SecurityService
更新时间： 2026/11/04
在AtomGit上查看源码ResourceDefinition
uris
/redfish/v1/Managers/manager_id/SecurityService
properties
| 名称 | 类型 | 是否只读 | 取值范围/枚举值 | 说明 |
|---|---|---|---|---|
| @odata.context | string | true | - | 安全服务资源的OData描述信息 |
| @odata.type | string | true | - | 安全服务资源类型 |
| @odata.id | string | true | - | 安全服务资源的访问路径 |
| Id | string | true | - | 安全服务资源的ID |
| Name | string | true | - | 安全服务资源的名称 |
| SessionTokenLength | number | true | - | Redfish消息Token长度 |
| SecurityControlVersion | number | true | - | 安全控制版本号 |
| MasterKeyUpdateInterval | number | false | - | 主密钥更新间隔 |
| HttpsTransferCertVerification | boolean | false | - | HTTPS传输证书校验使能状态 |
| SOLAutoOSLockEnabled | boolean | false | - | SOL自动OS锁定使能状态说明该接口为预留接口,功能暂未实现 |
| SOLAutoOSLockKey | number | false | - | SOL自动OS锁定密钥说明该接口为预留接口,功能暂未实现 |
| SSHCiphers { | object | false | - | SSH加密算法配置 |
| SSHCiphers.aes128-ctrEnabled | boolean | true | true,false | 是否支持该SSH加密算法 |
SSHCiphers.aes128-gcm@openssh.comEnabled | boolean | true | true,false | 是否支持该SSH加密算法 |
| SSHCiphers.aes192-ctrEnabled | boolean | true | true,false | 是否支持该SSH加密算法 |
| SSHCiphers.aes256-ctrEnabled | boolean | true | true,false | 是否支持该SSH加密算法 |
SSHCiphers.aes256-gcm@openssh.comEnabled | boolean | true | true,false | 是否支持该SSH加密算法 |
SSHCiphers.chacha20-poly1305@openssh.comEnabled | boolean | true | true,false | 是否支持该SSH加密算法 |
| } | ||||
| SSHKexAlgorithms { | object | false | - | SSH密钥交换算法配置 |
SSHKexAlgorithms.curve25519-sha256@libssh.orgEnabled | boolean | true | true,false | 是否支持该SSH密钥交换算法 |
| SSHKexAlgorithms.curve25519-sha256Enabled | boolean | true | true,false | 是否支持该SSH密钥交换算法 |
| SSHKexAlgorithms.diffie-hellman-group-exchange-sha1Enabled | boolean | true | true,false | 是否支持该SSH密钥交换算法 |
| SSHKexAlgorithms.diffie-hellman-group-exchange-sha256Enabled | boolean | true | true,false | 是否支持该SSH密钥交换算法 |
| SSHKexAlgorithms.diffie-hellman-group14-sha1Enabled | boolean | true | true,false | 是否支持该SSH密钥交换算法 |
| SSHKexAlgorithms.diffie-hellman-group16-sha512Enabled | boolean | true | true,false | 是否支持该SSH密钥交换算法 |
| SSHKexAlgorithms.diffie-hellman-group18-sha512Enabled | boolean | true | true,false | 是否支持该SSH密钥交换算法 |
| } | ||||
| SSHMACs { | object | false | - | SSH MAC算法配置 |
SSHMACs.hmac-sha2-256-etm@openssh.comEnabled | boolean | true | true,false | 是否支持该SSH加密算法 |
| SSHMACs.hmac-sha2-256Enabled | boolean | true | true,false | 是否支持该SSH加密算法 |
SSHMACs.hmac-sha2-512-etm@openssh.comEnabled | boolean | true | true,false | 是否支持该SSH加密算法 |
| SSHMACs.hmac-sha2-512Enabled | boolean | true | true,false | 是否支持该SSH加密算法 |
| } | ||||
| SSHHostKeyAlgorithms { | object | false | - | SSH主机密钥算法配置 |
| SSHHostKeyAlgorithms.ecdsa-sha2-nistp256Enabled | boolean | true | true,false | 是否支持该SSH主机密钥算法 |
| SSHHostKeyAlgorithms.ecdsa-sha2-nistp384Enabled | boolean | true | true,false | 是否支持该SSH主机密钥算法 |
| SSHHostKeyAlgorithms.ecdsa-sha2-nistp521Enabled | boolean | true | true,false | 是否支持该SSH主机密钥算法 |
| SSHHostKeyAlgorithms.rsa-sha2-256Enabled | boolean | true | true,false | 是否支持该SSH主机密钥算法 |
| SSHHostKeyAlgorithms.rsa-sha2-512Enabled | boolean | true | true,false | 是否支持该SSH主机密钥算法 |
SSHHostKeyAlgorithms.ssh-ed25519-cert-v01@openssh.comEnabled | boolean | true | true,false | 是否支持该SSH加密算法 |
| SSHHostKeyAlgorithms.ssh-ed25519Enabled | boolean | true | true,false | 是否支持该SSH主机密钥算法 |
SSHHostKeyAlgorithms.ssh-rsa-cert-v01@openssh.comEnabled | boolean | true | true,false | 是否支持该SSH加密算法 |
