4 ms·
Why is it banned?
by programmer_dude 4y ago
Why is it banned?
- tadfisher 4y agoHuawei
- tizio13 4y agoChina bad
- darthrupert 4y agoWell that too, but this device does seem to contain a completely undocumented BMC. Which is not the best situation. Whether it's incompetence or malice is difficult to say. https://community.cisco.com/t5/data-center-and-cloud-knowledge/what-is-bmc-and-what-are-the-tasks-of-bmc/ta-p/3115950 https://community.cisco.com/t5/data-center-and-cloud-knowled...
- T3OU-736 4y agoTo be fair, it ia not as if HP's iLo, Dell"s iDrac, or SuperMicro's IPMI are rife with documentation. Granted, there are tools to use them, but the best advice for all IPMI/BMC/OOB things like them is: A. Separate network interface (SuperMicro ships in "shared" mode by default, and, like most defaults, it is in a dire need of changing.) B: No Internet access to or from the IPMI HW. Gateway "bastion" host, one with, say, DHCP, DNS, and NTP services on it, and that is it. DNS forwarder should only resolve a very small set of domains.and IP ranges, and its logs monitored for IOCs. Bonus things: C: (Bonus): NACL isolating IPMIs from each other. Because there is not a good reason for them to talk to each other. D: (Bonus 2): Forward IPMI's syslogs to your syslog server (via the bastion host or, not directly). E: (Bonus 3): Run the https://www.conserver.com/ https://www.conserver.com/ (iDrac and iLo both support serial-over-SSH), for both accountability and console interaction logging. F: (Advanced Bonus): (Cryptographically) Signed FW updates. (Updated: formatting)