3 ms·
BMCs are scary as hell... even for people who say they isolate them, you also need to do a full audit as many come with rubbish default settings. For example,
by wilhil 7y ago
BMCs are scary as hell... even for people who say they isolate them, you also need to do a full audit as many come with rubbish default settings.
For example, Dell's default config on BMC/Idrac (at least 4-5 years ago when I tested) do not have brute force prevention and by default utilising a special CLI program, you can logon to a DRAC from the host OS.
Therefore, if a host got compromised, even if Idrac is on a different network, you could in theory bruteforce from the host credentials and jump/attack the management network.
FYI, for Dell, the command to disable this behaviour was racadm config -g cfgRacTune -o cfgRacTuneLocalConfigDisable 1
and it took quite a while to figure this out...
- EB66 7y ago> by default utilising a special CLI program, you can logon to a DRAC from the host OS ... Therefore, if a host got compromised, even if Idrac is on a different network, you could in theory bruteforce from the host credentials and jump/attack the management network. I'm not sure about a DRAC, but for standard BMC units on Dell/SuperMicro servers I am not aware of anyway that you can actually log into the BMC from the host OS. You can certainly use tools like ipmicfg to reset passwords or configuration on the BMC unit from the host OS, but I don't know of any way that you could actually drop into the command prompt for the BMC and launch an attack on the management network. As long as you have the BMC on a private IP in an entirely independent network (accessible only via VPN), then a utility like ipmicfg wouldn't help you break into it.