| SSHHostKeyAlgorithms.ssh-rsaEnabled | boolean | true | true,false | 是否支持该SSH主机密钥算法 |
| } | ||||
| SSLCipherSuites { | object | false | - | SSL加密套件配置 |
| SSLCipherSuites.DHE-RSA-AES128-GCM-SHA256Enabled | boolean | true | true,false | 是否支持该SSL加密套件 |
| SSLCipherSuites.DHE-RSA-AES256-GCM-SHA384Enabled | boolean | true | true,false | 是否支持该SSL加密套件 |
| SSLCipherSuites.ECDHE-ECDSA-AES128-GCM-SHA256Enabled | boolean | true | true,false | 是否支持该SSL加密套件 |
| SSLCipherSuites.ECDHE-ECDSA-AES256-GCM-SHA384Enabled | boolean | true | true,false | 是否支持该SSL加密套件 |
| SSLCipherSuites.ECDHE-RSA-AES128-GCM-SHA256Enabled | boolean | true | true,false | 是否支持该SSL加密套件 |
| SSLCipherSuites.ECDHE-RSA-AES256-GCM-SHA384Enabled | boolean | true | true,false | 是否支持该SSL加密套件 |
| } | ||||
| RMCPCipherSuites { | object | false | - | RMCP加密套件配置 |
| RMCPCipherSuites.CipherSuite1 { | object | true | - | RMPC加密套件配置信息 |
| RMCPCipherSuites.CipherSuite1.Enabled | boolean | true | true,false | 安全服务管理员使用该属性来禁用具有删除用户信息的帐户，当设置为true时，用户可以登录，当设置为false时，该帐户被管理禁用，用户无法登录 |
| } | ||||
| RMCPCipherSuites.CipherSuite17 { | object | true | - | RMPC加密套件配置信息 |
| RMCPCipherSuites.CipherSuite17.Enabled | boolean | true | true,false | 安全服务管理员使用该属性来禁用具有删除用户信息的帐户，当设置为true时，用户可以登录，当设置为false时，该帐户被管理禁用，用户无法登录 |
| } | ||||
| RMCPCipherSuites.CipherSuite2 { | object | true | - | RMPC加密套件配置信息 |
| RMCPCipherSuites.CipherSuite2.Enabled | boolean | true | true,false | 安全服务管理员使用该属性来禁用具有删除用户信息的帐户，当设置为true时，用户可以登录，当设置为false时，该帐户被管理禁用，用户无法登录 |
| } | ||||
| RMCPCipherSuites.CipherSuite3 { | object | true | - | RMPC加密套件配置信息 |
| RMCPCipherSuites.CipherSuite3.Enabled | boolean | true | true,false | 安全服务管理员使用该属性来禁用具有删除用户信息的帐户，当设置为true时，用户可以登录，当设置为false时，该帐户被管理禁用，用户无法登录 |
| } | ||||
| } | ||||
| IPMIChannelAccess { | object | false | - | 带内host或者BMC节点间通信通道允许的最高权限IPMI命令 |
| IPMIChannelAccess.IPMBAccessRole | string | true | - | IPMB通道的访问权限 |
| IPMIChannelAccess.SMSAccessRole | string | true | - | SMS通道的访问权限 |
| } | ||||
| AuthenticationAlgorithm | string | true | - | 加密套件中的认证算法 |
| CertId | number | true | - | 证书Id 说明：CertId取值范围为[1,32], 不再按证书Id区分证书用途，每个证书均可以被Redfish事件订阅或HTTPS协议的远程文件传输使用。 |
| CertUpdateService | object | true | - | 证书更新服务的访问路径 |
| ComponentMeasurementPolicy | string | true | - | 部件度量策略，取值范围： Disabled：不告警不记录日志； LoggingOnly：仅记录日志； LoggingAndAlarm：告警且记录日志。 说明 openUBMC 25.12 LTS及以上版本支持 应用场景：使用TPCM插卡或安全启动支持模型保护的场景，默认值为LoggingOnly； 部分无TPCM插卡的机器但客户可以打开模型保护的机型（920 VD/VE/Pro），默认值为Disabled 不支持TPCM或大模型保护的场景，无此字段与相关功能 |
| ConfidentialityAlgorithm | string | true | - | 加密套件中的加密算法 |
| CrlValidFrom | string | true | - | 证书吊销列表有效期起始日期 |
| CrlValidTo | string | true | - | 证书吊销列表有效期截止日期 |
| DiceCert | object | true | - | DICE证书服务的访问路径 |
| FingerPrint | string | true | - | 证书指纹 |
| HttpsCert | object | true | - | SSL证书服务的访问路径 |
| ICMBAccessRole | string | true | - | 计算节点间通道的访问权限，取值范围：NoAccess、User、Operator、Administrator |
| IntegrityAlgorithm | string | true | - | 加密套件中的校验算法 |
| IntrusionDetectionReportEnabled | boolean | true | - | 是否支持入侵检测事件上报 （注：该属性为只读常量，针对支持入侵检测上报的设备，返回true，表示支持入侵检测上报功能，openUBMC 25.12 LTS及后续版本设备默认支持此能力） |
| IsImportCrl | boolean | true | - | 是否配置证书吊销列表 |
| IssueBy | string | true | - | 颁发者 |
| IssueTo | string | true | - | 使用者 |
| KeyUsage | string | true | - | 秘钥用法 |
| Links | object | true | - | 安全服务列表 |
| PublicKeyLengthBits | number | true | - | 公钥长度 |
