Christian Manivong
6c60f7ac60
IpmiDriver.set_power_state sends an IPMI chassis control: On, GracefulShutdown, ForceOff and ForceRestart. get_power_state now offers what fits the server's state: On when it is off, the other three when it is on. IPMI has no graceful restart and pyghmi offers no power cycle, so neither is offered. The driver still does not reset the BMC. For boards that offer nothing but IPMI, such as a Supermicro X10 without a Redfish license.
46 lines
2.1 KiB
Markdown
46 lines
2.1 KiB
Markdown
# Security
|
|
|
|
A BMC can power a server off, mount virtual media and open a remote console. Its
|
|
credentials are worth as much as root on every machine it manages.
|
|
|
|
## Credentials
|
|
|
|
- Use a dedicated BMC account for netOrk, not the factory administrator. A read-only role
|
|
(Redfish `ReadOnly`) suffices for everything except power control, which needs
|
|
`Operator`.
|
|
- netOrk's credential gating applies unchanged: no job without credentials.
|
|
- Close Redfish sessions after each poll. BMCs allow few concurrent sessions, and a leaked
|
|
session can lock the web UI out.
|
|
|
|
## IPMI over LAN
|
|
|
|
- IPMI 2.0's RAKP handshake returns a salted hash of the user's password to any client that
|
|
names a valid user, before authentication (CVE-2013-4786). The hash can be cracked
|
|
offline. This is part of the protocol, not a bug a firmware update fixes.
|
|
- Cipher suite 0 (no authentication) is enabled on some BMCs and allows login with any
|
|
password.
|
|
- So the `ipmi` entry point is a fallback only. It switches the server's power, because
|
|
some boards (a Supermicro X10 without a Redfish license) offer nothing else, but it does
|
|
not reset the BMC. `get_management_protocols`
|
|
reporting `IPMI.ProtocolEnabled = true` should become a finding in netOrk, with the advice
|
|
to disable IPMI over LAN where Redfish is available.
|
|
|
|
## Power control
|
|
|
|
- `set_power_state` can take a production server down. In netOrk it needs a
|
|
`ConfirmDialog`, a permission of its own, and an audit log entry.
|
|
- `ForceOff`/`ForceRestart`/`PowerCycle` skip the OS shutdown; offer `GracefulShutdown`/
|
|
`GracefulRestart` first. Over IPMI there is no graceful restart, and no power cycle.
|
|
- `reboot_host` restarts only the BMC (`Manager.Reset`). The managed server keeps running.
|
|
|
|
## Firmware
|
|
|
|
BMC firmware versions from `UpdateService/FirmwareInventory` feed netOrk's vulnerability
|
|
management. Supermicro BMCs in particular have had serious published vulnerabilities, and
|
|
the X10 Redfish firmware line is no longer updated.
|
|
|
|
## Network placement
|
|
|
|
A BMC belongs in a management network that only administrators and netOrk can reach. A BMC
|
|
reachable from a user or guest VLAN is itself a finding for the segmentation checks.
|