0 Fork 0

Files

T

Christian Manivong 5f8a4ef975 docs: design notes for a Redfish/IPMI BMC driver

No code yet. The README explains why one Redfish driver with vendor quirk
modules beats a Supermicro-only IPMI driver, and keeps IPMI over LAN as a
read-only fallback. docs/ holds a draft for a new ManagementController
role base in napalm-device-types, the getter-to-resource map, the first
test device (Supermicro X10DRL-i, Redfish firmware 3.91), the security
points (IPMI RAKP hash disclosure, power control, credentials) and the
test plan with DMTF mockups and fixtures to record.

2026-10-13 01:15:57 +02:00

1.9 KiB

Raw Blame History

Security

A BMC can power a server off, mount virtual media and open a remote console. Its credentials are worth as much as root on every machine it manages.

Credentials

Use a dedicated BMC account for netOrk, not the factory administrator. A read-only role (Redfish ReadOnly) suffices for everything except power control, which needs Operator.
netOrk's credential gating applies unchanged: no job without credentials.
Close Redfish sessions after each poll. BMCs allow few concurrent sessions, and a leaked session can lock the web UI out.

IPMI over LAN

IPMI 2.0's RAKP handshake returns a salted hash of the user's password to any client that names a valid user, before authentication (CVE-2013-4786). The hash can be cracked offline. This is part of the protocol, not a bug a firmware update fixes.
Cipher suite 0 (no authentication) is enabled on some BMCs and allows login with any password.
So the ipmi entry point is read-only and a fallback only. get_management_protocols reporting IPMI.ProtocolEnabled = true should become a finding in netOrk, with the advice to disable IPMI over LAN where Redfish is available.

Power control

set_power_state can take a production server down. In netOrk it needs a ConfirmDialog, a permission of its own, and an audit log entry.
ForceOff/ForceRestart/PowerCycle skip the OS shutdown; offer GracefulShutdown/ GracefulRestart first.
reboot_host restarts only the BMC (Manager.Reset). The managed server keeps running.

Firmware

BMC firmware versions from UpdateService/FirmwareInventory feed netOrk's vulnerability management. Supermicro BMCs in particular have had serious published vulnerabilities, and the X10 Redfish firmware line is no longer updated.

Network placement

A BMC belongs in a management network that only administrators and netOrk can reach. A BMC reachable from a user or guest VLAN is itself a finding for the segmentation checks.

1.9 KiB Raw Blame History