IPMI Matthew Garrett <matthew.garrett@nebula.com> - PowerPoint PPT Presentation

IPMI Matthew Garrett <matthew.garrett@nebula.com>

Intelligent Platform Management Interface

Solves the biggest problem in server admin

(How do you turn it off and turn it on again without having to leave your desk?)

IPMI ● Remote power control ● Watchdog ● Boot order ● Serial over LAN ● Sensor monitoring ● Alarms

Vendor differentiation ● Remote console ● Firmware configuration ● Virtual CD device

IPMI ● Linux is near ubiquitous ● Your network contains embedded Linux

Your network contains embedded Linux

Your network contains embedded Linux

Your network contains embedded Linux

Your network contains embedded Linux

Your network contains embedded Linux

IPMI wants to be free ● Having a separate BMC network is difficult and expensive ● So why not just steal packets from the host NIC?

Security isn't great ● Old software ● Insecure software ● Bad software

Security isn't great

Security isn't great ● Authentication, encryption, attestation ● Pick any number

Security isn't great ● Authentication, encryption, attestation ● Pick any number ● (including 0)

Security isn't great ● Spec requires that the BMC hand over the hashed password

Security isn't great ● Usernames may be hardcoded

Best practices ● Physically distinct network ● Make sure they're all plugged in ● Change default credentials ● Change default usernames ● Disable unused users ● Disable cipher 0

Ponies

Server deployment is tedious ● Takes a long time to access firmware ● Opportunity to make mistakes ● Inconsistent configs = inconsistent performance

More vendor differentiation ● Vendor tools for config ● Vendor APIs for config ● Lock-in with vendor tooling ● Annoying for heterogeneous networks

Wouldn't abstraction be nice? ● Spoiler:

Wouldn't abstraction be nice? ● Spoiler: – (yes)

python-firmware-config import firmware-config fw = firmware-config.create(“cisco”, “192.168.0.20”, “admin”, “admin”) options = fw.get_options if options['TPMSupport']['current'] != “enabled”: options['TPMSupport']['new'] = “enabled fw.set_fw_options(options)

Mostly vendor-neutral ● API identical between vendors ● Option names differ ● Semantics may vary

Currently supported vendors ● Cisco ● Dell

Currently supported vendors ● Cisco ● Dell ● (Your name here)

Free software ● Apache 2.0 license ● http://github.com/nebula/firmware_config