Unsolved
This post is more than 5 years old
131 Posts
0
28901
iDRAC7 Security Review
Recently I have been working with (gasp!) SuperMicro servers, and their IPMI implementation. Upon testing and review I have concluded that my only secure course of action with regard to the SM implementation is to completely disable it. It is just too fat of a target, and too easy to break.
So what about Dell's iDRAC? How secure is this system anyway. Is there a white paper narrowly focused on the security of this system?
DELL-Daniel My
Moderator
Moderator
•
6.2K Posts
0
December 21st, 2013 11:00
Hello
I could not locate an in-depth security paper. Here is one I found:
ftp://ftp.dell.com/Manuals/all-products/esuprt_electronics/esuprt_software/esuprt_remote_ent_sys_mgmt/integrated-dell-remote-access-cntrllr-7-v1.10.10_White%20Papers_en-us.pdf
Here is the iDRAC wiki page that has links to several white papers:
http://en.community.dell.com/techcenter/systems-management/w/wiki/3204.dell-remote-access-controller-drac-idrac.aspx
I think you are going to find that most IPMI is the same. IPMI is not something we develop in-house. IPMI is going to be the same across most manufacturers. The biggest security loophole with IPMI is cipher 0. You can disable cipher 0, but we do not disable it by default. For security reasons we set it to be disabled by default with a firmware update, but due to complaints we changed back to enabled by default.
You can disable IPMI over LAN, and you can turn off IPMI completely. I recommend that connect any management interface like an iDRAC to a secure VLAN that has MAC filtering or something else to limit access to only administrators. The iDRAC allows local access that can bypass several security measures. It is not a good idea to have it connected to the regular LAN that everyone else is on. If the iDRAC is not segregated on your LAN then you can disable IPMI over LAN if you are concerned about it's security.
Putting the iDRAC on a restricted access VLAN or using port security, disabling ciper 0 so that a login is required when connected locally, and using the normal security features of passwords and certificates should combine to provide an acceptable level of security.
Thanks
Jack_the_coiner
131 Posts
0
December 23rd, 2013 11:00
HI Daniel,
Thanks very much for the reply. I am in a ticklish situation as far as IPMI/iDRAC is concerned. I love the utility it provides, but hate the exposure. It looks like 1.50.50 has some security updates, and I would be interested in using that. Can you tell me if the m420 supports that version? The documentation I can find says the m420 support 1.40.40, but that may be old.
DELL-Daniel My
Moderator
Moderator
•
6.2K Posts
0
December 26th, 2013 09:00
Versions differ between blades and servers, so the numbering system usually does not coincide. I show the latest version is 1.46.45 for the M420. A security update is mentioned in the release notes:
http://www.dell.com/support/drivers/us/en/04/DriverDetails/Product/poweredge-m420?driverId=JYX4C&osCode=WS8R2&fileId=3288107913&languageCode=en&categoryId=ES