iDRAC9 Security Configuration Guide

iDRAC USB Interfaces

For increased security, you can completely disable USB ports. You also have the option of disabling only the USB ports on the front. For example, USB ports can be disabled for production use and then temporarily enabled to grant access to a crash cart for debugging purposes.

iDRAC direct feature allows you to directly connect your laptop or PC USB port to the iDRAC USB port. This allows you to interact directly with iDRAC interfaces (such as Web interface, RACADM, and WSMAN) for advanced server management and servicing.

iDRAC Direct is a special USB port that is hardwired to the iDRAC service processor for at-the-server debugging and management from the front of the server (cold aisle). It allows a user to attach a standard Micro-AB USB cable to this port and the other end (Type A) to a laptop. A standard web browser can then access iDRAC GUI for extensive debugging and management of the server. If iDRAC Enterprise license is installed, the user can even access the OS desktop over iDRAC’s Virtual Console feature. Since normal iDRAC credentials are used for logging in, iDRAC Direct works as a secure “crash cart” with the additional advantage of extensive hardware management and service diagnostics. This can be an attractive option for securing physical access to the server in remote locations (host USB ports and VGA outputs can be disabled in this case).

As a security best practice, it is recommended to disable any unused interface including USB Interfaces.