4 ms·
IPMI is fantastic, so long that the understanding is in place that access to your IPMI vlan may as well be considered root access to the node. BMCs tend to be p
by subway 9y ago
IPMI is fantastic, so long that the understanding is in place that access to your IPMI vlan may as well be considered root access to the node. BMCs tend to be pretty miserable when it comes to security. It's generally a good idea to have ACLs in place to ensure BMCs can only communicate with a secured management node, and importantly that BMCs cannot communicate with each other.
- nullc 9y agoBack when boards kept the IPMI on a separate interface it was easy to isolate them, including shutting down all port to port traffic on a switch. Now, on many motherboards the BMC stuff will aggressively talk in-band even if you think you've disabled that.
- angry_octet 9y agoAnd even if all the dedicated IPMI ports are on a separate switch, if you have root on one box, you can attack another via the IPMI network. You have to put ACLs on the switch to prevent traffic except to the admin node.