Intelligent Platform Management Interface: Difference between revisions

From HandWiki
imported>Rtexter1
update
 
QCDvac (talk | contribs)
0 edits
update
 
Line 1: Line 1:
{{Short description|Interface standard}}
{{Short description|Computer interface standard}}
The '''Intelligent Platform Management Interface''' ('''IPMI''') is a set of [[Interface (computing)|computer interface]] specifications for an autonomous computer subsystem that provides management and monitoring capabilities independently of the host system's CPU, [[Firmware|firmware]] ([[BIOS]] or UEFI) and [[Operating system|operating system]]. IPMI defines a set of interfaces used by [[System administrator|system administrator]]s for [[Out-of-band management|out-of-band management]] of [[Computer systems|computer systems]] and monitoring of their operation. For example, IPMI provides a way to manage a computer that may be powered off or otherwise unresponsive by using a network connection to the hardware rather than to an operating system or login shell. Another use case may be installing a custom [[Operating system|operating system]] remotely. Without IPMI, installing a custom operating system may require an [[System administrator|administrator]] to be physically present near the computer, insert a [[Engineering:DVD|DVD]] or a [[Engineering:USB flash drive|USB flash drive]] containing the OS [[Software:Installation (computer programs)#Installer|installer]] and complete the installation process using a monitor and a keyboard. Using IPMI, an administrator can mount an [[ISO image]], simulate an installer DVD, and perform the installation remotely.<ref>{{cite web|title=Supermicro IPMI - What is it and what can it do for you?|url=https://www.bostonindia.in/technical/2015/10/supermicro-ipmi-what-is-it-and-what-can-it-do-for-you.aspx|access-date=27 February 2018|archive-date=27 February 2019|archive-url=https://web.archive.org/web/20190227182051/https://www.bostonindia.in/technical/2015/10/supermicro-ipmi-what-is-it-and-what-can-it-do-for-you.aspx|url-status=dead}}</ref>
The '''Intelligent Platform Management Interface''' ('''IPMI''') is a set of [[Interface (computing)|computer interface]] specifications for an autonomous computer subsystem that provides management and monitoring capabilities independently of the host system's CPU, [[Firmware|firmware]] ([[BIOS]] or UEFI) and [[Operating system|operating system]]. IPMI defines a set of interfaces used by [[System administrator|system administrator]]s for [[Out-of-band management|out-of-band management]] of [[Computer systems|computer systems]] and monitoring of their operation. For example, IPMI provides a way to manage a computer that may be powered off or otherwise unresponsive by using a network connection to the hardware rather than to an operating system or login shell. Another use case may be installing a custom [[Operating system|operating system]] remotely. Without IPMI, installing a custom operating system may require an [[System administrator|administrator]] to be physically present near the computer, insert a [[Engineering:DVD|DVD]] or a [[Engineering:USB flash drive|USB flash drive]] containing the OS [[Software:Installation (computer programs)#Installer|installer]] and complete the installation process using a monitor and a keyboard. Using IPMI, an administrator can mount an [[ISO image]], simulate an installer DVD, and perform the installation remotely.<ref>{{cite web|title=Supermicro IPMI - What is it and what can it do for you?|url=https://www.bostonindia.in/technical/2015/10/supermicro-ipmi-what-is-it-and-what-can-it-do-for-you.aspx|access-date=27 February 2018|archive-date=27 February 2019|archive-url=https://web.archive.org/web/20190227182051/https://www.bostonindia.in/technical/2015/10/supermicro-ipmi-what-is-it-and-what-can-it-do-for-you.aspx|url-status=dead}}</ref>


Line 11: Line 11:
* after OS or system failure{{snd}} the key characteristic of IPMI compared with in-band system management is that it enables remote login to the operating system using [[Secure Shell|SSH]]
* after OS or system failure{{snd}} the key characteristic of IPMI compared with in-band system management is that it enables remote login to the operating system using [[Secure Shell|SSH]]


System administrators can use IPMI messaging to monitor platform status (such as system temperatures, voltages, fans, power supplies and chassis intrusion); to query inventory information; to review hardware logs of out-of-range conditions; or to perform recovery procedures such as issuing requests from a remote console through the same connections e.g. system power-down and rebooting, or configuring [[Watchdog timer|watchdog timer]]s. The standard also defines an alerting mechanism for the system to send a [[Simple Network Management Protocol|simple Network Management Protocol]] (SNMP) platform event trap (PET).
System administrators can use IPMI messaging to monitor platform status (such as system temperatures, voltages, fans, power supplies and chassis intrusion); to query inventory information; to review hardware logs of out-of-range conditions; or to perform recovery procedures such as issuing requests from a remote console through the same connections e.g. system power-down and rebooting, or configuring [[Watchdog timer|watchdog timer]]s. The standard also defines an alerting mechanism for the system to send a [[Simple Network Management Protocol]] (SNMP) platform event trap (PET).