| RemoteHttpsServerCertChainInfo[ ] | array | true | - | 远程HTTPS服务器证书链及吊销列表信息 须知 此资源已经废弃，仅供兼容性用途使用。建议使用redfish/v1/Managers/manager_id/Certificates接口进行CA证书查询 自openUBMC 25.12 LTS版本后CA证书升级为资源池，所有BMC业务共用资源池中的CA证书，此接口导入证书会影响到其他包含根证书的接口。共用CA证书业务包括：Syslog、SMTP、LDAP、SSL证书自动更新、远程HTTPS服务器、双因素登录业务 |
| ServerCert | object | true | - | 直接签发远程HTTPS服务器证书的CA证书信息 |
| SignatureAlgorithm | string | true | - | 签名算法 |
| Usage | string | true | - | 证书用途。此字段仅为兼容性使用，所有证书在各个业务均使用，证书不再区分。用途取值如下： Manager CA Certificate |
| ValidFrom | string | true | - | 证书有效起始日期 |
| ValidTo | string | true | - | 证书有效截止日期 |
supported_methods
- GET
- PATCH
- POST
HTTP methods
GET
命令功能
查询服务器当前支持的安全服务集合的信息
说明
该接口为预留接口,功能暂未实现。
json
{
"SOLAutoOSLockKey": 0,
"RemoteHttpsServerCertChainInfo": [
{
"CertId": 1,
"Usage": "EventSubscription",
"ServerCert": {
"IssueBy": "CN=FDCa11, OU=IT, O=xxx, L=SHENZHEN, S=GUANGDONG, C=CN",
"IssueTo": "CN=FDCa12, OU=IT, O=xxx, L=SHENZHEN, S=GUANGDONG, C=CN",
"ValidFrom": "Nov 10 2020 UTC",
"ValidTo": "Nov 10 2030 UTC",
"SerialNumber": "01 23 45 aa c7",
"SignatureAlgorithm": "sha256WithRSAEncryption",
"KeyUsage": "Certificate Sign, CRL Sign",
"PublicKeyLengthBits": 2048,
"FingerPrint": "4859f4e270261522c479762ef7359ea871711a78d2ad3b45dda330bbe571a2ea",
"IsImportCrl": true,
"CrlValidFrom": "Nov 11 2020 UTC",
"CrlValidTo": "Dec 11 2020 UTC"
}
}
],
"Links": {
"HttpsCert": {
"@odata.id": "/redfish/v1/Managers/1/SecurityService/HttpsCert"
},
"CertUpdateService": {
"@odata.id": "/redfish/v1/Managers/1/SecurityService/CertUpdateService"
}
},
"SSHCiphers": {
"aes128-ctrEnabled": true,
"aes192-ctrEnabled": true,
"aes256-ctrEnabled": true,
"aes128-gcm@openssh.comEnabled": true,
"aes256-gcm@openssh.comEnabled": true,
"chacha20-poly1305@openssh.comEnabled": true
},
"SSHKexAlgorithms": {
"curve25519-sha256Enabled": true,
"curve25519-sha256@libssh.orgEnabled": true,
"diffie-hellman-group-exchange-sha256Enabled": true,
"diffie-hellman-group14-sha1Enabled": true,
"diffie-hellman-group16-sha512Enabled": false,
"diffie-hellman-group18-sha512Enabled": false,
"diffie-hellman-group-exchange-sha1Enabled": true
},
"SSHMACs": {
"hmac-sha2-512Enabled": true,
"hmac-sha2-512-etm@openssh.comEnabled": true,
"hmac-sha2-256Enabled": true,
"hmac-sha2-256-etm@openssh.comEnabled": true
},
"SSHHostKeyAlgorithms": {
"ssh-ed25519Enabled": true,
"ssh-ed25519-cert-v01@openssh.comEnabled": true,
"ecdsa-sha2-nistp256Enabled": true,
"ecdsa-sha2-nistp384Enabled": true,
"ecdsa-sha2-nistp521Enabled": true,
"rsa-sha2-256Enabled": true,
"rsa-sha2-512Enabled": true,
"ssh-rsaEnabled": true,
"ssh-rsa-cert-v01@openssh.comEnabled": true
},
"SSLCipherSuites": {
"ECDHE-RSA-AES256-GCM-SHA384Enabled": true,
"ECDHE-ECDSA-AES256-GCM-SHA384Enabled": true,
"DHE-RSA-AES256-GCM-SHA384Enabled": false,
"ECDHE-RSA-AES128-GCM-SHA256Enabled": true,
"ECDHE-ECDSA-AES128-GCM-SHA256Enabled": true,
"DHE-RSA-AES128-GCM-SHA256Enabled": false,
"ECDHE-RSA-CHACHA20-POLY1305Enabled": false,
"DHE-RSA-AES128-CCMEnabled": false,
"DHE-RSA-AES256-CCMEnabled": false,
"DHE-RSA-CHACHA20-POLY1305Enabled": false,
"ECDHE-ECDSA-AES128-CCMEnabled": true,
"ECDHE-ECDSA-AES256-CCMEnabled": true,
"ECDHE-ECDSA-CHACHA20-POLY1305Enabled": true,
"TLS_CHACHA20_POLY1305_SHA256Enabled": true,
"TLS_AES_256_GCM_SHA384Enabled": true,
"TLS_AES_128_GCM_SHA256Enabled": true
},
"RMCPCipherSuites": {
"CipherSuite1": {
"Enabled": true,
"AuthenticationAlgorithm": "RAKP-HMAC-SHA1",
"IntegrityAlgorithm": "None",
"ConfidentialityAlgorithm": "None"
},
"CipherSuite2": {
"Enabled": true,
"AuthenticationAlgorithm": "RAKP-HMAC-SHA1",
