On Wed, Apr 15, 2009 at 10:12 AM, Andy Cress <[email protected]> wrote:
>
> I'm not sure if this is the cause, but I do see a security hole in your IPMI
> LAN configuration, under LAN Parameter 2 (Auth Type Enables):
>> : User : NONE MD2 MD5 PASSWORD
>> : Operator : NONE MD2 MD5 PASSWORD
>> : Admin : NONE MD2 MD5 PASSWORD
>> : OEM : NONE MD2 MD5 PASSWORD
> That should omit the "NONE" bit in this case for all 4 bytes. (i.e. 0x17 ->
> 0x16)
> Can you try changing that in the server IPMI LAN configuration?
>
Well, I got rid of the NONE in front of 4 of them, but it won't let me
set the auth level for OEM. I get the following error:
$ ipmitool lan set 2 auth OEM md5,password
Invalid authentication level: OEM
So, this leaves me with the following:
===========================
$ ipmitool lan print 2
Password:
Set in Progress : Set Complete
Auth Type Support : NONE MD5 PASSWORD
Auth Type Enable : Callback : MD5 PASSWORD
: User : MD5 PASSWORD
: Operator : MD5 PASSWORD
: Admin : MD5 PASSWORD
: OEM : NONE MD5 PASSWORD
IP Address Source : Static Address
IP Address : 192.168.1.31
Subnet Mask : 255.255.255.0
MAC Address : 00:a0:d1:e8:63:ab
SNMP Community String : public
Default Gateway IP : 192.168.1.1
802.1q VLAN ID : Disabled
802.1q VLAN Priority : 0
RMCP+ Cipher Suites : 0,1,2,3
Cipher Suite Priv Max : aaaaXXXXXXXXXXX
: X=Cipher Suite Unused
: c=CALLBACK
: u=USER
: o=OPERATOR
: a=ADMIN
: O=OEM
===========================
And just to see what the user list looks like:
$ ipmitool user list 2
ID Name Callin Link Auth IPMI Msg Channel Priv Limit
1 true false true ADMINISTRATOR
2 Operator true true true OPERATOR
3 admin true true true ADMINISTRATOR
4 OEM true true true OEM
==========================
And I've set the passwords for both user #1 and channel #2
$ ipmitool user set password 1 XYZ
$ ipmitool lan set 2 password XYZ
============================
But still, I can connect using -C0:
$ ipmitool -C0 -I lanplus -H 192.168.1.31 chassis power status
Password:
Chassis Power is on
BTW, thanks for taking the time to look at this.
------------------------------------------------------------------------------
This SF.net email is sponsored by:
High Quality Requirements in a Collaborative Environment.
Download a free trial of Rational Requirements Composer Now!
http://p.sf.net/sfu/www-ibm-com
_______________________________________________
Ipmitool-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ipmitool-devel