The monitored system may be powered off, but must be connected to a power source and to the monitoring medium, typically a [[Engineering:Local area network|local area network]] (LAN) connection. IPMI can also function after the operating system has started, and exposes management data and structures to the system management software. IPMI prescribes only the structure and format of the interfaces as a standard, while detailed implementations may vary. An implementation of IPMI version 1.5 can communicate via a direct out-of-band LAN or serial connection or via a side-band LAN connection to a remote [[Client (computing)|client]]. The side-band LAN connection utilizes the board [[Engineering:Network interface controller|network interface controller]] (NIC). This solution is less expensive than a dedicated LAN connection but also has limited bandwidth and security issues.
The monitored system may be powered off, but must be connected to a power source and to the monitoring medium, typically a [[Engineering:Local area network|local area network]] (LAN) connection. IPMI can also function after the operating system has started, and exposes management data and structures to the system management software. IPMI prescribes only the structure and format of the interfaces as a standard, while detailed implementations may vary. An implementation of IPMI version 1.5 can communicate via a direct out-of-band LAN or [[Serial communication|serial]] connection or via a side-band LAN connection to a remote [[Client (computing)|client]]. The side-band LAN connection utilizes the board [[Engineering:Network interface controller|network interface controller]] (NIC). This solution is less expensive than a dedicated LAN connection but also has limited bandwidth and security issues.


Systems compliant with IPMI version 2.0 can also communicate via [[Serial over LAN|serial over LAN]], whereby serial console output can be remotely viewed over the LAN. Systems implementing IPMI 2.0 typically also include [[Engineering:KVM switch#KVM over IP (IPKVM)|KVM over IP]], remote virtual media and out-of-band embedded web-server interface functionality, although strictly speaking, these lie outside of the scope of the IPMI interface standard.
Systems compliant with IPMI version 2.0 can also communicate via [[Serial over LAN|serial over LAN]], whereby serial console output can be remotely viewed over the LAN. Systems implementing IPMI 2.0 typically also include [[Engineering:KVM switch#KVM over IP (IPKVM)|KVM over IP]], remote virtual media and out-of-band embedded web-server interface functionality, although strictly speaking, these lie outside of the scope of the IPMI interface standard.
Line 25: Line 25:


Several vendors develop and market BMC chips. A BMC utilized for embedded applications may have limited memory and require optimized firmware code for implementation of the full IPMI functionality. Highly integrated BMCs can provide complex instructions and provide the complete out-of-band functionality of a service processor. The firmware implementing the IPMI interfaces is provided by various vendors.
Several vendors develop and market BMC chips. A BMC utilized for embedded applications may have limited memory and require optimized firmware code for implementation of the full IPMI functionality. Highly integrated BMCs can provide complex instructions and provide the complete out-of-band functionality of a service processor. The firmware implementing the IPMI interfaces is provided by various vendors.
A field replaceable unit (FRU) repository  holds the inventory, such as vendor ID and manufacturer, of potentially replaceable devices.  A sensor data record (SDR) repository provides the properties of the individual sensors present on the board.  For example, the board may contain sensors for temperature, fan speed, and voltage.
A [[Engineering:Field-replaceable unit|field-replaceable unit]] (FRU) repository  holds the inventory, such as vendor ID and manufacturer, of potentially replaceable devices.  A sensor data record (SDR) repository provides the properties of the individual sensors present on the board.  For example, the board may contain sensors for temperature, fan speed, and voltage.


===Baseboard management controller===
===Baseboard management controller===
Line 32: Line 32:
The baseboard management controller (BMC) provides the intelligence in the IPMI architecture. It is a specialized [[Engineering:Microcontroller|microcontroller]] embedded on the [[Engineering:Motherboard|motherboard]] of a [[Computer|computer]]&nbsp;– generally a [[Server (computing)|server]]. The BMC manages the interface between system-management software and platform hardware. BMC has its dedicated firmware and RAM.
The baseboard management controller (BMC) provides the intelligence in the IPMI architecture. It is a specialized [[Engineering:Microcontroller|microcontroller]] embedded on the [[Engineering:Motherboard|motherboard]] of a [[Computer|computer]]&nbsp;– generally a [[Server (computing)|server]]. The BMC manages the interface between system-management software and platform hardware. BMC has its dedicated firmware and RAM.