"IntegrityAlgorithm": "HMAC-SHA1-96",
"ConfidentialityAlgorithm": "None"
},
"CipherSuite3": {
"Enabled": true,
"AuthenticationAlgorithm": "RAKP-HMAC-SHA1",
"IntegrityAlgorithm": "HMAC-SHA1-96",
"ConfidentialityAlgorithm": "AES-CBC-128"
},
"CipherSuite17": {
"Enabled": true,
"AuthenticationAlgorithm": "RAKP-HMAC-SHA256",
"IntegrityAlgorithm": "HMAC-SHA256-128",
"ConfidentialityAlgorithm": "AES-CBC-128"
}
},
"Actions": {
"#SecurityService.UpdateMasterKey": {
"target": "/redfish/v1/Managers/1/SecurityService/Actions/SecurityService.UpdateMasterKey",
"@Redfish.ActionInfo": "/redfish/v1/Managers/1/SecurityService/UpdateMasterKeyActionInfo"
},
"#SecurityService.ImportRemoteHttpsServerRootCA": {
"target": "/redfish/v1/Managers/1/SecurityService/Actions/SecurityService.ImportRemoteHttpsServerRootCA",
"@Redfish.ActionInfo": "/redfish/v1/Managers/1/SecurityService/ImportRemoteHttpsServerRootCAActionInfo"
},
"#SecurityService.DeleteRemoteHttpsServerRootCA": {
"target": "/redfish/v1/Managers/1/SecurityService/Actions/SecurityService.DeleteRemoteHttpsServerRootCA",
"@Redfish.ActionInfo": "/redfish/v1/Managers/1/SecurityService/DeleteRemoteHttpsServerRootCAActionInfo"
},
"#SecurityService.ImportRemoteHttpsServerCrl": {
"target": "/redfish/v1/Managers/1/SecurityService/Actions/SecurityService.ImportRemoteHttpsServerCrl",
"@Redfish.ActionInfo": "/redfish/v1/Managers/1/SecurityService/ImportRemoteHttpsServerCrlActionInfo"
},
"#SecurityService.DeleteRemoteHttpsServerCrl": {
"target": "/redfish/v1/Managers/1/SecurityService/Actions/SecurityService.DeleteRemoteHttpsServerCrl",
"@Redfish.ActionInfo": "/redfish/v1/Managers/1/SecurityService/DeleteRemoteHttpsServerCrlActionInfo"
}
},
"IPMIChannelAccess": {
"SMSAccessRole": "Administrator",
"IPMBAccessRole": "Administrator"
}
}命令格式
URL: https://device_ip/redfish/v1/Managers/manager_id/SecurityService
请求头:
text
X-Auth-Token: auth_value请求消息体: 无
参数说明
| 参数 | 参数说明 | 取值 |
|---|---|---|
| device_ip | 登录设备的IP地址 | IPv4或IPv6地址 |
| auth_value | 请求消息的鉴权参数 | 可通过/redfish/v1/SessionService/Sessions创建会话时获得 |
使用指南
无
使用实例
请求样例： GET https://device_ip/redfish/v1/Managers/manager_id/SecurityService
X-Auth-Token: auth_value 请求消息体：无
响应样例：
json
{
"@odata.context": "/redfish/v1/$metadata#SecurityService.SecurityService",
"@odata.id": "/redfish/v1/Managers/1/SecurityService",
"@odata.type": "#SecurityService.v1_0_0.SecurityService",
"Id": "SecurityService",
"Name": "Security Service",
"SessionTokenLength": 16,
"SecurityControlVersion": 1,
"MasterKeyUpdateInterval": 0,
"HttpsTransferCertVerification": false,
"SOLAutoOSLockEnabled": false,
"SOLAutoOSLockKey": 0,
"SSHCiphers": {
"aes128-ctrEnabled": true,
"aes192-ctrEnabled": true,
"aes256-ctrEnabled": true,
"aes128-gcm@openssh.comEnabled": true,
"aes256-gcm@openssh.comEnabled": true,
"chacha20-poly1305@openssh.comEnabled": true
},
"SSHKexAlgorithms": {
"curve25519-sha256Enabled": true,
"curve25519-sha256@libssh.orgEnabled": true,
"diffie-hellman-group-exchange-sha256Enabled": true,
"diffie-hellman-group14-sha1Enabled": true,
"diffie-hellman-group16-sha512Enabled": true,
"diffie-hellman-group18-sha512Enabled": true,
"diffie-hellman-group-exchange-sha1Enabled": true
},
"SSHMACs": {
"hmac-sha2-512Enabled": true,
"hmac-sha2-512-etm@openssh.comEnabled": true,
"hmac-sha2-256Enabled": true,
"hmac-sha2-256-etm@openssh.comEnabled": true
},
"SSHHostKeyAlgorithms": {
"ssh-ed25519Enabled": true,
"ssh-ed25519-cert-v01@openssh.comEnabled": true,
