IPMI Matthew Garrett <matthew.garrett@nebula.com> - - PowerPoint PPT Presentation

▶

Jun 13, 2023 288 likes •596 views

IPMI Matthew Garrett <matthew.garrett@nebula.com> Intelligent Platform Management Interface Solves the biggest problem in server admin (How do you turn it off and turn it on again without having to leave your desk?) IPMI Remote

SLIDE 1

IPMI

Matthew Garrett <matthew.garrett@nebula.com>

SLIDE 2

Intelligent Platform Management Interface

SLIDE 3

Solves the biggest problem in server admin

SLIDE 4

(How do you turn it off and turn it on again without having to leave your desk?)

SLIDE 5

IPMI

Remote power control
Watchdog
Boot order
Serial over LAN
Sensor monitoring
Alarms

SLIDE 6

Vendor differentiation

Remote console
Firmware configuration
Virtual CD device

SLIDE 7

IPMI

Linux is near ubiquitous
Your network contains embedded Linux

SLIDE 8

Your network contains embedded Linux

SLIDE 9

Your network contains embedded Linux

SLIDE 10

Your network contains embedded Linux

SLIDE 11

Your network contains embedded Linux

SLIDE 12

Your network contains embedded Linux

SLIDE 13

IPMI wants to be free

Having a separate BMC network is difficult and

expensive

So why not just steal packets from the host

NIC?

SLIDE 14

Security isn't great

Old software
Insecure software
Bad software

SLIDE 15

Security isn't great

SLIDE 16

Security isn't great

Authentication, encryption, attestation
Pick any number

SLIDE 17

Security isn't great

Authentication, encryption, attestation
Pick any number
(including 0)

SLIDE 18

Security isn't great

Spec requires that the BMC hand over the

hashed password

SLIDE 19

Security isn't great

Usernames may be hardcoded

SLIDE 20

Best practices

Physically distinct network
Make sure they're all plugged in
Change default credentials
Change default usernames
Disable unused users
Disable cipher 0

SLIDE 21

Ponies

SLIDE 22

Server deployment is tedious

Takes a long time to access firmware
Opportunity to make mistakes
Inconsistent configs = inconsistent performance

SLIDE 23

More vendor differentiation

Vendor tools for config
Vendor APIs for config
Lock-in with vendor tooling
Annoying for heterogeneous networks

SLIDE 24

Wouldn't abstraction be nice?

Spoiler:

SLIDE 25

Wouldn't abstraction be nice?

Spoiler:

– (yes)

SLIDE 26

python-firmware-config

import firmware-config fw = firmware-config.create(“cisco”, “192.168.0.20”, “admin”, “admin”)

ptions = fw.get_options

if options['TPMSupport']['current'] != “enabled”:

ptions['TPMSupport']['new'] = “enabled

fw.set_fw_options(options)

SLIDE 27

Mostly vendor-neutral

API identical between vendors
Option names differ
Semantics may vary

SLIDE 28

Currently supported vendors

Cisco
Dell

SLIDE 29

Currently supported vendors

Cisco
Dell
(Your name here)

SLIDE 30

Free software

Apache 2.0 license
http://github.com/nebula/firmware_config