3 ms·

I agree with your overall conclusions, but I am having a hard time imagining the 'normal users' who would use remote administration... though perhaps if that we

I agree with your overall conclusions, but I am having a hard time imagining the 'normal users' who would use remote administration... though perhaps if that were normal-for-HN users...

rwmj 9y ago
I guess I'm "Normal-for-HN". IPMI is so useful that I wouldn't buy a server without it, even one I'm going to use in the same building.
- subway 9y ago
  IPMI is fantastic, so long that the understanding is in place that access to your IPMI vlan may as well be considered root access to the node. BMCs tend to be pretty miserable when it comes to security. It's generally a good idea to have ACLs in place to ensure BMCs can only communicate with a secured management node, and importantly that BMCs cannot communicate with each other.
  - nullc 9y ago
    Back when boards kept the IPMI on a separate interface it was easy to isolate them, including shutting down all port to port traffic on a switch. Now, on many motherboards the BMC stuff will aggressively talk in-band even if you think you've disabled that.
    - angry_octet 9y ago
      And even if all the dedicated IPMI ports are on a separate switch, if you have root on one box, you can attack another via the IPMI network. You have to put ACLs on the switch to prevent traffic except to the admin node.
inetknght 9y ago
If you have a hard time imagining normal users who would use this, then I suggest you grow your imagination and teach users what possibilities there are.
- blacksmith_tb 9y ago
  Normal users can be sold on the idea of devices talking to each other (though in the case of Bluetooth I'd say it may have soured them on the whole thing). But I'd still say that even convincing a non-dev that wake-on-lan would be handy for them is a stretch, let alone more... Also I'm not sure how much evangelism is really appropriate - I may think that shelling into my headless server at home is great, but if you are happy with just cat videos, who am I to say you need to do more?
derefr 9y ago
Whenever my HTPC gets borked (it's a Hackintosh, it gets borked a lot), I regret not buying a "Q" motherboard. As it is, to fix the box, I have to temporarily switch the HDMI cable to the internal graphics, plug in a USB keyboard and mouse, and then sit down in front of it on the floor, craning my head to look at my TV beside it. With AMT access, I just could remote into the BIOS from my laptop on my couch.

I agree with your overall conclusions, but I am having a hard time imagining the 'normal users' who would use remote administration... though perhaps if that were normal-for-HN users...

rwmj 9y ago

I guess I'm "Normal-for-HN". IPMI is so useful that I wouldn't buy a server without it, even one I'm going to use in the same building.

subway 9y ago
IPMI is fantastic, so long that the understanding is in place that access to your IPMI vlan may as well be considered root access to the node. BMCs tend to be pretty miserable when it comes to security. It's generally a good idea to have ACLs in place to ensure BMCs can only communicate with a secured management node, and importantly that BMCs cannot communicate with each other.
- nullc 9y ago
  Back when boards kept the IPMI on a separate interface it was easy to isolate them, including shutting down all port to port traffic on a switch. Now, on many motherboards the BMC stuff will aggressively talk in-band even if you think you've disabled that.
  - angry_octet 9y ago
    And even if all the dedicated IPMI ports are on a separate switch, if you have root on one box, you can attack another via the IPMI network. You have to put ACLs on the switch to prevent traffic except to the admin node.

inetknght 9y ago

If you have a hard time imagining normal users who would use this, then I suggest you grow your imagination and teach users what possibilities there are.

blacksmith_tb 9y ago
Normal users can be sold on the idea of devices talking to each other (though in the case of Bluetooth I'd say it may have soured them on the whole thing). But I'd still say that even convincing a non-dev that wake-on-lan would be handy for them is a stretch, let alone more... Also I'm not sure how much evangelism is really appropriate - I may think that shelling into my headless server at home is great, but if you are happy with just cat videos, who am I to say you need to do more?

derefr 9y ago

Whenever my HTPC gets borked (it's a Hackintosh, it gets borked a lot), I regret not buying a "Q" motherboard. As it is, to fix the box, I have to temporarily switch the HDMI cable to the internal graphics, plug in a USB keyboard and mouse, and then sit down in front of it on the floor, craning my head to look at my TV beside it. With AMT access, I just could remote into the BIOS from my laptop on my couch.