Comment by EvanAnderson | Hacker News Reader

Comment by EvanAnderson | Hacker News Reader

Parent Full thread

Reading about the OP's issue got me to a doc from Intel (http://www.intel.com/content/dam/doc/application-note/sideba...) re: the "NC Sideband Interface", which sounds like the place where the bug that bit you "lives". Reading over that doc made me shudder a few times, thinking about the complexity and, thus, potential bugs that could be lurking there. I wonder if the OP's bug was related, too.

Having the NIC inspecting incoming frames and potentially diverting them to the management controller sounds like a scary proposition. I'd almost rather just have dedicated Ethernet hardware for the management controller. The decrease in switch ports needed is certainly seductive, but I wonder if it's worth the risk.

(Do you happen to recall which Intel motherboard this bit you on? I was just getting out of whitebox Intel motherboard-based server builds about the time you're describing, but I'm just curious if only for the nostalgia.)

"IPMI operates independently of the OS and allows administrators to manage a system remotely even without an OS, system management software, and even if the monitored system is powered off (along as it is connected to a power source). IPMI can also function after an OS has started, offering enhanced features when used with system management software."

Yikes! Sounds like system management mode in a BIOS!

It's worse than that. It's not BIOS-- it's a freestanding computer.

You'll enjoy this (or be horrified by it): http://fish2.com/ipmi/itrain.html

But it's a freestanding computer that means that I don't need to go to the data center at two in the morning to bring up a box that's kernel panicked.

Yeah, be careful with it. Firewall it silly. But recognize that it's a tool that can be very useful.

They're definitely useful tools-- don't get me wrong about that. The fear is that they're controlled, essentially, by an in-band signaling mechanism.

Being grafted onto the same NICs on the server computer that you might potentially expose to the Internet makes firewalling them a more difficult proposition. I get a lot of piece of mind from having management interfaces on an an out-of-band control network whenever possible.

If you use your BMC's "pass-through" capability to push its traffic through your regular NICs, you're Doing It Wrong. In fact, if you're not running a separate physical network (not merely separate VLANs) that is, to the extent possible, air-gapped from the rest of the world for your IPMI traffic, you're probably still Doing It Wrong.

"Yikes! Sounds like system management mode in a BIOS!"

Or, "Sounds like an advanced persistent hardware rootkit!"

I don't remember which motherboard it was, sorry. Looking at my resume, this was back in the 2000-2001 time frame.

Reply on news.ycombinator.com