SSH to iLO (ssh Administrator@<ilo-ip>). SMASH CLP for accounts, static IP, HTTP ISO, power. Legacy cipher: -c aes256-cbc.

If you have SSH to iLO and do not want the web UI, the shell is SMASH CLP (/map1, oemhp_*). This is the iLO 2/3/4 dialect, not Redfish.

Connect

1

ssh Administrator@<ilo-ip>

Old firmware often needs a legacy cipher:

1

ssh -c aes256-cbc Administrator@<ilo-ip>

Accounts

Create a user with the usual admin groups (network changes reset iLO; accounts persist):

1

create /map1/accounts1 username=ops password='<password>' group=admin,config,oemhp_vm,oemhp_rc,oemhp_power

Change the Administrator password on first boot (Administrator / hpinvent is the HP default):

1

set /map1/accounts1/Administrator password='<new-password>'

Network (iLO reboots)

1
2
3

set map1/dhcpendpt1 EnabledState=no
set map1/enetport1/lanendpt1/ipendpt1 IPv4Address=192.168.1.213 SubnetMask=255.255.255.0
set map1/enetport1 SystemName=merlin

After each network set, wait for iLO to come back and SSH to the new address.

Mount an HTTP ISO and boot once

The ISO must be HTTP-reachable from iLO, not from your laptop.

1
2
3

set /map1/oemhp_vm1/cddr1 oemhp_image=http://10.254.0.50/ssp2017.iso
set /map1/oemhp_vm1/cddr1 oemhp_boot=Once
show /map1/oemhp_vm1/cddr1

Power

1
2
3
4

show /system1
start /system1
stop /system1
reset /system1

Ping from iLO

Useful to see whether iLO can reach the management network:

1

oemhp_ping /map1 10.1.1.50

Manual

HP’s CLP tree: iLO scripting and command line.

See also: upgrade firmware over SSH, read the license key.

curl -sk "https://<ilo-ip>/xmldata?item=CpqKey" — license key is in the XML, no UI login.

iLO Advanced is licensed by key. If you inherited a ProLiant and the UI will not open (cert, Java, firmware), the BMC still publishes an inventory XML.

The endpoint

1

curl -sk "https://<ilo-ip>/xmldata?item=CpqKey"

In a browser: https://<ilo-ip>/xmldata?item=CpqKey.

The body is XML with the product and the key (or an unlicensed state). This is not Redfish; it is iLO’s xmldata interface, the one old HP SIM scripts used.

Notes

• -k because the iLO certificate is almost never from a public CA.
• Some iLOs still serve this over HTTP (http://<ilo-ip>/xmldata?item=CpqKey) if HTTPS will not negotiate.
• Treat the key as a secret. Do not commit it or paste it.
• Reading it does not activate anything: it only reads what is already stored on the BMC. Applying a different key is still license in CLP or the UI.

See also: iLO CLI commands.

Serve the .bin over HTTP. Over SSH: load -source http://…/ilofirmware.bin under /map1/firmware1.

When iLO firmware is old enough that browsers refuse its TLS, SSH plus HTTP still works.

1. Serve the .bin over HTTP

iLO pulls the firmware; you do not SCP it in. python3 -m http.server on the management network is enough, or nginx. Use the official HPE ilo*.bin.

2. Log in and load

1
2
3
4

ssh -c aes256-cbc Administrator@<ilo-ip>
show /map1/firmware1
cd /map1/firmware1
load -source http://<http-server>/ilofirmware.bin

-c aes256-cbc is the iLO 2/3 trick: modern OpenSSH will not offer the BMC’s ciphers unless you ask.

show /map1/firmware1 prints the current version before you touch anything. Keep it.

What to expect

• load takes minutes. Do not kill the session.
• iLO reboots itself. The host does not power off (firmware lives on the BMC).
• If HTTP is not reachable from the iLO NIC, load fails with a useless error: oemhp_ping the HTTP server.

After reboot, show /map1/firmware1 again and confirm the version string.

Write-up this is based on: Upgrade HP iLO via SSH.

See also: iLO CLI commands.