Different types of [[Engineering:Sensor|sensor]]s built into the computer system report to the BMC on [[Parameter|parameter]]s such as [[Physics:Temperature|temperature]], cooling [[Engineering:Computer fan|fan]] [[Physics:Speed|speed]]s, [[Physics:Power|power]] status, [[Operating system|operating system]] (OS) status, etc.
Different types of [[Engineering:Sensor|sensor]]s built into the computer system report to the BMC on [[Parameter|parameter]]s such as [[Physics:Temperature|temperature]], cooling [[Engineering:Computer fan|fan]] [[Speed|speed]]s, [[Power|power]] status, [[Operating system|operating system]] (OS) status, etc.
The BMC monitors the sensors and can send alerts to a [[System administrator|system administrator]] via the [[Computer network|network]] if any of the parameters do not stay within pre-set limits, indicating a potential failure of the system. The administrator can also remotely communicate with the BMC to take some corrective actions – such as resetting or power cycling the system to get a hung OS running again. These abilities reduce the [[Total cost of ownership|total cost of ownership]] of a system.
The BMC monitors the sensors and can send alerts to a [[System administrator|system administrator]] via the [[Computer network|network]] if any of the parameters do not stay within pre-set limits, indicating a potential failure of the system. The administrator can also remotely communicate with the BMC to take some corrective actions – such as resetting or power cycling the system to get a hung OS running again. These abilities reduce the [[Total cost of ownership|total cost of ownership]] of a system.


Systems compliant with IPMI version 2.0 can also communicate via [[Serial over LAN|serial over LAN]], whereby serial console output can be remotely viewed over the LAN. Systems implementing IPMI 2.0 typically also include [[Engineering:KVM switch#KVM over IP (IPKVM)|KVM over IP]], remote virtual media and out-of-band embedded web-server interface functionality, although strictly speaking, these lie outside of the scope of the IPMI interface standard.
Systems compliant with IPMI version 2.0 can also communicate via [[Serial over LAN|serial over LAN]], whereby serial console output can be remotely viewed over the LAN. Systems implementing IPMI 2.0 typically also include [[Engineering:KVM switch#KVM over IP (IPKVM)|KVM over IP]], remote virtual media and out-of-band embedded web-server interface functionality, although strictly speaking, these lie outside of the scope of the IPMI interface standard.


Physical interfaces to the BMC include SMBuses, an [[RS-232]] serial console, address and data lines and an IPMB, that enables the BMC to accept IPMI request messages from other management controllers in the system.
Physical interfaces to the BMC include SMBuses, an [[RS-232]] [[Serial communication|serial]] console, address and data lines and an IPMB, that enables the BMC to accept IPMI request messages from other management controllers in the system.


A direct serial connection to the BMC is not [[Encryption|encrypted]] as the connection itself is secure. Connection to the BMC over LAN may or may not use encryption depending on the security concerns of the user.
A direct serial connection to the BMC is not [[Encryption|encrypted]] as the connection itself is secure. Connection to the BMC over LAN may or may not use encryption depending on the security concerns of the user.


There are rising concerns about general security regarding BMCs as a closed infrastructure.<ref name="Schneier on Security">{{cite web|url= https://www.schneier.com/blog/archives/2013/01/the_eavesdroppi.html |title= The Eavesdropping System in Your Computer - Schneier on Security |website= Schneier.com |date= 2013-01-31 |access-date= 2013-12-05}}</ref><ref>{{cite web|url= https://isc.sans.edu/diary/IPMI%3A+Hacking+servers+that+are+turned+%22off%22/13399 |title= InfoSec Handlers Diary Blog - IPMI: Hacking servers that are turned "off" |website= Isc.sans.edu |date= 2012-06-07 |access-date= 2015-05-29}}</ref><ref>{{cite web|last= Goodin |first= Dan |url= https://arstechnica.com/security/2013/08/remote-admin-tool-imperils-servers/ |title= "Bloodsucking leech" puts 100,000 servers at risk of potent attacks |website= Arstechnica.com |date= 2013-08-16 |access-date= 2015-05-29}}
There are concerns about the general security of BMCs, as piece of infrastructure with such low-level, wide-ranging access and control over servers. Vendor implementations are based on closed source and proprietary software, with little to no transparency regarding how they are made and what security vulnerabilities they contain.<ref name="Schneier on Security">{{cite web|url= https://www.schneier.com/blog/archives/2013/01/the_eavesdroppi.html |title= The Eavesdropping System in Your Computer - Schneier on Security |website= Schneier.com |date= 2013-01-31 |access-date= 2013-12-05}}</ref><ref>{{cite web|url= https://isc.sans.edu/diary/IPMI%3A+Hacking+servers+that+are+turned+%22off%22/13399 |title= InfoSec Handlers Diary Blog - IPMI: Hacking servers that are turned "off" |website= Isc.sans.edu |date= 2012-06-07 |access-date= 2015-05-29}}</ref><ref>{{cite web|last= Goodin |first= Dan |url= https://arstechnica.com/security/2013/08/remote-admin-tool-imperils-servers/ |title= "Bloodsucking leech" puts 100,000 servers at risk of potent attacks |website= Arstechnica.com |date= 2013-08-16 |access-date= 2015-05-29}}
</ref><ref>
</ref><ref>
{{cite web  
{{cite web  
Line 50: Line 50:
|website= Usenix.org |access-date= 2015-05-29
|website= Usenix.org |access-date= 2015-05-29
}}
}}
</ref> OpenBMC is a [[Organization:Linux Foundation|Linux Foundation]] Collaborative open-source BMC project.<ref>{{Cite news|url=http://www.linuxfoundation.org/blog/openbmc-project-community-comes-together-at-the-linux-foundation-to-define-open-source-implementation-of-bmc-firmware-stack/|title=OpenBMC Project Community Comes Together at The Linux Foundation to Define Open Source Implementation of BMC Firmware Stack - The Linux Foundation|date=2018-03-19|work=The Linux Foundation|access-date=2018-03-27|language=en-US}}</ref>
</ref>.
 
