Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

On my SuperMicro Server, using a H8SCM motherboard i have an IPMI Card

The IPMI card uses version 2.0 and running the 2.37 firmware

The problem i have is that i find no feasible way to disable port 80 (HTTP) Access

As user ADMIN...

Through the Web Interface, i can only change the port (1-65535)
Through the SSH login, i have no access to any relative or interesting information whatsoever
Through the ipmitool, i can only change setting relative to SOL
Through the patched SuperMicro ipmitool, there is no setting available

Am i missing something, or has SuperMicro left a gaping security hole allowing plaintext password transmission???

share|improve this question
Are you certain that it allows you to authenticate over HTTP? Their spec page says they use HTTPS, so I am (perhaps naively) assuming that they allow you to connect over 80 and then redirect you to HTTPS. Can you test this and let me know? I don't have access to a SuperMicro server to test my guess. – mfinni Apr 25 '12 at 15:37
I am capable of connecting to port 80 and logging in without redirection to 443 :( i would like to see port 80 closed. – Arenstar Apr 25 '12 at 15:40
Have you tried contacting their support, to see what they say? Not to discourage you from asking here as well, but you're asking whether a product has a given feature. Seems like the manufacturer of the product should be your first stop. – mfinni Apr 25 '12 at 15:43
I have, and havent even received acknowledgment of my question. :( I was hoping the public could help me out here... – Arenstar Apr 25 '12 at 15:48
You could just remember to not use http, always use https. It's more work on your part (there are browser plugins to help you with this though.) If you don't use the insecure method, then you're not exposing yourself to the vulnerability. – mfinni Apr 25 '12 at 16:53

2 Answers

up vote 3 down vote

Supermicro IPMI BMCs are extremely useful, but they are not engineered for security. I recommend keeping IPMI on a separate interface/VLAN. Even if you are able to disable port 80, it is highly likely that there are undocumented remote exploit vulnerabilities.

share|improve this answer
I have mine on my internal interface where my LAN ip address's are.. It allows me to access them externally through proxying or SSH forwarding.. How do you manage these remotely on a different network/interface/vlan?? – Arenstar Apr 25 '12 at 16:23
2  
With a router, typically. That's how networks work. – mfinni Apr 25 '12 at 16:52
mfinni... I dont think that would suffice for PCI-DSS certification.. A router would result in the same situation i have right now.. We need security obviously, and accessibility outside of my datacenter... Miles.. When you seperate these on a seperate Interface/VLAN what methods do you use to manage your IPMI's externally ( also through proxying or ssh hoppping through a jump server)?....... Although my IPMI's are only accessible from my internal network, I recently have had some professional penetration tests, and the general view is that port 80 is a problem, and should be removed. – Arenstar Apr 25 '12 at 17:36
A router with firewall capabilities, or a firewall added in as an in-line device. Block port 80 into that subnet, and it is no longer a vulnerability. – mfinni Apr 25 '12 at 18:58
Correct. Even the sort of Cisco router that you can buy used for under $50 (e.g. 1760) will let you configure extended ACLs. Add a managed switch that supports VLAN trunking (again you're looking at $50 and up, e.g. 2950) and you have a rudimentary managed network including everything you need to segregate VLANs and route between them. Obviously, newer/faster/better/in-warranty equipment costs more. – Miles Erickson Apr 26 '12 at 18:21
up vote 2 down vote

There is an OEM extension for IPMI that Supermicro supports to disable non-IPMI ports on their service processor. I'm not sure which motherboard lines it is currently supported in and what firmware versions it is in, but it may be worth trying out.

I'm not sure if the extension is supported in any of Supermicro's client software. The OEM extension is currently supported in FreeIPMI's ipmi-oem tool (disclaimer: I maintain this project, so this is a mini-plug). Here's the relevant chunk from the manpage.

Supermicro

get-bmc-services-status

This OEM command will determine if non-IPMI services (e.g. ssh, http, https, vnc, etc.) are currently enabled or disabled on the BMC. Command confirmed to work on Supermicro X8DTG.

set-bmc-services-status enable|disable

This OEM command will enable or disable all non-IPMI services on the BMC. This command can be used to enable or disable non-IPMI services such as ssh, http, https, and vnc. Command confirmed to work on Supermicro X8DTG.

share|improve this answer
Ok.. i was hoping.. however i retrieved "Supermicro:get-bmc-services-status failed: Invalid data field in Request" :( – Arenstar May 3 '12 at 19:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.