40 ms·
> IPMI is very common in enterprise servers but very rare elsewhere, much to the consternation of people like me that don't have the space or noise tolerance fo
by neilv 2y ago
> IPMI is very common in enterprise servers but very rare elsewhere, much to the consternation of people like me that don't have the space or noise tolerance for a 1U pizzabox in their homes. If you are trying to stick to compact or low-power computers, you'll pretty much have to go without.
One option: you can get IPMI on an Atom-based Supermicro MicroATX board that can be cooled quietly with a small Noctua fan, in a short-depth 1U chassis.
I have an older one at home. The quietness and small size made it much more attractive than the Dell R2x0 models I saw. And it has server features like IPMI and ECC RAM that made it more attractive than a mini-PC, and it was also more reliable than a flimsy RasPi. (I'd be happy with a Dell quiet short-depth 1U with comparable characteristics, but I'm not aware of one.)
Personally, I wouldn't plug the IPMI port into my main LAN, but it's come in handy isolated from that, and was also a little fun to play with.
- organsnyder 2y agoI keep my IPMI and other management interfaces segregated to a separate management VLAN that's only accessible via a dedicated VPN.
- pabs3 2y agoThat isn't enough, some implementations are also always or fallback to using the main NIC transparently in parallel to the host CPU use of it.
- temp0826 2y agoThis is probably the minimum you should do. I remember a time when IPMI on (some?) Supermicro boards was really really insecure. From the IPMI client, you could set the encryption mode to "0" ("null encryption" or something, I dunno it's been years)- setting it allowed you to bypass the password completely. Assume if you can touch the IPMI, the system is yours.
- crest 2y agoIPMI is still a festering cesspool no matter which vendor. Assume that layer 3 access to the IPMI grants you unrestricted persistent code execution on the managed system and design for with it in mind. Restrict access as tightly as possible. If you only need to power up/down/reset the system and access the serial console most IPMI implementations expose that via SSH. A small SSH proxy that exposes only those features would be a good investment. e.g. `ssh bastion [status|up|down|cycle|reset|console] <server>`. You could probably write it in <100 lines as SSH forced command. Deploy the SSH client to a different VRF (aka network namespace/vnet jail/rdomain) than the SSH server to make it harder to leak traffic from the bastion.
- throwaway984393 2y ago[dead]
- nyrikki 2y agoThat was Dell iDRAC boards had a bug, where while they asked for a password, they would accept ANY password. IPMI is like typical IoT, a rarely updated full system with often questionable code quality. Private VLANs and separate interfaces on dedicated ports is not out of line. Often shared interfaces with vlan isolation depends on the IPMI honoring that isolation. By Private VLANs I am talking about RFC 5517 style, a switch level feature where IPMI cannot reach other IPMI interfaces.
- doublepg23 2y agoThere's ASRock Rack boards with X470, X570, X670, etc. chipsets that take standard AM4/AM5 chips and have loads of server features like IPMI and ECC (I think that's already common on the AMD side). I managed to snag a 5950x to throw into mine but I was rocking a 5600G for a while. They're mATX/ATX too so they'll fit in a regular case and take a regular power supply - no racks needed!
- dboreham 2y agoWe have a bunch of those atom boards. It was the first thought I had reading the article, which takes a while to say that IPMI means large machines.