The BMC (especially BMCs from Aspeed) may integrated an entry GPU (usually only supports 2D hardware acceleration) for basic display and remote administration purpose.
 
OpenBMC is a [[Organization:Linux Foundation|Linux Foundation]] collaborative, free and open source BMC project that aims to build transparent, well-documented and tested BMC management software that would alleviate these issues.<ref>{{Cite news|url=http://www.linuxfoundation.org/blog/openbmc-project-community-comes-together-at-the-linux-foundation-to-define-open-source-implementation-of-bmc-firmware-stack/|title=OpenBMC Project Community Comes Together at The Linux Foundation to Define Open Source Implementation of BMC Firmware Stack - The Linux Foundation|date=2018-03-19|work=The Linux Foundation|access-date=2018-03-27|language=en-US}}</ref>


==Security==
==Security==
Line 73: Line 77:
  }}</ref>
  }}</ref>


However, like for any other management interface, best security practices dictate the placement of the IPMI management port on a dedicated management LAN or VLAN restricted to trusted Administrators.<ref>{{Cite web|url=https://www.servethehome.com/basic-bmc-and-ipmi-management-security-practices/|title=Basic BMC and IPMI Management Security Practices|last=Kumar|first=Rohit|date=2018-10-19|website=ServeTheHome|language=en-US|access-date=2019-12-23}}</ref>
However, like any other management interface, best security practices dictate the placement of the IPMI management port on a dedicated management LAN or VLAN restricted to trusted Administrators.<ref>{{Cite web|url=https://www.servethehome.com/basic-bmc-and-ipmi-management-security-practices/|title=Basic BMC and IPMI Management Security Practices|last=Kumar|first=Rohit|date=2018-10-19|website=ServeTheHome|language=en-US|access-date=2019-12-23}}</ref>


=== Latest IPMI specification security improvements ===
=== Latest IPMI specification security improvements ===


The IPMI specification has been updated with RAKP+ and a stronger cipher that is computationally impractical to break.<ref>{{Cite web |title=IPMI Specification, V2.0, Rev. 1.1: Document |url=https://www.intel.com/content/www/us/en/products/docs/servers/ipmi/ipmi-second-gen-interface-spec-v2-rev1-1.html |access-date=2022-06-11 |website=Intel |language=en}}</ref> Vendors as a result have provided patches that remediate these vulnerabilities.{{citation needed|date=February 2017}}
The IPMI specification has been updated with RAKP+ and a stronger cipher that is computationally impractical to break.<ref>{{Cite web |title=IPMI Specification, V2.0, Rev. 1.1: Document |url=https://www.intel.com/content/www/us/en/products/docs/servers/ipmi/ipmi-second-gen-interface-spec-v2-rev1-1.html |access-date=2022-06-11 |website=Intel |language=en}}</ref> Vendors as a result have provided patches that remediate these vulnerabilities.  
 
