3 ms·
If your IPMI is in any way exposed to anyone other than your administrators, then you have other problems. These interfaces should be segmented away from all ot
by greggsy 3y ago
If your IPMI is in any way exposed to anyone other than your administrators, then you have other problems. These interfaces should be segmented away from all other networks, irrespective of any vulnerabilities they could have.
- jwiz 3y agoSome supermicro will default to put IPMI on the shared primary nic if the dedicated IPMI nic has no link at poweron.
- SoftTalker 3y agoSome? Every one that I’ve ever worked with, which is several hundred.
- KennyBlanken 3y agoand why would IPMI port ranges and IP addresses be accessible outside of the DMZ, if you're an even half competent sysadmin?
- c00lio 3y agoIf you are halfway competent, you do not use inband IPMI at all. IPMI belongs on a separate ethernet jack or at least a separate VLAN, connected only to a separate secured admin network. Which sysadmins can connect to, but which doesn't have connectivity to other parts of your network or the internet. But I agree that you should filter all the relevant ports in all networks, just in case somebody screws up.
- dicknuckle 3y agoThat's great and all, but if there was a known barracuda OS vuln that allowed attackers to gain root access, then they could gather information about the hardware, which includes the ability to interact with the IPMI (which runs it's own separate OS) to update the firmware or whichever way they're able gain persistent access to the IPMI device's OS.