied, regarding the contents of this document. The
contents of this document may be updated from time to time due to product version upgrades or
other reasons. Unless otherwise agreed, this document is provided as a guide only, and all
statements, information, and recommendations in this document are not warranties of any kind,
express or implied.
Inspur Electronic Information Industry Co., Ltd.
Website: www.inspur.com
Address: No. 1036, Langchao Road, Jinan City, Shandong Province, China
Postcode: 250101

Inspur server security configuration Guide
3/ 42
Contents
0 Introduction..................................................................................................................................6
1Hardware security configuration...........................................................................................8
1.1 Power module installation...............................................................................................8
1.2 Connect network interface ..............................................................................................8
1.3 Power on .......................................................................................................................10
1.4 Power off.......................................................................................................................11
2Firmware security configuration.........................................................................................13
2.1 Security configuration of system BIOS ........................................................................13
2.1.1 How to enter BIOS............................................................................................15
2.1.2 BIOS system menu configuration .....................................................................16
2.2 BMC security configuration..........................................................................................27
2.2.1 Get BMC IP.......................................................................................................27
2.2.2 Remote login BMC...........................................................................................28
2.2.3 BMC web interface settings..............................................................................30
3System security configuration..............................................................................................38
3.1 Server hardware maintenance.......................................................................................38
3.2 Server data backup........................................................................................................39
3.3 Server software configuration.......................................................................................39
3.4 Other .............................................................................................................................40
4Conclusion .............................................................................................................................42

Inspur server security configuration Guide
4/ 42
Purpose
This document introduces the security reinforcement methods and
suggestions of Inspur server, which are applicable to almost all product
models of M5 platform server (such as NF5280M5, NF8480M5, etc.).
The purpose is to guide users how to configure the server to achieve the
best security, eliminate potential threats and security risks brought by
natural and human factors, and improve users' use experience.
Scope
The server is a device that provides services for enterprises and operators
and ensures business continuity. Therefore, the security reinforcement of
the server mainly involves the security configuration and management of
the device, including:
Hardware security configuration;
Firmware security configuration;
System security configuration.
Readers
This document applies to administrators who are responsible for
configuring and managing servers. You should be familiar with the basic
knowledge of Ethernet and have rich experience in server management.

Inspur server security configuration Guide
5/ 42
Symbols and abbreviated terms
Abbreviation
Describe
UPS
Uninterruptible Power Supply
PDU
Power Distribution Unit
BMC
Baseboard Management Controller
BIOS
Basic Input Output System
CMOS
Complementary Metal Oxide Semiconductor
TPM
Trusted Platform Module
NTFS
New Technology File System
UEFI
Unified Extensible Firmware Interface

Inspur server security configuration Guide
6/ 42
0 Introduction
The security and confidentiality of the whole information in the network is
a crucial issue. At present, global information technology has become a
major trend of human development. However, due to the diversity of
connection forms and uneven distribution of terminals in computer
networks based on servers and terminals, and the vulnerability caused by
various kinds of application defects, the whole network is vulnerable to
hackers, malware and other attacks. Therefore, it is particularly important
to guarantee the security and confidentiality of servers that carry and
process information. Inspur has made great efforts to solve this problem,
and has made a comprehensive and in-depth investigation and analysis of
the security problems existing on the server, forming this security
configuration manual.
In order to maintain the security of the whole server system, you need to
build security measures from multiple levels to discover and deal with
various possiblesecurityproblems in advance. Therefore, how to configure
the server safely is particularly important.
In order to improve the security of the server, you need to configure the
security of the server system from several aspects:
1. Hardware security configuration
It mainly includes power on and power off of server, network and interface

Inspur server security configuration Guide
7/ 42
configuration.
2. Firmware security configuration
It is mainly about the security configuration and use of BIOS and BMC,
which are the bottom firmware and start before the server system. Only
BIOS and BMC are secure enough can the security of the server system be
guaranteed fundamentally.
3. System security configuration
It mainly includes server data backup and server software configuration.
These are also critical to server security.
Before you perform any operation on the server, make sure that you have
read all the operation instructions of the device, especially the instructions
such as danger, warning and attention that may endanger personal and
device safety, so as to minimize the probability of accidents.
It is strongly recommended that you make basic security configuration
for server to avoid most security problems.
Note: The recommended configuration in this document is not applicable
to all Inspur server product models. Please refer to the user manual of the
corresponding product model for details.