The [[Organization:Distributed Management Task Force|DMTF]] organization has developed a secure and scalable interface specification called [[Redfish (specification)|Redfish]] to work in modern datacenter environments.<ref>{{Cite web |title=Redfish: A New API for Managing Servers |url=https://www.infoq.com/news/2015/08/redfish/ |access-date=2022-06-11 |website=InfoQ |language=en}}</ref>
The [[Organization:Distributed Management Task Force|DMTF]] organization has developed a secure and scalable interface specification called [https://www.dmtf.org/standards/redfish Redfish] to work in modern datacenter environments.<ref>{{Cite web |title=Redfish: A New API for Managing Servers |url=https://www.infoq.com/news/2015/08/redfish/ |access-date=2022-06-11 |website=InfoQ |language=en}}</ref>


=== Potential solutions ===
=== Potential solutions ===


Some potential solutions exist outside of the IPMI standard, depending on proprietary implementations.  The use of default short passwords, or "cipher 0" hacks can be easily overcome with the use of a [[RADIUS]] server for Authentication, Authorization, and Accounting over SSL as is typical in a datacenter or any medium to large deployment.  The user's RADIUS server can be configured to store AAA securely in an [[Lightweight Directory Access Protocol|LDAP]] database using either FreeRADIUS/OpenLDAP or Microsoft Active Directory and related services.
Some potential solutions exist outside of the IPMI standard, depending on proprietary implementations.  The use of default short passwords, or "cipher 0" hacks can be easily overcome with the use of a [[RADIUS]] server for  
[[AAA (computer security)|Authentication, Authorization, and Accounting (AAA)]] over SSL as is typical in a datacenter or any medium to large deployment.  The user's RADIUS server can be configured to store AAA securely in an [[Lightweight Directory Access Protocol|LDAP]] database using either [[Software:FreeRADIUS|FreeRADIUS]]/[[Software:OpenLDAP|OpenLDAP]] or Microsoft Active Directory and related services.


Role-based access provides a way to respond to current and future security issues by increasing amounts of restriction for higher roles.
Role-based access provides a way to respond to current and future security issues by increasing amounts of restriction for higher roles.
Line 110: Line 114:


==Implementations==
==Implementations==
* [[HP Integrated Lights-Out]], HP's implementation of IPMI
* [[HPE Integrated Lights-Out]], HP's implementation of IPMI
* Dell DRAC, Dell's implementation of IPMI
* Dell DRAC, Dell's implementation of IPMI
* [https://www.supermicro.com/en/solutions/management-software/bmc-resources Supermicro Intelligent Management], SMCI's implementation of IPMI
* IBM Remote Supervisor Adapter, [[Company:IBM|IBM]]'s out-of-band management products, including IPMI implementations
* IBM Remote Supervisor Adapter, [[Company:IBM|IBM]]'s out-of-band management products, including IPMI implementations
* MegaRAC, [[Software:American Megatrends|AMI]]'s out-of-band management product and OEM IPMI firmware
* MegaRAC, [[Software:American Megatrends|AMI]]'s out-of-band management product and OEM IPMI firmware
* [[Company:Avocent|Avocent]] MergePoint Embedded Management Software, an OEM IPMI firmware
* [[Company:Avocent|Avocent]] MergePoint Embedded Management Software, an OEM IPMI firmware
* [[Company:Cisco|Cisco]] Integrated Management Controller (IMC), Cisco's implementation of IPMI
* [[Company:Cisco|Cisco]] Integrated Management Controller (IMC), Cisco's implementation of IPMI
* Lenovo xClarity, Lenovo's implementation of IPMI


==See also==
==See also==
Line 121: Line 127:
* [[Desktop and mobile Architecture for System Hardware]] (DASH), another platform management standard
* [[Desktop and mobile Architecture for System Hardware]] (DASH), another platform management standard
* [[Engineering:Intel Active Management Technology|Intel Active Management Technology]] (AMT), Intel's out-of-band management product, as an alternative to IPMI
* [[Engineering:Intel Active Management Technology|Intel Active Management Technology]] (AMT), Intel's out-of-band management product, as an alternative to IPMI
* [[Redfish (specification)]]
* [[Engineering:Management Component Transport Protocol|Management Component Transport Protocol]] (MCTP), a low-level protocol used for controlling hardware components
* [[Engineering:Management Component Transport Protocol|Management Component Transport Protocol]] (MCTP), a low-level protocol used for controlling hardware components
* [[Open Platform Management Architecture]] (OPMA), AMD's out-of-band management standard
* [[Open Platform Management Architecture]] (OPMA), AMD's out-of-band management standard
* System Service Processor, on some SPARC machines
* [[Software:System Service Processor|System Service Processor]], on some SPARC machines
* [[Wired for Management]] (WfM)
* [[Wired for Management]] (WfM)


