<html><body>
<p><tt><font size="2">Robert Collins <robertc@robertcollins.net> wrote on 05/13/2013 06:25:02 PM:<br>
<br>
<br>
> <br>
> Note though that the out of band IPMI network is almost certainly<br>
> attackable by tenants. You need a chassis controller that is not<br>
> configurable or managable by the card, to be able to have any<br>
> confidence that it won't be hosed rapidly.<br>
> </font></tt><br>
<br>
<tt><font size="2">The operative word being 'almost'. The problem being that it is exceptionally difficult to know whether a vendor both considers the scenario a priority and is competent in following through on that concern. It pretty much demands some trusted independent organization audit vendor implementations. This isn't specific to IPMI of course, anything of the same concept runs similar risks.</font></tt><br>
<br>
<tt><font size="2">Almost all IPMI implementations can at least be knocked offline inband. Quality implementations don't provide a way to gain access to the management network in a useful way (well, you can induce the platform to lie about alerts and throw those alerts at whatever target you want). It is *possible* to build a non-chassis based solution that is impervious to being knocked out of commision inband and/or being reliably reparable in such a case, but I don't think anyone has done it (too inconvenient as it requires restricting things like in-band configurable passwords and network port selection). It might be nice to have a command for operators to be able to use to lockdown in-band configuration. Chassis-based solutions might or might not be able to be knocked offline depending on vendor, but I'd guess most at least have a way to repair the configuration from a chassis manager regardless of configuration pushed in-band. </font></tt><br>
<br>
<tt><font size="2"><br>
> -Rob<br>
> <br>
> -- <br>
> Robert Collins <rbtcollins@hp.com><br>
> Distinguished Technologist<br>
> HP Cloud Services<br>
> <br>
> _______________________________________________<br>
> OpenStack-dev mailing list<br>
> OpenStack-dev@lists.openstack.org<br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
> <br>
</font></tt></body></html>