Hacker News Reader

Comment by yuhong | Hacker News Reader

You would have to enable it first I think though.

I thought you couldn't disable it?

https://www.coreboot.org/pipermail/coreboot/2016-September/0... - "AFAIK the ME will allow the platform to stay on for 30 minutes, and will then shut it down hard." (when the firmware/ME has gone bad)

I am talking about the remote management feature, aka Intel AMT.

As much as people are freaked out by the capabilities of ME, I really like the concept of AMT.

I built a headless compile-slave box recently, and was looking forward to using AMT features to manage it and keep it headless, but found out too late that the board I ordered didn't have AMT support. Now, whenever its fragile boot-stack of GRUB+iSCSI+Xen+LVM decides to wedge into single-user mode on a reboot, I have to power the box off and carry it over to a monitor to see what's wrong. I'd much rather just fix it from my laptop.

These kinds of features are standard for servers and nobody bats an eye ("out of band management"). You need them unless you want to attach a remote KVM to every single server. AMT is just that - out of band management. Intel's implementation is a lot more secure than, say, SuperMicro IPMI which had its fair share of issues.

You can disable SuperMicros IPMI though by pulling out the PCI card, though :-)

Why can't you attach a serial console? This will help with any problems that still let you get to grub (BIOS Setup likely doesn't support UI over serial, unless it's a server-like machine).

Once you have a serial console, you can either just plug the cable into your laptop (likely through USB-attached serial port) or set up a small second box (that just runs an ssh daemon and has something like picocom installed) and connect it to that. Then you'll have access over the network.

The capabilities of an out-of-band management system are much, much greater than the serial console offers. BIOS and UEFI configuration are an obvious case, but you also use out-of-band management to bail yourself out of situations where the OS is unresponsive or unbootable, and to take many other management actions that would normally require physical access.

Serial consoles don't help if the box is properly wedged, or has eaten its own bootloader. With a good out of band management system, you can install an OS remotely, with disks on the session driving it appearing as local disks to the machine. Or, you can power off a box as needed, power it on, reconfigure raid cards, etc. A remote serial console is very limited in comparison.

I really like the concept of AMT.

As long as the actual owner has the keys, I agree.

This 30-minutes-then-shutdown annoyance looks to be optional and disabled at the very least on the x230 machine that trmm is hacking on:

https://www.coreboot.org/pipermail/coreboot/attachments/2016...

If this will turn out to be something that could be reliably disabled on other laptops, this is going to be huge.

Heck, it would be big news even if this applied only to the x230. Or even if it only applied to some x230s. It means there's a somewhat modern x64 laptop on which the ME can be disabled.

As an owner of an x230 I'm very very interested.

Reply on news.ycombinator.com