{
  "port": 1311,
  "protocol": "tcp",
  "service": "Dell OpenManage Server Administrator",
  "oneLiner": "The HTTPS web console for Dell OpenManage Server Administrator — a server's hardware admin plane.",
  "whatItIs": "Dell OpenManage Server Administrator (OMSA) runs an embedded web server on TCP 1311 and serves its console over HTTPS at https://host:1311. Through it an authenticated operator reads hardware health, RAID and firmware state, and performs management actions on a PowerEdge server. The IANA registration for 1311 is the unrelated \"RxMon\", so on a scan of Dell hardware treat 1311 as OMSA. Its presence marks the host as a physical Dell server with the management agent installed.",
  "exposure": {
    "verdict": "never",
    "note": "This is a hardware administration console with credentials in front of it; OMSA has a history of remotely exploitable CVEs and belongs on a management VLAN, never on the internet."
  },
  "checkCommand": "openssl s_client -connect TARGET:1311 -servername TARGET </dev/null",
  "links": [
    {
      "title": "Dell — Support for OpenManage Server Administrator (OMSA), web console on port 1311",
      "url": "https://www.dell.com/support/kbdoc/en-us/000132087/support-for-dell-emc-openmanage-server-administrator-omsa",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}