3 ms·

Only speaking for ASRockRACK, the situation is not much better with regards to firmware updates or confidence in IPMI security. Oh, and there's a fishy undocume

by 3np 1y ago

Only speaking for ASRockRACK, the situation is not much better with regards to firmware updates or confidence in IPMI security. Oh, and there's a fishy undocumented preconfigured second Admin account you have to go into user management to spot... Thank for alleviating buyers remorse as the grass seemed greener at SuperMicro ;^^ > They still seem to have ridiculous LAN sharing of IPMI, which means that even if you set their IPMI to use the dedicated NIC, and setup an isolated network, a loss of defaults means your IPMI is now no longer on that network but sharing the NIC on your main network. This sounds partilularly weird though, if I am reading it right. Are you saying the BMC will bridge IPMI over multiple NICs in default configuration? And that there is no setup that safely and consistently binds the IPMI to a single NIC? Isolating management to a dedicated network continues to be part of basic security and it's very surprising to hear that this would not be a supported use-case by SuperMicro...

b112 1y ago
This sounds partilularly weird though, if I am reading it right. Are you saying the BMC will bridge IPMI over multiple NICs in default configuration? And that there is no setup that safely and consistently binds the IPMI to a single NIC? By default, their servers have a 'failover' mode for the main NIC. This means that when the server gets power, and IPMI boots, if the IPMI NIC doesn't have a link it will then share connectivity with the main NIC. # To get LAN mode: ipmitool raw 0x30 0x70 0x0c 0 # 00 = dedicated, 01 = share, 02 = failover # To set, use 0|1|2: ipmitool raw 0x30 0x70 0x0c 1 <value> You can set it to 'dedicated', but sometimes that's buggy and the setting can get lost. I've had it happen. And it defaults to failover on most servers I've bought, so a dead bios battery means the same outcome. And if you're not aware, and leave it at failover, your dedicated IPMI LAN switch dies, then next boot all your stuff is exposed. From what I've read, this is still the same in 2025. I'd really have preferred a jumper for something this insanely unsecure. Thanks for the FYI on AsRockRACK. Have you had any firmware updates for IPMI with them, however?
- 3np 1y ago
  That sucks. If it were me I'd suck it up and consider that I now have two dedicated IPMI NICs with failover and attach new ones if needed for system network... > Thanks for the FYI on AsRockRACK. NP. FWIW at least I think the BMC networking doesn't have the kind of failure mode you're describing. > Have you had any firmware updates for IPMI with them, however? Yeah, they have unofficial newer "beta" versions that you will get a private download link for over email if you contact support and ask for it. Same if you want fixes for UEFI or AMD firmware vulnerabilities more than a year or so after board release. Thinking about supply-chain security when flashing those make me a bit nauseous... The industry seems to be stuck with 90s mindset and processes.

by 3np 1y ago

b112 1y ago

This sounds partilularly weird though, if I am reading it right. Are you saying the BMC will bridge IPMI over multiple NICs in default configuration? And that there is no setup that safely and consistently binds the IPMI to a single NIC? By default, their servers have a 'failover' mode for the main NIC. This means that when the server gets power, and IPMI boots, if the IPMI NIC doesn't have a link it will then share connectivity with the main NIC. # To get LAN mode: ipmitool raw 0x30 0x70 0x0c 0 # 00 = dedicated, 01 = share, 02 = failover # To set, use 0|1|2: ipmitool raw 0x30 0x70 0x0c 1 <value> You can set it to 'dedicated', but sometimes that's buggy and the setting can get lost. I've had it happen. And it defaults to failover on most servers I've bought, so a dead bios battery means the same outcome. And if you're not aware, and leave it at failover, your dedicated IPMI LAN switch dies, then next boot all your stuff is exposed. From what I've read, this is still the same in 2025. I'd really have preferred a jumper for something this insanely unsecure. Thanks for the FYI on AsRockRACK. Have you had any firmware updates for IPMI with them, however?

3np 1y ago
That sucks. If it were me I'd suck it up and consider that I now have two dedicated IPMI NICs with failover and attach new ones if needed for system network... > Thanks for the FYI on AsRockRACK. NP. FWIW at least I think the BMC networking doesn't have the kind of failure mode you're describing. > Have you had any firmware updates for IPMI with them, however? Yeah, they have unofficial newer "beta" versions that you will get a private download link for over email if you contact support and ask for it. Same if you want fixes for UEFI or AMD firmware vulnerabilities more than a year or so after board release. Thinking about supply-chain security when flashing those make me a bit nauseous... The industry seems to be stuck with 90s mindset and processes.