Latest revision as of 15:19, 23 May 2026

Short description: Computer interface standard

The Intelligent Platform Management Interface (IPMI) is a set of computer interface specifications for an autonomous computer subsystem that provides management and monitoring capabilities independently of the host system's CPU, firmware (BIOS or UEFI) and operating system. IPMI defines a set of interfaces used by system administrators for out-of-band management of computer systems and monitoring of their operation. For example, IPMI provides a way to manage a computer that may be powered off or otherwise unresponsive by using a network connection to the hardware rather than to an operating system or login shell. Another use case may be installing a custom operating system remotely. Without IPMI, installing a custom operating system may require an administrator to be physically present near the computer, insert a DVD or a USB flash drive containing the OS installer and complete the installation process using a monitor and a keyboard. Using IPMI, an administrator can mount an ISO image, simulate an installer DVD, and perform the installation remotely.[1]

The specification is led by Intel and was first published on September 16, 1998. It is supported by more than 200 computer system vendors, such as Cisco, Dell,[2] Hewlett Packard Enterprise, and Intel.[3][4]

Functionality

Using a standardized interface and protocol allows systems-management software based on IPMI to manage multiple, disparate servers. As a message-based, hardware-level interface specification, IPMI operates independently of the operating system (OS) to allow administrators to manage a system remotely in the absence of an operating system or of the system management software. Thus, IPMI functions can work in any of three scenarios:

  • before an OS has booted (allowing, for example, the remote monitoring or changing of BIOS settings)
  • when the system is powered down
  • after OS or system failure – the key characteristic of IPMI compared with in-band system management is that it enables remote login to the operating system using SSH

System administrators can use IPMI messaging to monitor platform status (such as system temperatures, voltages, fans, power supplies and chassis intrusion); to query inventory information; to review hardware logs of out-of-range conditions; or to perform recovery procedures such as issuing requests from a remote console through the same connections e.g. system power-down and rebooting, or configuring watchdog timers. The standard also defines an alerting mechanism for the system to send a Simple Network Management Protocol (SNMP) platform event trap (PET).

The monitored system may be powered off, but must be connected to a power source and to the monitoring medium, typically a local area network (LAN) connection. IPMI can also function after the operating system has started, and exposes management data and structures to the system management software. IPMI prescribes only the structure and format of the interfaces as a standard, while detailed implementations may vary. An implementation of IPMI version 1.5 can communicate via a direct out-of-band LAN or serial connection or via a side-band LAN connection to a remote client. The side-band LAN connection utilizes the board network interface controller (NIC). This solution is less expensive than a dedicated LAN connection but also has limited bandwidth and security issues.

Systems compliant with IPMI version 2.0 can also communicate via serial over LAN, whereby serial console output can be remotely viewed over the LAN. Systems implementing IPMI 2.0 typically also include KVM over IP, remote virtual media and out-of-band embedded web-server interface functionality, although strictly speaking, these lie outside of the scope of the IPMI interface standard.

DCMI (Data Center Manageability Interface) is a similar standard based on IPMI but designed to be more suitable for Data Center management: it uses the interfaces defined in IPMI, but minimizes the number of optional interfaces and includes power capping control, among other differences.

IPMI components

IPMI architecture diagram shows BMC sideband via SMBUS.
Interfaces to the baseboard management controller (BMC)

An IPMI sub-system consists of a main controller, called the baseboard management controller (BMC) and other management controllers distributed among different system modules that are referred to as satellite controllers. The satellite controllers within the same chassis connect to the BMC via the system interface called Intelligent Platform Management Bus/Bridge (IPMB) – an enhanced implementation of I²C (Inter-Integrated Circuit). The BMC connects to satellite controllers or another BMC in another chassis via the Intelligent Platform Management Controller (IPMC) bus or bridge. It may be managed with the Remote Management Control Protocol (RMCP), a specialized wire protocol defined by this specification. RMCP+ (a UDP-based protocol with stronger authentication than RMCP) is used for IPMI over LAN.

Several vendors develop and market BMC chips. A BMC utilized for embedded applications may have limited memory and require optimized firmware code for implementation of the full IPMI functionality. Highly integrated BMCs can provide complex instructions and provide the complete out-of-band functionality of a service processor. The firmware implementing the IPMI interfaces is provided by various vendors. A field-replaceable unit (FRU) repository holds the inventory, such as vendor ID and manufacturer, of potentially replaceable devices. A sensor data record (SDR) repository provides the properties of the individual sensors present on the board. For example, the board may contain sensors for temperature, fan speed, and voltage.

