Here are the magic numbers, which I have no idea of the meaning, that I got (a while ago) from Supermicro (via our vendor, Silicon Mechanics):
myuser Auth-Type :=Local, User-Password == “123456”
Vendor-Specific = “H=4, I=4”
testuser Auth-Type :=Local, User-Password == “654321”
Vendor-Specific = “H=3, I=3”
So, obviously H= and I= mean something, and at least 3 and 4 are valid values (and I don't believe the syntax is even allowed by the RFCs, but whatever). I replied asking what those mean, and haven't heard back. I just sent a followup...
Got a reply:
Those setting match the user account type in IPMI Web GUI.
CallBack (H=1, I=1) = No Access
Basically, this type of account will be rejected by IPMI. It can be used to temporarily disable an account.
User (H=2, I=2) = User
This type of the account is only allowed to check the system status.
Operator (H=3, I=3) = Operator
This type of the account is allowed to do the remote control & check the system statsus, but can't change the configuration.
Administrator (H=4, I=4) = Administrator
The type of accout is allowed to do everything.
There is no other privilege.
Reply to the two different field meanings.
This is the info SuperMicro got from ATEN:
"H" means if for the user privilege. IPMI spec 2.0 defines the following channel privilege levels. We don't use the OEM Proprietary level for special privilege.
Channel Privilege Level Limit:
0h = reserved
1h = CALLBACK level
2h = USER level
3h = OPERATOR level
4h = ADMINISTRATOR level
5h = OEM Proprietary level
"I" is for debug purpose and it is reserved option. Please ignore it.
Below is the definition of the Channel Privilege Levels from IPMI spec 2.0:
This may be considered the lowest privilege level. Only commands necessary to support initiating a Callback are allowed.
Only 'benign' commands are allowed. These are primarily commands that read data structures and retrieve status. Commands that can be used to alter BMC configuration, write data to the BMC or other management controllers, or perform system actions such as resets, power on/off, and watchdog activation are disallowed.
All BMC commands are allowed, except for configuration commands that can change the behavior of the out-of band interfaces. For example, Operator privilege does not allow the capability to disable individual channels, or change user access privileges.
All BMC commands are allowed, including configuration commands. An Adminstrator can even execute
configuration commands that would disable the channel that the Administrator is communicating over.