4 ms·

So I keep hearing that the IME can do remote KVM. I've got an old laptop lying around, could I hook at up to my router and access it without remote desktop sof

by Jonnax 7y ago

So I keep hearing that the IME can do remote KVM. I've got an old laptop lying around, could I hook at up to my router and access it without remote desktop software from another PC on my network? Or does this require some expensive intel software with a subscription?

deleted 7y ago
[deleted]
mopsi 7y ago
Standard VNC is enough. If you want other fancy features too (power control, remote media mounting, re-configuration), use Intel Manageability Commander (free): https://downloadcenter.intel.com/download/27807/Intel-Manageability-Commander https://downloadcenter.intel.com/download/27807/Intel-Manage...
- close04 7y ago
  This would be a much better option: https://www.meshcommander.com/meshcommander https://www.meshcommander.com/meshcommander It works if the computer is fully vPro compliant. There are castrated versions of vPro for small businesses that lack the KVM feature. It’s all free and you just need to do the initial provisioning in the MEBx (post UEFI). Again, having the ME in the CPU is not enough. The chipset, NIC, and BIOS/UEFI support matter.
  - snagglegaggle 7y ago
    > The chipset, NIC, and BIOS/UEFI support matter. True but it has been shown a lot of motherboards that should not support these things do, or at least that they are software enabled features.
    - close04 7y ago
      Some do have a subset of features enabled or that can be enabled (maybe, somehow). But my post was not meant to be generic or for a hacker, rather for a person who would like to use a Lenovo T450 with (AMT) KVM. While all Intel CPUs have the ME, this is not enough. The chances of "hacking" the rest of the features on such a system without explicit vPro support are slim to none for all intents and purposes.
vbezhenar 7y ago
Key words: AMT, vPro. You should have compatible CPU and board. Remote KVM is provided via VNC protocol, so any VNC viewer should work. You need to open web interface and proceed from there. Basically it's a business feature and usually not available on consumer laptops.
- rwmj 7y ago
  And very annoyingly not available on the Intel NUC, even though remote-managing those would be very useful. I guess something about not wanting to canabalise their server market. If IME could be reprogrammed then maybe there would be a way to add these features.
  - dleslie 7y ago
    Intel NUC are weird little devices; for my home file server, which at most ever has one user accessing at a time, I replaced an old PC tower with a NUC and a 5 disk USB3 SATA dock. It works better, has excellent Linux support, and uses less power. The device is weird because it strikes me as the perfect HTPC, and yet it isn't really marketed as such.
    - rwmj 7y ago
      I've bought something like 10 of them (the oldest two are Gigabyte Brix, but I'll count those with them). There are a few home servers, but the main use is as a pool of machines to use for oVirt, Open Stack, Kubernetes and RHEL work. The machines get wiped and repurposed quite a bit. They're a lot more convenient for this than actual 19" servers, since they take up a tiny fraction of the space and power of even a single server. However they would be so much more useful if I could remote IPMI into them rather than having to find a monitor, keyboard, HDMI cable and mouse every time I want to fix them. They would also be reasonable for home theatre since they are silent and low power, while at the same time having decent CPUs, but they use Intel graphics so I guess they probably can't drive 4K + 60Hz displays, although I've never actually tried.
      - 7y ago
unixhero 7y ago
I always wondered this and I never ever got to trying it. Ever since Intel introduced vPro.
snagglegaggle 7y ago
Yes. You can do most anything you can do with IPMI which includes loading a CD over the network to reinstall the OS or redirecting the serial port. On newer machines you can set the IME to connect to a IPsec tunnel when some conditions are met and keep the IME enabled when the machine is on battery power and a wireless network. This allows you to administer the device when it is "outside of the office."
- ta999999171 7y ago
  > M.E. > VNC > IPsec tunnel This being the state of enterprise, no wonder every Fortune listed company is getting their doors blown off.
e12e 7y ago
You might find the following helpful, I followed a similar guide for testing on an old laptop a few years back: https://www.cyberciti.biz/faq/remotely-access-intel-amt-kvm-linux-desktop/ https://www.cyberciti.biz/faq/remotely-access-intel-amt-kvm-...