"ecdsa-sha2-nistp256Enabled": true,
"ecdsa-sha2-nistp384Enabled": true,
"ecdsa-sha2-nistp521Enabled": true,
"rsa-sha2-256Enabled": true,
"rsa-sha2-512Enabled": true,
"ssh-rsaEnabled": true,
"ssh-rsa-cert-v01@openssh.comEnabled": true
},
"SSLCipherSuites": {
"ECDHE-RSA-AES256-GCM-SHA384Enabled": true,
"ECDHE-ECDSA-AES256-GCM-SHA384Enabled": true,
"DHE-RSA-AES256-GCM-SHA384Enabled": true,
"ECDHE-RSA-AES128-GCM-SHA256Enabled": true,
"ECDHE-ECDSA-AES128-GCM-SHA256Enabled": true,
"DHE-RSA-AES128-GCM-SHA256Enabled": true
},
"RMCPCipherSuites": {
"CipherSuite1": {
"Enabled": true
},
"CipherSuite2": {
"Enabled": true
},
"CipherSuite3": {
"Enabled": true
},
"CipherSuite17": {
"Enabled": true
}
},
"IPMIChannelAccess": {
"SMSAccessRole": "Administrator",
"IPMBAccessRole": "Administrator"
}
}命令格式
URL: https://device_ip/redfish/v1/Managers/manager_id/SecurityService
请求头:
text
X-Auth-Token: auth_value
Content-Type: header_type
If-Match: ifmatch_value请求消息体:
json
{
"SessionTokenLength": tokenlen_value,
"MasterKeyUpdateInterval": interval,
"HttpsTransferCertVerification": verification_value,
"SOLAutoOSLockEnabled": state,
"SOLAutoOSLockKey": key_value,
"SSHCiphers": {
"aes128-ctrEnabled": state,
"aes192-ctrEnabled": state,
"aes256-ctrEnabled": state,
"aes128-gcm@openssh.comEnabled": state,
"aes256-gcm@openssh.comEnabled": state,
"chacha20-poly1305@openssh.comEnabled": state
},
"SSHKexAlgorithms": {
"curve25519-sha256Enabled": state,
"curve25519-sha256@libssh.orgEnabled": state,
"diffie-hellman-group-exchange-sha256Enabled": state,
"diffie-hellman-group14-sha1Enabled": state,
"diffie-hellman-group16-sha512Enabled": state,
"diffie-hellman-group18-sha512Enabled": state,
"diffie-hellman-group-exchange-sha1Enabled": state
},
"SSHMACs": {
"hmac-sha2-512Enabled": state,
"hmac-sha2-512-etm@openssh.comEnabled": state,
"hmac-sha2-256Enabled": state,
"hmac-sha2-256-etm@openssh.comEnabled": state
},
"SSHHostKeyAlgorithms": {
"ssh-ed25519Enabled": state,
"ssh-ed25519-cert-v01@openssh.comEnabled": state,
"ecdsa-sha2-nistp256Enabled": state,
"ecdsa-sha2-nistp384Enabled": state,
"ecdsa-sha2-nistp521Enabled": state,
"rsa-sha2-256Enabled": state,
"rsa-sha2-512Enabled": state,
"ssh-rsaEnabled": state,
"ssh-rsa-cert-v01@openssh.comEnabled": state
},
"SSLCipherSuites": {
"ECDHE-RSA-AES256-GCM-SHA384Enabled": state,
"ECDHE-ECDSA-AES256-GCM-SHA384Enabled": state,
"DHE-RSA-AES256-GCM-SHA384Enabled": state,
"ECDHE-RSA-AES128-GCM-SHA256Enabled": state,
"ECDHE-ECDSA-AES128-GCM-SHA256Enabled": state,
"DHE-RSA-AES128-GCM-SHA256Enabled": state
},
"RMCPCipherSuites": {
"CipherSuite1": {
"Enabled": state
},
"CipherSuite2": {
"Enabled": state
},
"CipherSuite3": {
"Enabled": state
},
"CipherSuite17": {
"Enabled": state
}
},
"IPMIChannelAccess": {
"SMSAccessRole": "Administrator",
"IPMBAccessRole": "Administrator"
}
}请求头参数说明
参见 请求头参数说明
请求体参数说明
| 参数 | 参数说明 | 取值 |
|---|---|---|
| ifmatch_value | 请求消息的匹配参数 | 可通过对相应资源发起GET操作,从响应头中获取（对应于“ETag”参数） |
| tokenlen_value | Redfish消息Token长度 | ● 16：token长度16字节 (32个16进制字符) ● 32：token长度为32字节（64个16进制字符） |
| interval | 主密钥更新间隔 | ● 0 ~365的整数,单位为天 ● 0表示不自动更新主密钥 |
| verification_value | 远程Https服务器证书校验开关 | ● true ● false |
| key_value | SOL的OS自动锁屏按键 | ● 0：组合键ctrl + d ● 1：字符串exit |
| state | SOL的OS自动锁屏使能状态、算法或加密套件的使能状态 | ● true ● false |
使用指南
- 可同时设置多种算法或加密套件的使能状态。
- 若SSL加密套件的使能状态发生变更,需要重启BMC使变更生效。
使用实例
请求样例： PATCH https://device_ip/redfish/v1/Managers/manager_id/SecurityService
X-Auth-Token: auth_value Content-Type: header_type If-Match: ifmatch_value 请求消息体：
