0 Fork 0

Files

T

Christian Manivong 6c60f7ac60 feat: switch the server's power over IPMI (0.3.0)

IpmiDriver.set_power_state sends an IPMI chassis control: On, GracefulShutdown,
ForceOff and ForceRestart. get_power_state now offers what fits the server's
state: On when it is off, the other three when it is on. IPMI has no graceful
restart and pyghmi offers no power cycle, so neither is offered. The driver
still does not reset the BMC.

For boards that offer nothing but IPMI, such as a Supermicro X10 without a
Redfish license.

2026-10-17 01:04:43 +02:00

2.1 KiB

Raw Blame History

Security

A BMC can power a server off, mount virtual media and open a remote console. Its credentials are worth as much as root on every machine it manages.

Credentials

Use a dedicated BMC account for netOrk, not the factory administrator. A read-only role (Redfish ReadOnly) suffices for everything except power control, which needs Operator.
netOrk's credential gating applies unchanged: no job without credentials.
Close Redfish sessions after each poll. BMCs allow few concurrent sessions, and a leaked session can lock the web UI out.

IPMI over LAN

IPMI 2.0's RAKP handshake returns a salted hash of the user's password to any client that names a valid user, before authentication (CVE-2013-4786). The hash can be cracked offline. This is part of the protocol, not a bug a firmware update fixes.
Cipher suite 0 (no authentication) is enabled on some BMCs and allows login with any password.
So the ipmi entry point is a fallback only. It switches the server's power, because some boards (a Supermicro X10 without a Redfish license) offer nothing else, but it does not reset the BMC. get_management_protocols reporting IPMI.ProtocolEnabled = true should become a finding in netOrk, with the advice to disable IPMI over LAN where Redfish is available.

Power control

set_power_state can take a production server down. In netOrk it needs a ConfirmDialog, a permission of its own, and an audit log entry.
ForceOff/ForceRestart/PowerCycle skip the OS shutdown; offer GracefulShutdown/ GracefulRestart first. Over IPMI there is no graceful restart, and no power cycle.
reboot_host restarts only the BMC (Manager.Reset). The managed server keeps running.

Firmware

BMC firmware versions from UpdateService/FirmwareInventory feed netOrk's vulnerability management. Supermicro BMCs in particular have had serious published vulnerabilities, and the X10 Redfish firmware line is no longer updated.

Network placement

A BMC belongs in a management network that only administrators and netOrk can reach. A BMC reachable from a user or guest VLAN is itself a finding for the segmentation checks.

2.1 KiB Raw Blame History