christianmanivong
0052ba7884
An `amt` driver (napalm_amt.AmtDriver), a ManagementControllerDriver for the management controller of Intel vPro machines, with its own lean WS-Management client (requests + ElementTree, HTTP Digest, ports 16992/16993). It reads the machine's identity, hardware with the SMBIOS system UUID, firmware (AMT with build, BIOS), power state and the hardware event log, reports what AMT listens on (plain HTTP or TLS, KVM incl. port 5900, IDE-R), and switches the machine's power. AMT cannot be reset over WS-Management, so there is no reboot_host. Discovery recognises AMT by its ports and its Server header. Tested against Intel's published AMT 12 recordings (go-wsman-messages, Apache-2.0, see NOTICE). `python -m napalm_amt.record` records a real AMT read-only; the first test devices are two Lenovo ThinkCentre M910x.
55 lines
2.7 KiB
Markdown
55 lines
2.7 KiB
Markdown
# First test devices: Lenovo ThinkCentre M910x
|
|
|
|
Two ThinkCentre M910x (Tiny, Intel Q270, vPro) with Intel ME/AMT 11.x, plus possibly a
|
|
third to experiment on. Nothing has been recorded from them yet; the driver is tested
|
|
against Intel's AMT 12 recordings (see [testing.md](testing.md)).
|
|
|
|
## Setting up AMT
|
|
|
|
Menu names vary between BIOS and ME firmware versions.
|
|
|
|
1. **BIOS** (F1): under *Advanced → Intel Manageability*, enable Intel Manageability
|
|
Control and the Ctrl+P prompt for MEBx.
|
|
2. **MEBx** (Ctrl+P at boot): log in with the default password `admin` and set a new one
|
|
(8 to 32 characters with upper and lower case, a digit and a special character).
|
|
3. *Intel AMT Configuration → Manageability Feature Selection*: enabled.
|
|
4. *Network Setup → TCP/IP Settings → Wired LAN IPv4*: **turn DHCP off** and give AMT a
|
|
**static address of its own**, with mask, gateway and DNS. In DHCP mode AMT uses the
|
|
operating system's address, and netOrk keeps one device per address.
|
|
5. *Network Access State*: activate network access.
|
|
6. *User Consent*: for KVM without a code from the person at the machine, set opt-in to
|
|
none. Admin Control Mode, which manual MEBx setup gives, allows that.
|
|
7. *Redirection Features*: SOL, storage redirection (IDE-R) and KVM as wanted.
|
|
|
|
Afterwards `http://<amt-ip>:16992/` answers with AMT's web UI, and the `Server` header
|
|
names the version.
|
|
|
|
## Recording
|
|
|
|
From a machine that reaches AMT, with the password in a file:
|
|
|
|
```bash
|
|
python -m napalm_amt.record <amt-ip> --user admin --password-file ~/.amt-m910x \
|
|
--out tests/fixtures/lenovo-m910x-<amt-version>
|
|
```
|
|
|
|
The recorder only reads (see [testing.md](testing.md)). It redacts the provisioning OTP
|
|
and the RFB password and keeps serial numbers.
|
|
|
|
## What the recordings have to settle
|
|
|
|
These are assumptions the driver makes from Intel's AMT 12 recordings and documentation:
|
|
|
|
- [ ] **System UUID byte order.** `get_hardware_inventory()["system_uuid"]` should equal
|
|
`dmidecode -s system-uuid` on the machine's OS. netOrk links AMT to its host by it.
|
|
- [ ] **Chassis versus board.** Whether `CIM_Chassis.Model` holds Lenovo's machine type
|
|
(`10MU…`) and `CIM_Card` the board.
|
|
- [ ] **Event log timestamps.** Taken as UTC. Some AMT versions keep local time.
|
|
- [ ] **Drives.** Whether AMT 11 lists `CIM_MediaAccessDevice` at all.
|
|
- [ ] **Graceful power states.** Whether AMT lists 12 and 14 with the OS running, and
|
|
whether that needs the Intel ME driver (LMS) on the host.
|
|
- [ ] **Sleep.** A sleeping machine is reported as Off. Check that On wakes it.
|
|
- [ ] **Static address.** `AMT_EthernetPortSettings.IPAddress` present with a static
|
|
configuration.
|
|
- [ ] **AMT version and CVE state.** Which 11.8 build Lenovo's latest ME firmware gives.
|