by Jonnax 7y ago

deleted 7y ago

[deleted]

mopsi 7y ago

Standard VNC is enough. If you want other fancy features too (power control, remote media mounting, re-configuration), use Intel Manageability Commander (free): https://downloadcenter.intel.com/download/27807/Intel-Manageability-Commander https://downloadcenter.intel.com/download/27807/Intel-Manage...

close04 7y ago
This would be a much better option: https://www.meshcommander.com/meshcommander https://www.meshcommander.com/meshcommander It works if the computer is fully vPro compliant. There are castrated versions of vPro for small businesses that lack the KVM feature. It’s all free and you just need to do the initial provisioning in the MEBx (post UEFI). Again, having the ME in the CPU is not enough. The chipset, NIC, and BIOS/UEFI support matter.
- snagglegaggle 7y ago
  > The chipset, NIC, and BIOS/UEFI support matter. True but it has been shown a lot of motherboards that should not support these things do, or at least that they are software enabled features.
  - close04 7y ago
    Some do have a subset of features enabled or that can be enabled (maybe, somehow). But my post was not meant to be generic or for a hacker, rather for a person who would like to use a Lenovo T450 with (AMT) KVM. While all Intel CPUs have the ME, this is not enough. The chances of "hacking" the rest of the features on such a system without explicit vPro support are slim to none for all intents and purposes.

vbezhenar 7y ago

Key words: AMT, vPro. You should have compatible CPU and board. Remote KVM is provided via VNC protocol, so any VNC viewer should work. You need to open web interface and proceed from there. Basically it's a business feature and usually not available on consumer laptops.

rwmj 7y ago
And very annoyingly not available on the Intel NUC, even though remote-managing those would be very useful. I guess something about not wanting to canabalise their server market. If IME could be reprogrammed then maybe there would be a way to add these features.
- dleslie 7y ago
  Intel NUC are weird little devices; for my home file server, which at most ever has one user accessing at a time, I replaced an old PC tower with a NUC and a 5 disk USB3 SATA dock. It works better, has excellent Linux support, and uses less power. The device is weird because it strikes me as the perfect HTPC, and yet it isn't really marketed as such.
  - rwmj 7y ago
    I've bought something like 10 of them (the oldest two are Gigabyte Brix, but I'll count those with them). There are a few home servers, but the main use is as a pool of machines to use for oVirt, Open Stack, Kubernetes and RHEL work. The machines get wiped and repurposed quite a bit. They're a lot more convenient for this than actual 19" servers, since they take up a tiny fraction of the space and power of even a single server. However they would be so much more useful if I could remote IPMI into them rather than having to find a monitor, keyboard, HDMI cable and mouse every time I want to fix them. They would also be reasonable for home theatre since they are silent and low power, while at the same time having decent CPUs, but they use Intel graphics so I guess they probably can't drive 4K + 60Hz displays, although I've never actually tried.
    - 7y ago

unixhero 7y ago

I always wondered this and I never ever got to trying it. Ever since Intel introduced vPro.

snagglegaggle 7y ago

Yes. You can do most anything you can do with IPMI which includes loading a CD over the network to reinstall the OS or redirecting the serial port. On newer machines you can set the IME to connect to a IPsec tunnel when some conditions are met and keep the IME enabled when the machine is on battery power and a wireless network. This allows you to administer the device when it is "outside of the office."

ta999999171 7y ago
> M.E. > VNC > IPsec tunnel This being the state of enterprise, no wonder every Fortune listed company is getting their doors blown off.

e12e 7y ago

You might find the following helpful, I followed a similar guide for testing on an old laptop a few years back: https://www.cyberciti.biz/faq/remotely-access-intel-amt-kvm-linux-desktop/ https://www.cyberciti.biz/faq/remotely-access-intel-amt-kvm-...