undefined | Better HN

0 pointsjevinskie13y ago0 comments

"IPMI operates independently of the OS and allows administrators to manage a system remotely even without an OS, system management software, and even if the monitored system is powered off (along as it is connected to a power source). IPMI can also function after an OS has started, offering enhanced features when used with system management software."

Yikes! Sounds like system management mode in a BIOS!

0 comments

4 comments · 2 top-level

EvanAnderson13y ago· 2 in thread

It's worse than that. It's not BIOS-- it's a freestanding computer.

You'll enjoy this (or be horrified by it): http://fish2.com/ipmi/itrain.html

rosser13y ago

But it's a freestanding computer that means that I don't need to go to the data center at two in the morning to bring up a box that's kernel panicked.

Yeah, be careful with it. Firewall it silly. But recognize that it's a tool that can be very useful.

EvanAnderson13y ago

They're definitely useful tools-- don't get me wrong about that. The fear is that they're controlled, essentially, by an in-band signaling mechanism.

Being grafted onto the same NICs on the server computer that you might potentially expose to the Internet makes firewalling them a more difficult proposition. I get a lot of piece of mind from having management interfaces on an an out-of-band control network whenever possible.

1 more reply

bigiain13y ago

"Yikes! Sounds like system management mode in a BIOS!"

Or, "Sounds like an advanced persistent hardware rootkit!"

j / k navigate · click thread line to collapse