4 ms·
IDRAC still uses non-ssl connection for fetching upgrades by default. They all seem so bad on many levels regarding security without even diving deep. I hope s
by comboy 4y ago
IDRAC still uses non-ssl connection for fetching upgrades by default. They all seem so bad on many levels regarding security without even diving deep.
I hope safe virtualization (where host can't access guest stuff) become a standard for hardware, but it still feels backward.
- yjftsjthsd-h 4y agoAny chance the updates are signed (w/ PGP or such)? There are ways to make non-ssl safe-ish, and I can kind of accept not wanting a system that depends on an accurate clock and current root certs.
- pixl97 4y agoImagine the current scenario. Version 1: Secure, currently in use. Version 2: Insecure. Known RCE. Version 3: Secure. Version 2 in this case is a signed update that is valid from the vendor, but adds a remote exploit that the attacker performing the MITM can then exploit.
- yjftsjthsd-h 4y agoFair point; I suppose I should have said safer; GPG gives you authenticity with lower requirements, but is generally inferior to HTTPS. I suppose the ideal would be to do both HTTPS and PGP so you can degrade gracefully if the user says to (or in case of offline update).
- sebazzz 4y agoIs there a self-update function in iDRAC? I never noticed it. I always use the clunky Dell upgrade packages.
- comboy 4y agoPerhaps this is what you should do. Here's wonderful article about updating over HTTPS[1]. Do remember about important option to choose - when certificate is expired or invalid, action must be set to "Ignore" if you want to update over HTTPS. Enterprise solutions always amaze me in unexpected ways. 1. https://www.dell.com/support/kbdoc/en-us/000130533/dell-poweredge-how-to-update-the-firmware-via-https-connection-to-idrac?lwp=rt https://www.dell.com/support/kbdoc/en-us/000130533/dell-powe...