Inspur server security configuration Guide
8/ 42
1Hardware security configuration
Hardware security configuration includes power on and power off of server,
network and interface configuration, including how to install the power
module, how to access the network safely, how to ensure the safe power
on and power off, and how to check the system information through the
serial port in case of system startup problems.
1.1 Power module installation
Generally, the server has multiple power modules. Please ensure that all
the power modules are inserted in the power slots of the server. If one of
the power modules fails, the other power modules can still maintain the
operation of the server and ensure that the business of the server will not
be interrupted.
1.2 Connect network interface
There are multiple network interfaces on the server. For the sake of server
security,it is recommended not to connect the BMC networkto the Internet,
but to connect to the enterprise intranet. For how to configure the network
parameters of the BMC, please refer to section 2.1.2.
The network port on the back of the server is shown in Figure 1.1:

Inspur server security configuration Guide
9/ 42
Figure 1.1 schematic diagram of server network port distribution
Name
Function and description
Network interface
0/1/2/3
4 gigabit network interfaces per IO riser;
The indicator LED of the network card is green when the speed
is 100MB;
The indicator LED of the network card is orange at Gigabit rate
USB interface 1/2
Connect USB device
VGA interface
Connect standard VGA interface display device
Management
interface
Independent RJ45 Gigabit management interface;
The system can be monitored and managed through integrated
BMC
Network interface 0/1/2/3 is the public network interface of the server. It
can access the operating system and BMC simultaneously by connecting
one of the network interfaces. The management interface is a dedicated
network interface of BMC, which only allows access to BMC, but not to
the server.

Inspur server security configuration Guide
10 / 42
1.3 Power on
When powering up the server, pay attention to the status LED, ID LED,
and power button on the front control panel of the server. The descriptions
of various indicators are as follows:
Name
Explain
Status indicator LED
Green is always on: the system operates
normally after power on;
Light off: the system is not powered up
normally;
Red is always on: the system is abnormal
ID indicator LED
When confirming the system ID, the indicator
light is always on;
This function needs to be realized by
management software
Power button
System on/off button;
After the system is powered on, the button is
green and bright
If you need to view the startup information during the startup process of
the server through the server serial port, please connect one endof the serial
port line to the client (ordinary PC) and the other end to the serial port on
the front of the server. You also need to install a remote login tool (such as
putty) on your client computer. The putty interface is shown in Figure 1.2:

Inspur server security configuration Guide
11 / 42
Figure 1.2 putty interface
Press the switchbutton on the front control panel of the server, the fan runs,
and the system starts self-test.
1.4 Power off
There are two ways to shut down the server system:
1. The server can be shut down through the operation under the operating
system;
2. The servercan be shut down by manually long pressing the switch button
on the front control panel.
After the above two ways of operation, although the server is no longer
running, some voltages are still available. At this time, the system can be
powered on through remote management. To achieve a complete shutdown,
you need to disconnect the AC power supply of the system (that is, unplug

Inspur server security configuration Guide
12 / 42
the power cord or turn off the power supply plug).

Inspur server security configuration Guide
13 / 42
2Firmware security configuration
2.1 Security configuration of system BIOS
The purpose of this section is to guide the user how to configure the system
BIOS safely. The specific operations include how to restore the BIOS to
the default settings when the system crashes, how to enter the BIOS and
configure various security parameters.
Generally, the factory default settings of the system are optimization
settings. Before understanding the meaning of each parameter, if there is
no special need, it is recommended that you use the default value, and do
not change the parameter settings at will. Because BIOS has a significant
impact on the operation and startup of the system, setting improper
parameters may cause conflicts between hardware resources, or reduce the
performance of the system. In addition, the content of BIOS will change
according to the different configuration of the product or the update of
BIOS version.
Before changing the BIOS settings of the server, please record the
corresponding initial settings, so that when the system is abnormal due to
the modification of options, it can be restored according to the recorded
initial settings.
If you modify some options during the use process and cause the system to