Baseboard management controller

Fully integrated BMC as a single chip on a server motherboard

The baseboard management controller (BMC) provides the intelligence in the IPMI architecture. It is a specialized microcontroller embedded on the motherboard of a computer – generally a server. The BMC manages the interface between system-management software and platform hardware. BMC has its dedicated firmware and RAM.

Different types of sensors built into the computer system report to the BMC on parameters such as temperature, cooling fan speeds, power status, operating system (OS) status, etc. The BMC monitors the sensors and can send alerts to a system administrator via the network if any of the parameters do not stay within pre-set limits, indicating a potential failure of the system. The administrator can also remotely communicate with the BMC to take some corrective actions – such as resetting or power cycling the system to get a hung OS running again. These abilities reduce the total cost of ownership of a system.

Systems compliant with IPMI version 2.0 can also communicate via serial over LAN, whereby serial console output can be remotely viewed over the LAN. Systems implementing IPMI 2.0 typically also include KVM over IP, remote virtual media and out-of-band embedded web-server interface functionality, although strictly speaking, these lie outside of the scope of the IPMI interface standard.

Physical interfaces to the BMC include SMBuses, an RS-232 serial console, address and data lines and an IPMB, that enables the BMC to accept IPMI request messages from other management controllers in the system.

A direct serial connection to the BMC is not encrypted as the connection itself is secure. Connection to the BMC over LAN may or may not use encryption depending on the security concerns of the user.

There are concerns about the general security of BMCs, as piece of infrastructure with such low-level, wide-ranging access and control over servers. Vendor implementations are based on closed source and proprietary software, with little to no transparency regarding how they are made and what security vulnerabilities they contain.[5][6][7][8].

The BMC (especially BMCs from Aspeed) may integrated an entry GPU (usually only supports 2D hardware acceleration) for basic display and remote administration purpose.

OpenBMC is a Linux Foundation collaborative, free and open source BMC project that aims to build transparent, well-documented and tested BMC management software that would alleviate these issues.[9]

Security

Historical issues

On 2 July 2013, Rapid7 published a guide to security penetration testing of the latest IPMI 2.0 protocol and implementations by various vendors.[10]

Some sources in 2013 were advising against using the older version of IPMI,[5] due to security concerns related to the design and vulnerabilities of Baseboard Management Controllers (BMCs).[11][12]

However, like any other management interface, best security practices dictate the placement of the IPMI management port on a dedicated management LAN or VLAN restricted to trusted Administrators.[13]

Latest IPMI specification security improvements

The IPMI specification has been updated with RAKP+ and a stronger cipher that is computationally impractical to break.[14] Vendors as a result have provided patches that remediate these vulnerabilities. The DMTF organization has developed a secure and scalable interface specification called Redfish to work in modern datacenter environments.[15]

Potential solutions

Some potential solutions exist outside of the IPMI standard, depending on proprietary implementations. The use of default short passwords, or "cipher 0" hacks can be easily overcome with the use of a RADIUS server for Authentication, Authorization, and Accounting (AAA) over SSL as is typical in a datacenter or any medium to large deployment. The user's RADIUS server can be configured to store AAA securely in an LDAP database using either FreeRADIUS/OpenLDAP or Microsoft Active Directory and related services.

Role-based access provides a way to respond to current and future security issues by increasing amounts of restriction for higher roles. Role-based access is supported with three roles available: Administrator, Operator and User.

Overall, the User role has read-only access of the BMC and no remote control ability such as power cycle or the ability to view or log into the main CPU on the motherboard. Therefore, any hacker with the User role has zero access to confidential information, and zero control over the system. The User role is typically used to monitor sensor readings, after an SNMP alert has been received by SNMP Network Monitoring Software.

The Operator role is used in the rare event when a system is hung, to generate an NMI crash/core dump file and reboot or power cycle the system. In such a case, the Operator will also have access to the system software to collect the crash/core dump file.

The Administrator role is used to configure the BMC on first boot during the commissioning of the system when first installed.

Therefore, the prudent best practice is to disable the use of the Operator and Administrator roles in LDAP/RADIUS, and only enable them when needed by the LDAP/RADIUS administrator. For example, in RADIUS a role can have its setting Auth-Type changed to: 

Auth-Type := Reject

Doing so will prevent RAKP hash attacks from succeeding since the username will be rejected by the RADIUS server.

