How to disable port 80 on IPMI console for a rhel server? [closed]

Question

I have a requirement to disable http port for the IPMI console for a rhel server. Where should I start?

Answer 1

The answer is it depends on the manufacturer of your motherboard. The IPMI standard does not specify how to disable the IPMI port, so if it does exist for your motherboard, you'd have to ask your vendor about support. My recollection is some manufacturers might support this in the BIOS, but I can't recall 100%.

That said, what I think you really care about is disabling IPMI over LAN, not just disable the port? Because you can disable IPMI over LAN by disabling the IPMI LAN channel on a service processor.

In FreeIPMI, bmc-config can be used to do this by doing (Note, I currently don't have access to an IPMI system, so hopefully the example I give below is correct. Could have minor errors).

bmc-config --commit -e Lan_Channel:Volatile_Access_Mode=No -e Lan_Channel:Non_Volatile_Access_Mode=No

Although, I think it might be better to do

bmc-config --checkout -vv > myconf.conf

Load up myconf.conf in an editor, and just disable everything possible (users, SOL, all LAN channels - there could be multiple, all authentication mechanisms, fill in bad IPs and MAC Addresses for kicks, etc.). Then commit the changes via.

bmc-config --commit --filename=myconf.conf

Answer 2

IPMI is separate from your installed operating system and may be implemented differently based on different hardware vendors. The OS may have tools to interface with the IPMI chip directly, but there are usually a couple hoops to jump through to get that working (drivers, authentication, etc). If you just have a couple servers and can tolerate the downtime, it might be easiest to reboot the server and enter the IPMI chip management interface during the boot sequence, then find the management interface configuration and disable HTTP.