json
{
"SessionTokenLength": tokenlen_value,
"MasterKeyUpdateInterval": interval,
"HttpsTransferCertVerification": verification_value,
"SOLAutoOSLockEnabled": state,
"SOLAutoOSLockKey": key_value,
"SSHCiphers": {
"aes128-ctrEnabled": state,
"aes192-ctrEnabled": state,
"aes256-ctrEnabled": state,
"aes128-gcm@openssh.comEnabled": state,
"aes256-gcm@openssh.comEnabled": state,
"chacha20-poly1305@openssh.comEnabled": state
},
"SSHKexAlgorithms": {
"curve25519-sha256Enabled": state,
"curve25519-sha256@libssh.orgEnabled": state,
"diffie-hellman-group-exchange-sha256Enabled": state,
"diffie-hellman-group14-sha1Enabled": state,
"diffie-hellman-group16-sha512Enabled": state,
"diffie-hellman-group18-sha512Enabled": state,
"diffie-hellman-group-exchange-sha1Enabled": state
},
"SSHMACs": {
"hmac-sha2-512Enabled": state,
"hmac-sha2-512-etm@openssh.comEnabled": state,
"hmac-sha2-256Enabled": state,
"hmac-sha2-256-etm@openssh.comEnabled": state
},
"SSHHostKeyAlgorithms": {
"ssh-ed25519Enabled": state,
"ssh-ed25519-cert-v01@openssh.comEnabled": state,
"ecdsa-sha2-nistp256Enabled": state,
"ecdsa-sha2-nistp384Enabled": state,
"ecdsa-sha2-nistp521Enabled": state,
"rsa-sha2-256Enabled": state,
"rsa-sha2-512Enabled": state,
"ssh-rsaEnabled": state,
"ssh-rsa-cert-v01@openssh.comEnabled": state
},
"SSLCipherSuites": {
"ECDHE-RSA-AES256-GCM-SHA384Enabled": state,
"ECDHE-ECDSA-AES256-GCM-SHA384Enabled": state,
"DHE-RSA-AES256-GCM-SHA384Enabled": state,
"ECDHE-RSA-AES128-GCM-SHA256Enabled": state,
"ECDHE-ECDSA-AES128-GCM-SHA256Enabled": state,
"DHE-RSA-AES128-GCM-SHA256Enabled": state
},
"RMCPCipherSuites": {
"CipherSuite1": {
"Enabled": state
},
"CipherSuite2": {
"Enabled": state
},
"CipherSuite3": {
"Enabled": state
},
"CipherSuite17": {
"Enabled": state
}
},
"IPMIChannelAccess": {
"SMSAccessRole": "Administrator",
"IPMBAccessRole": "Administrator"
}
}响应样例：
json
{
"@odata.context": "/redfish/v1/$metadata#Managers/Members/1/SecurityService/$entity",
"@odata.id": "/redfish/v1/Managers/1/SecurityService",
"@odata.type": "#SecurityService.v1_0_0.SecurityService",
"Id": "SecurityService",
"Name": "Security Service",
"SessionTokenLength": 16,
"SecurityControlVersion": 1,
"MasterKeyUpdateInterval": 0,
"HttpsTransferCertVerification": true,
"SOLAutoOSLockEnabled": false,
"SOLAutoOSLockKey": 0,
"RemoteHttpsServerCertChainInfo": [
{
"CertId": 1,
"Usage": "Manager CA Certificate",
"ServerCert": {
"IssueBy": "CN=FDCa11, OU=IT, O=xxx, L=SHENZHEN, S=GUANGDONG, C=CN",
"IssueTo": "CN=FDCa12, OU=IT, O=xxx, L=SHENZHEN, S=GUANGDONG, C=CN",
"ValidFrom": "Nov 10 2020 UTC",
"ValidTo": "Nov 10 2030 UTC",
"SerialNumber": "01 23 45 aa c7",
"SignatureAlgorithm": "sha256WithRSAEncryption",
"KeyUsage": "Certificate Sign, CRL Sign",
"PublicKeyLengthBits": 2048,
"FingerPrint": "4859f4e270261522c479762ef7359ea871711a78d2ad3b45dda330bbe571a2ea",
"IsImportCrl": true,
"CrlValidFrom": "Nov 11 2020 UTC",
"CrlValidTo": "Dec 11 2020 UTC"
}
}
],
"Links": {
"HttpsCert": {
"@odata.id": "/redfish/v1/Managers/1/SecurityService/HttpsCert"
},
"CertUpdateService": {
"@odata.id": "/redfish/v1/Managers/1/SecurityService/CertUpdateService"
}
},
"SSHCiphers": {
"aes128-ctrEnabled": true,
"aes192-ctrEnabled": true,
"aes256-ctrEnabled": true,
"aes128-gcm@openssh.comEnabled": true,
"aes256-gcm@openssh.comEnabled": true,
"chacha20-poly1305@openssh.comEnabled": true
},
"SSHKexAlgorithms": {
"curve25519-sha256Enabled": true,