Version history

The IPMI standard specification has evolved through a number of iterations:[16][17]

  • v1.0 was announced on September 16, 1998: base specification
  • v1.5, published on February 21, 2001: added features including IPMI over LAN, IPMI over Serial/Modem, and LAN Alerting
  • v2.0, published on February 12, 2004: added features including Serial over LAN, Group Managed Systems, Enhanced Authentication, Firmware Firewall, and VLAN Support
  • v2.0 revision 1.1, published on October 1, 2013: amended for errata, clarifications, and addenda, plus addition of support for IPv6 Addressing
  • v2.0 revision 1.1 Errata 7, published on April 21, 2015: amended for errata, clarifications, addenda[18]

Implementations

  • HPE Integrated Lights-Out, HP's implementation of IPMI
  • Dell DRAC, Dell's implementation of IPMI
  • Supermicro Intelligent Management, SMCI's implementation of IPMI
  • IBM Remote Supervisor Adapter, IBM's out-of-band management products, including IPMI implementations
  • MegaRAC, AMI's out-of-band management product and OEM IPMI firmware
  • Avocent MergePoint Embedded Management Software, an OEM IPMI firmware
  • Cisco Integrated Management Controller (IMC), Cisco's implementation of IPMI
  • Lenovo xClarity, Lenovo's implementation of IPMI

See also

References

  1. ↑ "Supermicro IPMI - What is it and what can it do for you?". https://www.bostonindia.in/technical/2015/10/supermicro-ipmi-what-is-it-and-what-can-it-do-for-you.aspx. 
  2. ↑ An Introduction to the Intelligent Platform Management Interface
  3. ↑ "Intelligent Platform Management Interface; Adopters list". Intel. http://www.intel.com/content/www/us/en/servers/ipmi/ipmi-adopters-list.html. 
  4. ↑ Chernis, P J (1985). Petrographic analyses of URL-2 and URL-6 special thermal conductivity samples. doi:10.4095/315247. 
  5. ↑ 5.0 5.1 "The Eavesdropping System in Your Computer - Schneier on Security". 2013-01-31. https://www.schneier.com/blog/archives/2013/01/the_eavesdroppi.html. 
  6. ↑ "InfoSec Handlers Diary Blog - IPMI: Hacking servers that are turned "off"". 2012-06-07. https://isc.sans.edu/diary/IPMI%3A+Hacking+servers+that+are+turned+%22off%22/13399. 
  7. ↑ Goodin, Dan (2013-08-16). ""Bloodsucking leech" puts 100,000 servers at risk of potent attacks". https://arstechnica.com/security/2013/08/remote-admin-tool-imperils-servers/. 
  8. ↑ "Illuminating the Security Issues Surrounding Lights-Out Server Management.Usenix Workshop on Offensive Technologies". 2013. https://www.usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf. 
  9. ↑ "OpenBMC Project Community Comes Together at The Linux Foundation to Define Open Source Implementation of BMC Firmware Stack - The Linux Foundation" (in en-US). The Linux Foundation. 2018-03-19. http://www.linuxfoundation.org/blog/openbmc-project-community-comes-together-at-the-linux-foundation-to-define-open-source-implementation-of-bmc-firmware-stack/. 
  10. ↑ "Metasploit: A Penetration Tester's Guide to IPMI and BMCs". 2013-07-02. https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi. 
  11. ↑ "Authentication Bypass Vulnerability in IPMI 2.0 RAKP through the use of cipher zero". 2013-08-23. http://www.websecuritywatch.com/authentication-bypass-vulnerability-in-ipmi-2-0-rakp-through-the-use-of-cipher-zero/. 
  12. ↑ Dan Farmer (2013-08-22). "IPMI: Freight train to hell". http://fish2.com/ipmi/itrain.pdf. 
  13. ↑ Kumar, Rohit (2018-10-19). "Basic BMC and IPMI Management Security Practices" (in en-US). https://www.servethehome.com/basic-bmc-and-ipmi-management-security-practices/. 
  14. ↑ "IPMI Specification, V2.0, Rev. 1.1: Document" (in en). https://www.intel.com/content/www/us/en/products/docs/servers/ipmi/ipmi-second-gen-interface-spec-v2-rev1-1.html. 
  15. ↑ "Redfish: A New API for Managing Servers" (in en). https://www.infoq.com/news/2015/08/redfish/. 
  16. ↑ "Intelligent Platform Management Interface: What is IPMI?". Intel. http://www.intel.com/content/www/us/en/servers/ipmi/what-is-ipmi.html. 
  17. ↑ "Intelligent Platform Management Interface; Specifications". Intel. http://www.intel.com/content/www/us/en/servers/ipmi/ipmi-specifications.html. 
  18. ↑ IPMI - Ver2.0 Rev1.1 Errata7



Retrieved from "https://handwiki.org/wiki/index.php?title=Intelligent_Platform_Management_Interface&oldid=4348558"