5 ms·

> should never be exposed to the internet Good luck with that, on many devices the BMC gets silently bridged onto the lan ports even if you make a significant

by nullc 7y ago

> should never be exposed to the internet Good luck with that, on many devices the BMC gets silently bridged onto the lan ports even if you make a significant effort to prevent it. Even where you think you have it isolated and have tested, you may later find yourself thwarted when an unoverridable bridge gets triggered any time the dedicated BMC port's link is down.

nightfly 7y ago
Having static IPs on your management devices on a separate subnet and vlan from your regular host ports should mostly mitigate this.
- persistent 7y ago
  How? The BMC can intercept and inject any ethernet frames that it cares to inject.
  - jessaustin 7y ago
    What happens to those frames? Will a router configured for a particular VLAN pass through whatever the BMC happens to invent?
  - EB66 7y ago
    Not when you've gone into the BIOS and configured the BMC to only operate on it's dedicated port. I'm responsible for netsec at my company and I've never seen any indication of the BMC network activity on primary network ports after I've configured the BMC in BIOS to use it's dedicated network port.
EB66 7y ago
> Good luck with that, on many devices the BMC gets silently bridged onto the lan ports even if you make a significant effort to prevent it. I don't think that's true. I can't speak for all devices, but I've worked with a lot of Dell and SuperMicro servers and they all have an option in the BIOS for this. You specify if the BMC should operate on it's own dedicated network port or share the network port used for primary network uplink. From the network traffic logs I've gathered, I've never seen any indication of the BMC interfering with the primary LAN ports when the BMC is set to use the dedicated LAN port. Additionally, the BMC doesn't revert back to the shared port if the link is broken on the dedicated port -- the BIOS setting prevents that. At my company we've configured all of the BMCs to use the dedicated LAN port, those LAN ports are connected to physically separate top of cabinet switches, and those switches are linked to a fully independent core router with it's own independent uplink to the internet. The BMCs are only assigned private network IPs and can only be accessed by outside users through a VPN. This is all very standard practice for the hosting industry.
- nullc 7y ago
  > I can't speak for all devices, but I've worked with a lot of Dell and SuperMicro servers and they all have an option in the BIOS for this. You specify if the BMC should operate on it's own dedicated network port or share the network port used for primary network uplink. They do, but on the three supermicro board types I have here, simply doing that but then leaving the BMC port disconnected results in them bridging onto the lan anyways. They obey the setting but only so long as a link is up on the BMC port.
z3t4 7y ago
For example your server might have 3 network ports, one is a dedicated BMC, but if it's not populated it will bridge to one of the other two, so basically you only have 1 port that is safe to use.

by nullc 7y ago

nightfly 7y ago

Having static IPs on your management devices on a separate subnet and vlan from your regular host ports should mostly mitigate this.

persistent 7y ago
How? The BMC can intercept and inject any ethernet frames that it cares to inject.
- jessaustin 7y ago
  What happens to those frames? Will a router configured for a particular VLAN pass through whatever the BMC happens to invent?
- EB66 7y ago
  Not when you've gone into the BIOS and configured the BMC to only operate on it's dedicated port. I'm responsible for netsec at my company and I've never seen any indication of the BMC network activity on primary network ports after I've configured the BMC in BIOS to use it's dedicated network port.

EB66 7y ago

> Good luck with that, on many devices the BMC gets silently bridged onto the lan ports even if you make a significant effort to prevent it. I don't think that's true. I can't speak for all devices, but I've worked with a lot of Dell and SuperMicro servers and they all have an option in the BIOS for this. You specify if the BMC should operate on it's own dedicated network port or share the network port used for primary network uplink. From the network traffic logs I've gathered, I've never seen any indication of the BMC interfering with the primary LAN ports when the BMC is set to use the dedicated LAN port. Additionally, the BMC doesn't revert back to the shared port if the link is broken on the dedicated port -- the BIOS setting prevents that. At my company we've configured all of the BMCs to use the dedicated LAN port, those LAN ports are connected to physically separate top of cabinet switches, and those switches are linked to a fully independent core router with it's own independent uplink to the internet. The BMCs are only assigned private network IPs and can only be accessed by outside users through a VPN. This is all very standard practice for the hosting industry.

nullc 7y ago
> I can't speak for all devices, but I've worked with a lot of Dell and SuperMicro servers and they all have an option in the BIOS for this. You specify if the BMC should operate on it's own dedicated network port or share the network port used for primary network uplink. They do, but on the three supermicro board types I have here, simply doing that but then leaving the BMC port disconnected results in them bridging onto the lan anyways. They obey the setting but only so long as a link is up on the BMC port.

z3t4 7y ago

For example your server might have 3 network ports, one is a dedicated BMC, but if it's not populated it will bridge to one of the other two, so basically you only have 1 port that is safe to use.