For AI agents: the complete documentation index is available at https://docs.ovhcloud.com/it/llms.txt, the full documentation bundle is available at https://docs.ovhcloud.com/it/llms-full.txt, and this page is available as Markdown at https://docs.ovhcloud.com/it/guides/hosted-private-cloud/opcp/how-to-sed-unlock-controller.md.

How to unlock the SED drives on a controller

Vedi come Markdown

Find out how to trigger the SED (Self-Encrypting Drive) unlock procedure via the OOB management interface, SSH, or direct keyboard access

Objective

This guide describes the unlock procedure for Self-Encrypting Drives (SED) via the out-of-band (OOB) management interface of an OPCP controller.

There are 3 ways to trigger the unlock, depending on the access you have to the target server:

  • Option 1: OOB HTTP API (curl)
  • Option 2: SSH into the controller
  • Option 3: Direct access on the server (keyboard or KVM)

Requirements

  • An active OPCP platform with SED drives configured.
  • The SED password for the target server, provided by the OVHcloud team upon delivery.
  • Depending on the chosen option: network access to the controller's OOB IP address, SSH access, or physical/console access to the server.

Instructions

Option 1: OOB HTTP API (curl)

1.1 Prerequisites

  • Network access to the controller's OOB IP address.
  • The SED password for the target server.

1.2 Procedure

1. Read the SED password without echoing it to the terminal:

read -s SED_PASSWORD

2. Send the unlock request to the OOB interface:

curl -k -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "action=unlock&psw=$SED_PASSWORD" \
  https://<oob_ip>/

Replace <oob_ip> with the controller's OOB management IP address.

Info

The -k flag is required because the TLS certificate served by the PBA (Pre-Boot Authentication) agent is self-signed and generated locally. The PBA must be able to serve HTTPS before any dependency on the control plane — since no control-plane-issued certificate is available at this stage, -k allows curl to connect without verifying the certificate.

1.3 Expected output

A successful unlock typically returns a confirmation message indicating how many disks were unlocked, followed by a reboot notice.

1.4 Known behavior: partial disk count

The response may include a message such as:

2 of 6 disks unlocked. Rebooting...

This is not necessarily an error. On servers where only 2 disks are OS disks compatible with PBA, the remaining disks are unlocked correctly but are not counted in the final message due to a setMBRDone error.

Info

If the reported count is lower than the total number of disks but matches (or exceeds) the number of PBA-compatible OS disks, this is expected behavior and not a failure condition.

Option 2: SSH into the controller

If you have SSH access to the controller, you can connect directly using the opcp-admin (customer key) private key on port 2222:

ssh -i opcp-admin -p 2222 opcp-admin@<controller_ip>

Replace <controller_ip> with the controller's IP address.

Once connected, you will be prompted to enter the SED password to trigger the unlock from the PBA shell.

Option 3: Direct access on the server (keyboard)

If you have physical (or KVM/console) access to the server, the PBA prompt can be unlocked directly by typing the SED password on the keyboard at the PBA login screen, without going through the network.

This is typically used as a fallback when neither the OOB HTTP API nor SSH access is available.

Go further

For training or technical assistance implementing our solutions, contact your sales representative or visit our Professional Services page to request a quote and have your project analyzed by our experts.

Join our community of users.

Questa pagina ti è stata utile?