Christian Manivong
5f8a4ef975
No code yet. The README explains why one Redfish driver with vendor quirk modules beats a Supermicro-only IPMI driver, and keeps IPMI over LAN as a read-only fallback. docs/ holds a draft for a new ManagementController role base in napalm-device-types, the getter-to-resource map, the first test device (Supermicro X10DRL-i, Redfish firmware 3.91), the security points (IPMI RAKP hash disclosure, power control, credentials) and the test plan with DMTF mockups and fixtures to record.
44 lines
1.9 KiB
Markdown
44 lines
1.9 KiB
Markdown
# Security
|
|
|
|
A BMC can power a server off, mount virtual media and open a remote console. Its
|
|
credentials are worth as much as root on every machine it manages.
|
|
|
|
## Credentials
|
|
|
|
- Use a dedicated BMC account for netOrk, not the factory administrator. A read-only role
|
|
(Redfish `ReadOnly`) suffices for everything except power control, which needs
|
|
`Operator`.
|
|
- netOrk's credential gating applies unchanged: no job without credentials.
|
|
- Close Redfish sessions after each poll. BMCs allow few concurrent sessions, and a leaked
|
|
session can lock the web UI out.
|
|
|
|
## IPMI over LAN
|
|
|
|
- IPMI 2.0's RAKP handshake returns a salted hash of the user's password to any client that
|
|
names a valid user, before authentication (CVE-2013-4786). The hash can be cracked
|
|
offline. This is part of the protocol, not a bug a firmware update fixes.
|
|
- Cipher suite 0 (no authentication) is enabled on some BMCs and allows login with any
|
|
password.
|
|
- So the `ipmi` entry point is read-only and a fallback only. `get_management_protocols`
|
|
reporting `IPMI.ProtocolEnabled = true` should become a finding in netOrk, with the advice
|
|
to disable IPMI over LAN where Redfish is available.
|
|
|
|
## Power control
|
|
|
|
- `set_power_state` can take a production server down. In netOrk it needs a
|
|
`ConfirmDialog`, a permission of its own, and an audit log entry.
|
|
- `ForceOff`/`ForceRestart`/`PowerCycle` skip the OS shutdown; offer `GracefulShutdown`/
|
|
`GracefulRestart` first.
|
|
- `reboot_host` restarts only the BMC (`Manager.Reset`). The managed server keeps running.
|
|
|
|
## Firmware
|
|
|
|
BMC firmware versions from `UpdateService/FirmwareInventory` feed netOrk's vulnerability
|
|
management. Supermicro BMCs in particular have had serious published vulnerabilities, and
|
|
the X10 Redfish firmware line is no longer updated.
|
|
|
|
## Network placement
|
|
|
|
A BMC belongs in a management network that only administrators and netOrk can reach. A BMC
|
|
reachable from a user or guest VLAN is itself a finding for the segmentation checks.
|