IMM configuration restore reports error restoring user account - IBM Flex and Lenovo x86 Servers

Resolving The Problem

Source

RETAIN tip: H214529

Symptom

When restoring the Integrated Management Module (IMM) configuration from a backup file, the process will report an error involving the 'users' command. This may also result in some of the IPMI/SNMP Users from the backup file not being restored on the IMM.

Example of the reported failure:

Affected configurations

The system may be any of the following servers:

• Flex System x240 Compute Node, type 2588, any model, any any model
• Flex System x240 Compute Node, type 7162, any model, any
• Flex System x240 M5 Compute Node, type 2591, any model, any AC1
• Flex System x240 M5 Compute Node, type 9532, any model, any AC1
• Flex System x880 Compute Node, type 4258, any model
• Flex System x880 Compute Node, type 7196, any model, any x880
• Lenovo Flex System x440 Compute Node, 2590 (4-Year Warranty), any model
• Lenovo Flex System x440 Compute Node, type 7167 (3-Year Warranty), any model

This tip is not software specific.

This tip is not option specific.

Solution

This behavior was determined to be working as designed and will not be corrected in a future release of IMM Firmware.

The IMM Backup Restore process will not restore an account if the password does not comply with the current security policy as configured by the CMM.

Workaround

If the Chassis Management Module (CMM) is not configured to provision Node User Accounts then the workaround is to manually delete the IPMI/SNMP Users on the IMM before running the Configuration Restore. There are multiple ways to delete the accounts on the IMM.

1. From the IMM web page navigate to the IMM Management --> Users page. From there select an account and click the delete button.
   
2. From the IMM CLI the command 'users -<account slot#> -clear' will delete the specified account. Use the 'users' command to list the current accounts and their corresponding account slot number.
   

• Resetting the IMM to defaults will clear the IPMI/SNMP User Accounts.
  

If the CMM is configured to provision Node User Accounts, the IMM Configuration Restore will be unable to restore any accounts present in a backup file and will continue to use the accounts provided by the CMM.

Additional information

The issue occurs due to the fact that the configuration restore process does not clear the existing user accounts before restoring the users from the backup file. The CLI command that the restore process uses ('users') does not overwrite an account if one is already present in the specified account slot.

If the existing accounts have the same usernames as the accounts in the backup file the 'users' command will attempt to change the password. If the passwords are the same, to similar, or do not comply with current CMM security policies the command will fail with 'Password too weak, try another'.