"curve25519-sha256@libssh.orgEnabled": true,
"diffie-hellman-group-exchange-sha256Enabled": true,
"diffie-hellman-group14-sha1Enabled": true,
"diffie-hellman-group16-sha512Enabled": false,
"diffie-hellman-group18-sha512Enabled": false,
"diffie-hellman-group-exchange-sha1Enabled": true
},
"SSHMACs": {
"hmac-sha2-512Enabled": true,
"hmac-sha2-512-etm@openssh.comEnabled": true,
"hmac-sha2-256Enabled": true,
"hmac-sha2-256-etm@openssh.comEnabled": true
},
"SSHHostKeyAlgorithms": {
"ssh-ed25519Enabled": true,
"ssh-ed25519-cert-v01@openssh.comEnabled": true,
"ecdsa-sha2-nistp256Enabled": true,
"ecdsa-sha2-nistp384Enabled": true,
"ecdsa-sha2-nistp521Enabled": true,
"rsa-sha2-256Enabled": true,
"rsa-sha2-512Enabled": true,
"ssh-rsaEnabled": true,
"ssh-rsa-cert-v01@openssh.comEnabled": true
},
"SSLCipherSuites": {
"ECDHE-RSA-AES256-GCM-SHA384Enabled": true,
"ECDHE-ECDSA-AES256-GCM-SHA384Enabled": true,
"DHE-RSA-AES256-GCM-SHA384Enabled": true,
"ECDHE-RSA-AES128-GCM-SHA256Enabled": true,
"ECDHE-ECDSA-AES128-GCM-SHA256Enabled": true,
"DHE-RSA-AES128-GCM-SHA256Enabled": true
},
"RMCPCipherSuites": {
"CipherSuite1": {
"Enabled": true,
"AuthenticationAlgorithm": "RAKP-HMAC-SHA1",
"IntegrityAlgorithm": "None",
"ConfidentialityAlgorithm": "None"
},
"CipherSuite2": {
"Enabled": true,
"AuthenticationAlgorithm": "RAKP-HMAC-SHA1",
"IntegrityAlgorithm": "HMAC-SHA1-96",
"ConfidentialityAlgorithm": "None"
},
"CipherSuite3": {
"Enabled": true,
"AuthenticationAlgorithm": "RAKP-HMAC-SHA1",
"IntegrityAlgorithm": "HMAC-SHA1-96",
"ConfidentialityAlgorithm": "AES-CBC-128"
},
"CipherSuite17": {
"Enabled": true,
"AuthenticationAlgorithm": "RAKP-HMAC-SHA256",
"IntegrityAlgorithm": "HMAC-SHA256-128",
"ConfidentialityAlgorithm": "AES-CBC-128"
}
},
"Actions": {
"#SecurityService.UpdateMasterKey": {
"target": "/redfish/v1/Managers/1/SecurityService/Actions/SecurityService.UpdateMasterKey",
"@Redfish.ActionInfo": "/redfish/v1/Managers/1/SecurityService/UpdateMasterKeyActionInfo"
},
"#SecurityService.ImportRemoteHttpsServerRootCA": {
"target": "/redfish/v1/Managers/1/SecurityService/Actions/SecurityService.ImportRemoteHttpsServerRootCA",
"@Redfish.ActionInfo": "/redfish/v1/Managers/1/SecurityService/ImportRemoteHttpsServerRootCAActionInfo"
},
"#SecurityService.DeleteRemoteHttpsServerRootCA": {
"target": "/redfish/v1/Managers/1/SecurityService/Actions/SecurityService.DeleteRemoteHttpsServerRootCA",
"@Redfish.ActionInfo": "/redfish/v1/Managers/1/SecurityService/DeleteRemoteHttpsServerRootCAActionInfo"
},
"#SecurityService.ImportRemoteHttpsServerCrl": {
"target": "/redfish/v1/Managers/1/SecurityService/Actions/SecurityService.ImportRemoteHttpsServerCrl",
"@Redfish.ActionInfo": "/redfish/v1/Managers/1/SecurityService/ImportRemoteHttpsServerCrlActionInfo"
},
"#SecurityService.DeleteRemoteHttpsServerCrl": {
"target": "/redfish/v1/Managers/1/SecurityService/Actions/SecurityService.DeleteRemoteHttpsServerCrl",
"@Redfish.ActionInfo": "/redfish/v1/Managers/1/SecurityService/DeleteRemoteHttpsServerCrlActionInfo"
}
},
"IPMIChannelAccess": {
"SMSAccessRole": "Administrator",
"IPMBAccessRole": "Administrator"
}
}响应码：200
POST (ACTION)
UpdateMasterKey
命令功能
更新系统主密钥
命令格式
请求头:
text
X-Auth-Token: auth_value
Content-Type: header_type请求消息体:
json
{}请求头参数说明
参见 请求头参数说明
请求体参数说明
无
使用指南
无
使用实例
X-Auth-Token: auth_value Content-Type: header_type 请求消息体：
json
{}响应样例：
json
{
"@odata.context": "/redfish/v1/$metadata#TaskService/Tasks/Members/$entity",
"@odata.type": "#Task.v1_0_2.Task",
