syslock 命令
使用此命令可显示和配置系统锁定设置。
语法：
syslock [-options]
| 选项 | 描述 | 值 |
|---|---|---|
| -en | 启用或禁用系统配置锁定功能。 注 使用 | enabled, disabled |
| -e | 启用系统配置锁定设置（无论是否将当前清单强制设为可信快照）。 注 如果没有 | enabled, disabled |
| -l [x] | 列出索引 x 处的特定快照的清单。 | 索引号 x 在命令选项中指定为整数。 |
| -m | 手动拍摄快照。 | |
| -d | 手动快照的说明。 | 最多包含 32 个字符的字符串。 |
| -c | 列出清单与可信快照的差异。 | |
| -po | 设置锁定策略。 注 如果“系统防护”处于不合规状态，此操作将阻止服务器引导。 | none, osboot, pperm |
| -cpu | 设置 CPU 锁定。 | on, off |
| -dimm | 设置 DIMM 锁定。 | on, off |
| -pci | 设置 PCI 锁定。 | on, off |
| -drive | 设置硬盘锁定。 | on, off |
| -riser | 设置转接卡锁定。 | on, off |
| -bp | 设置背板锁定。 | on, off |
To show current status and snapshot list (trusted and history)
system> syslock
Current status: disabled
Policy: none
cpu: off
dXCC: off
pci: off
drive: off
riser: off
bp: off
No snapshot.
System changes have been detected!
Index In Use Date Description
----- -------- ------------------- ----------------
1 Yes 28/01/2022 15:32:59 Enforced by XCCroot.
2 No 28/01/2022 15:28:16 Boot by BMC.
system> syslock
Current status: disabled
Policy: none
cpu: off
dXCC: off
pci: off
drive: off
riser: off
bp: off
To list inventory of specific snapshot
system> syslock -l 1
Location Component ID Description
--------- -------------- ----------------
To enable/disable function.(enable with passphrase, and/or promote current inventory as trusted snapshot):
system> syslock -en enabled
ok
system> syslock -en disabled
ok
system> syslock -en disabled -p Passw0rd12 -e disabled
ok
To take manual snapshot:
system> syslock -m -d xyz
ok
To list inventory difference from trusted snapshot
System>syslock -c
system configuration changes have been detected:
Difference Location ID Description
-------------- ---------- --------------- ----------------------------------------------------------------
New device Drive 13 S0K2QRYC Drive 13, IBM-ESXS, 300GB 10K 6Gbps SAS 2.5"
To set lockdown policy:
system> syslock -po none/pperm/osboot
To set lockdown components:
system>syslock -cpu <on | off>
system>syslock -dXCC <on | off>
system>syslock -pci <on | off>
system>syslock -drive <on | off>
system>syslock -tpm <on | off>
system>syslock -riser <on | off>
system>syslock -bp <on | off>
system>syslock -board <on | off>
system>syslock -psu <on | off>
system>syslock -fan <on | off>
system>syslock -xccfw <on | off>
system>syslock -uefifw <on | off>
提供反馈