IPMI security

Portal Home > Knowledgebase > Articles Database > IPMI security

Posted by keith007, 03-22-2014, 05:23 PM
Hi All, I have a dedicated server with IPMI builtin on a dedi IP Its a supermicro brand server and the IP filter / firewall doesn't seem to work even with latest firmware applied Whats the best method to add protection and to prevent brute forcing this Cheers Keith
Posted by SajanP, 03-22-2014, 06:29 PM
The best thing to do is have the IPMI port be only available behind a VPN. That way, it's not on the public internet at all.
Posted by gone-afk, 03-22-2014, 07:35 PM
Agreed, get your provider to put it behind a firewall or vpn. Otherwise, there is a built in software firewall on the newer versions of the supermicro IPMI.
Posted by keith007, 03-22-2014, 07:51 PM
Cheers Requested hoster to unplug cable for time being Keith
Posted by Maxnet, 03-22-2014, 08:57 PM
Note that the Supermicro IPMI IP filter does not block anything by default. Need to add 0.0.0.0/0 DROP as last rule -after your ACCEPT rules for your range- to achieve that. Also make sure you disable IPv6
Posted by bachmanmichael, 03-22-2014, 09:16 PM
What we do is run a VPN server with two nic cards. One nic card is on the public network, the other on the private network with the IPMI devices. Any of our clients that request IPMI, we just add them a VPN account along with that. Works very well. It also alows us to put our private PXE boot server on the private lan for quick os installs.
Posted by Steven, 03-22-2014, 10:36 PM
The software firewall is iptables based so it's pretty effective.
Posted by keith007, 03-23-2014, 12:40 PM
thanks all I have this blocked at switch, support will enable in case its required Keith

Add to Favourites Print this Article