4 ms·

"IPMI operates independently of the OS and allows administrators to manage a system remotely even without an OS, system management software, and even if the mon

"IPMI operates independently of the OS and allows administrators to manage a system remotely even without an OS, system management software, and even if the monitored system is powered off (along as it is connected to a power source). IPMI can also function after an OS has started, offering enhanced features when used with system management software." Yikes! Sounds like system management mode in a BIOS!

EvanAnderson 14y ago
It's worse than that. It's not BIOS-- it's a freestanding computer. You'll enjoy this (or be horrified by it): http://fish2.com/ipmi/itrain.html http://fish2.com/ipmi/itrain.html
- rosser 14y ago
  But it's a freestanding computer that means that I don't need to go to the data center at two in the morning to bring up a box that's kernel panicked. Yeah, be careful with it. Firewall it silly. But recognize that it's a tool that can be very useful.
  - EvanAnderson 14y ago
    They're definitely useful tools-- don't get me wrong about that. The fear is that they're controlled, essentially, by an in-band signaling mechanism. Being grafted onto the same NICs on the server computer that you might potentially expose to the Internet makes firewalling them a more difficult proposition. I get a lot of piece of mind from having management interfaces on an an out-of-band control network whenever possible.
    - rosser 14y ago
      If you use your BMC's "pass-through" capability to push its traffic through your regular NICs, you're Doing It Wrong. In fact, if you're not running a separate physical network (not merely separate VLANs) that is, to the extent possible, air-gapped from the rest of the world for your IPMI traffic, you're probably still Doing It Wrong.
bigiain 14y ago
"Yikes! Sounds like system management mode in a BIOS!" Or, "Sounds like an advanced persistent hardware rootkit!"

4 ms·

"IPMI operates independently of the OS and allows administrators to manage a system remotely even without an OS, system management software, and even if the mon

by jevinskie 14y ago

EvanAnderson 14y ago
It's worse than that. It's not BIOS-- it's a freestanding computer. You'll enjoy this (or be horrified by it): http://fish2.com/ipmi/itrain.html http://fish2.com/ipmi/itrain.html
- rosser 14y ago
  But it's a freestanding computer that means that I don't need to go to the data center at two in the morning to bring up a box that's kernel panicked. Yeah, be careful with it. Firewall it silly. But recognize that it's a tool that can be very useful.
  - EvanAnderson 14y ago
    They're definitely useful tools-- don't get me wrong about that. The fear is that they're controlled, essentially, by an in-band signaling mechanism. Being grafted onto the same NICs on the server computer that you might potentially expose to the Internet makes firewalling them a more difficult proposition. I get a lot of piece of mind from having management interfaces on an an out-of-band control network whenever possible.
    - rosser 14y ago
      If you use your BMC's "pass-through" capability to push its traffic through your regular NICs, you're Doing It Wrong. In fact, if you're not running a separate physical network (not merely separate VLANs) that is, to the extent possible, air-gapped from the rest of the world for your IPMI traffic, you're probably still Doing It Wrong.
bigiain 14y ago
"Yikes! Sounds like system management mode in a BIOS!" Or, "Sounds like an advanced persistent hardware rootkit!"