# Security

A BMC can power a server off, mount virtual media and open a remote console. Its
credentials are worth as much as root on every machine it manages.

## Credentials

- Use a dedicated BMC account for netOrk, not the factory administrator. A read-only role
  (Redfish `ReadOnly`) suffices for everything except power control, which needs
  `Operator`.
- netOrk's credential gating applies unchanged: no job without credentials.
- Close Redfish sessions after each poll. BMCs allow few concurrent sessions, and a leaked
  session can lock the web UI out.

## IPMI over LAN

- IPMI 2.0's RAKP handshake returns a salted hash of the user's password to any client that
  names a valid user, before authentication (CVE-2013-4786). The hash can be cracked
  offline. This is part of the protocol, not a bug a firmware update fixes.
- Cipher suite 0 (no authentication) is enabled on some BMCs and allows login with any
  password.
- So the `ipmi` entry point is a fallback only. It switches the server's power, because
  some boards (a Supermicro X10 without a Redfish license) offer nothing else, but it does
  not reset the BMC. `get_management_protocols`
  reporting `IPMI.ProtocolEnabled = true` should become a finding in netOrk, with the advice
  to disable IPMI over LAN where Redfish is available.

## Power control

- `set_power_state` can take a production server down. In netOrk it needs a
  `ConfirmDialog`, a permission of its own, and an audit log entry.
- `ForceOff`/`ForceRestart`/`PowerCycle` skip the OS shutdown; offer `GracefulShutdown`/
  `GracefulRestart` first. Over IPMI there is no graceful restart, and no power cycle.
- `reboot_host` restarts only the BMC (`Manager.Reset`). The managed server keeps running.

## Firmware

BMC firmware versions from `UpdateService/FirmwareInventory` feed netOrk's vulnerability
management. Supermicro BMCs in particular have had serious published vulnerabilities, and
the X10 Redfish firmware line is no longer updated.

## Network placement

A BMC belongs in a management network that only administrators and netOrk can reach. A BMC
reachable from a user or guest VLAN is itself a finding for the segmentation checks.