Inspur server security configuration Guide
14 / 42
crash, you can restore the BIOS to the default settings through the clear
CMOS function, which can be realized in two ways:
1. unplug CMOS battery
1) power down the server AC;
2) unplug the CMOS battery and wait for two minutes;
3) replace the CMOS battery and power on the AC.
The CMOS battery and its removal method are shown in Figure 2.1
Figure 2.1 step of removing COMS battery
2. CMOS Jumper
1) power off the server AC;
2) change the main board CMOS jumper from 1, 2 pin short circuit to 2, 3
pin short circuit;
3) restore the CMOS jumper to its original position and power on the AC.
The location of CMOS jumper on the server motherboard is shown in
Figure 2.2:

Inspur server security configuration Guide
15 / 42
Figure 2.2 location of CMOS jumper on main board
(Note: the system time will be reset if the CMOS battery is removed, so
the jumper mode is recommended.)
You can also restore the BIOS function through ‘load default’ option.
When BIOS cannot be started normally due to BIOS configuration error,
an error prompt window will pop up on the screen during BIOS startup,
indicating that you can restore BIOS function by clicking ‘load default’
option.
2.1.1 How to enter BIOS
Power on and start the server. When the logo screen is displayed, the
bottom of the screen will prompt ‘press <del> to setup or <tab> to post or
<F11> to boot menu or <F12> to PXE boot’. Press the <del> key quickly,
and the system will enter the BIOS setting interface.
If the above operations do not enter the setting interface, press <Ctrl> +

Inspur server security configuration Guide
16 / 42
<ALT> + <del> at the same time to restart the system and repeat the above
operations.
According to the above operations, enter the BIOS main interface, as
shown in Figure 2.3.
Figure 2.3
2.1.2 BIOS system menu configuration
The BIOS Setup program includes the following main function menus,
among which the security related options are configured as follows:
Menu name
Menu function
Main
Set basic system time, system date, display BIOS version,
CPU model, system memory capacity and other
information

Inspur server security configuration Guide
17 / 42
Advanced
Set advanced features of CPU, integrated SATA controller,
etc
Chipset
Configure processor, QPI, memory, IIO, PCH, ME and
some general configurations
Server Mgmt
Configure server management features
Security
Configure the super user and user password of the system
Boot
Set the boot order of system devices
Save & Exit
Save BIOS settings, exit BIOS settings, etc.
1. Advanced menu
Figure 2.4
This menu is mainly used to set the enhanced features. If it is not set
properly, it may cause abnormal operation of the system. It is
recommended to use the default settings.
Only the main and common submenus or options are described below.

Inspur server security configuration Guide
18 / 42
1) Trusted Computing
This item displays TPM related information. If your server does not have
a TPM chip, ignore this submenu.
Figure 2.5
If you need to use the TPM feature, set the ‘Security Device Support’
option to ‘Enable’. If you have trusted software business on your server,
please turn on trusted related devices through options such as ‘Storage
Devices’, or turn off trusted devices.
2. Server Mgmt menu

Inspur server security configuration Guide
19 / 42
Figure 2.6
This menu provides setting function items and FRU related information for
system management.
Only the main and common submenus or options are described below.
1) FRB-2 Timer
This itemis used to set whether to start the timing function of FRB-2. There
are two options: [enabled]\[disabled].
2）FRB-2 Timer timeout
This item is used to set the time for starting FRB-2. The default setting is
6 minutes.
3）FRB-2 Timer Policy
This item is used to set the actions that the system will perform after the

Inspur server security configuration Guide
20 / 42
arrival of the time. There are four options: "restart", "reset (default)", "shut
down" and "do nothing".
4）BMC network configuration
This item is used to view the configuration information of BMC network
interface.
Figure 2.7