"@odata.id": "/redfish/v1/TaskService/Tasks/2",
"Id": "2",
"Name": "Update Master Key Task",
"Description": "",
"TaskState": "Running",
"TaskStatus": "OK",
"StartTime": "2019-12-28T00:08:29+08:00",
"Messages": [],
"PercentComplete": null,
"Oem": {
"Public": {
"TaskPercentage": null
}
}
}响应码：202
POST (ACTION)
ImportRemoteHttpsServerRootCA
命令功能
导入远程 HTTPS 传输服务器根证书
说明 须知 此资源已经废弃,仅供兼容性用途使用。建议使用redfish/v1/CertificateService接口 进行CA证书/吊销列表管理 自openUBMC 25.12 LTS版本后CA证书升级为资源池,所有BMC业务共用资源池中的CA证 书,此接口导入证书会影响到其他包含根证书的接口。共用CA证书业务包括： Syslog、SMTP、LDAP、SSL证书自动更新、远程HTTPS服务器、双因素登录业务
命令格式
请求头:
text
X-Auth-Token: auth_value
Content-Type: header_type请求消息体:
json
{
"Type": "text",
"Content": crt_text,
"RootCertId": certid_value
}请求头参数说明
参见 请求头参数说明
请求体参数说明
| 参数 | 参数说明 | 取值 |
|---|---|---|
| crt_text | 远程HTTPS传输服务器证书文本 | 远程HTTPS传输服务器证书的文本内容 |
| tmp_uri | 远程HTTPS传输服务器证书的本地路径 | 证书的本地路径,/tmp/ 目录/文件名,文件扩展名必须是“.crt、.cer、.pem” |
| remote_uri | 远程HTTPS传输服务器证书的远程路径 | 远程导入的路径,形如：sftp://user:password@ip/path；目前支持五种传输协议,https、scp、sftp、cifs、nfs,远程文件的扩展名必须是“.crt、.cer、.pem” |
| certid_value | 远程HTTPS传输服务器认证的根证书ID | 数值类型值,取值在1至32之间；每个证书均可以被Redfish事件订阅或HTTPS协议的远程文件传输使用；不指定证书ID时,会自动选择空余的证书ID进行导入 |
| usage_value | 兼容历史功能的参数 | 字符串类型。可选参数。此参数实际不生效,仅作兼容性用途。导入时会自动忽略此参数。 |
使用指南
- 相同用途的证书不允许重复导入；
- 指定证书ID导入时,如果此ID之前已导入一个证书,则会用新证书覆盖旧证书；
使用实例
X-Auth-Token: auth_value Content-Type: header_type 请求消息体：
json
{
"Type": "text",
"Content": crt_text,
"RootCertId": certid_value
}响应样例：
json
{
"error": {
"code": "Base.1.0.GeneralError",
"message": "A general error has occurred. See ExtendedInfo for more information.",
"@Message.ExtendedInfo": [
{
"@odata.type": "#Message.v1_0_0.Message",
"MessageId": "Base.1.0.Success",
"RelatedProperties": [],
"Message": "Successfully Completed Request",
"MessageArgs": [],
"Severity": "OK",
"Resolution": "None"
}
]
}
}响应码：200
POST (ACTION)
DeleteRemoteHttpsServerRootCA
命令功能
删除远程 HTTPS 传输服务器根证书
说明 须知 此资源已经废弃,仅供兼容性用途使用。建议使用redfish/v1/CertificateService接口 进行CA证书/吊销列表管理 自openUBMC 25.12 LTS版本后CA证书升级为资源池,所有BMC业务共用资源池中的CA证 书,此接口导入证书会影响到其他包含根证书的接口。共用CA证书业务包括： Syslog、SMTP、LDAP、SSL证书自动更新、远程HTTPS服务器、双因素登录业务
命令格式
请求头:
text
X-Auth-Token: auth_value
Content-Type: header_type请求消息体:
json
{
"RootCertId": certid_value
}请求头参数说明
参见 请求头参数说明
请求体参数说明
| 参数 | 参数说明 | 取值 |
|---|---|---|
| certid_value | 远程HTTPS传输服务器认证的根证书ID | 数值类型值,取值在1至32之间；且对应的根证书已经导入。 |
使用指南
无
使用实例
X-Auth-Token: auth_value Content-Type: header_type 请求消息体：
json
{
"RootCertId": certid_value
}响应样例：
json
{
"error": {
"code": "Base.1.0.GeneralError",
"message": "A general error has occurred. See ExtendedInfo for more information.",
"@Message.ExtendedInfo": [
{
"@odata.type": "#Message.v1_0_0.Message",
"MessageId": "Base.1.0.Success",
"RelatedProperties": [],
"Message": "Successfully Completed Request",
"MessageArgs": [],
"Severity": "OK",
"Resolution": "None"
}
]
}
}响应码：200
POST (ACTION)
ImportRemoteHttpsServerCrl
命令功能
导入远程 HTTPS 传输服务器根证书的吊销列表
说明 须知 此资源已经废弃,仅供兼容性用途使用。建议使用redfish/v1/CertificateService接口 进行CA证书/吊销列表管理 自openUBMC 25.12 LTS版本后CA证书升级为资源池,所有BMC业务共用资源池中的CA证 书,此接口导入证书会影响到其他包含根证书的接口。共用CA证书业务包括： Syslog、SMTP、LDAP、SSL证书自动更新、远程HTTPS服务器、双因素登录业务
命令格式
请求头:
text
X-Auth-Token: auth_value
Content-Type: header_type请求消息体:
json
{
"Type": "text",
"Content": crl_text,
"RootCertId": certid_value
}请求头参数说明
参见 请求头参数说明
请求体参数说明
无
使用指南
无
使用实例
Content-Type: header_type X-Auth-Token: auth_value 请求消息体：
json
{
"Type": "text",
"Content": crl_text,
"RootCertId": certid_value
}响应码：200