How to disable ipmi over lan using ipmitool

command-line-interfacedraciloipmiipmitool

I would like to know if it is possible to disable ipmi over lan via ipmitool.

Setting the IP to 0.0.0.0 as stated here http://support.unitrends.com/ikm/questions.php?questionid=642 did not do what I hoped for. In fact it did nothing.

ipmitool -I lanplus -H hostname -U user -a lan set 1 ipaddr 0.0.0.0

Ipmitool is the only ipmi management utility available on that jumphost.

I would alternatively be interested in ways to disable impi over lan via ssh on hp hosts.

For those that came here from google, here is how to disable ipmi over lan via ssh on dell hosts: connect via ssh to the idrac, open racadm and use it to disable this service. Documentation can be found here: http://web.mit.edu/cron/documentation/dell-server-admin/en/idrac1/chap09.htm

Feel free to post if you know something remotely connected 🙂

Thank you!

Best Answer

Here is another way to disable lan channel :

ipmitool lan set 1 access off

Related Solutions

Power management over IPMI and HP iLO2

Well, for an HP ILO2 management processor, you can do this via ssh. Something like ssh -l Administrator 192.168.1.x "power warm" would do a warm boot of the server. I've never attempted via ipmitool, though. You can also SSH into the ILO2 and examine the command-line options:

</>hpiLO-> power

power: server power is currently: On

</>hpiLO-> power help

POWER    : Control server power.
power          - Display the current server power state
CLP COMMAND    - show /system1 enabledstate
power on       - Turn the server on
CLP COMMAND    - start /system1
power off      - Turn the server off
CLP COMMAND    - stop /system1
power reset    - Reset the server
CLP COMMAND    - reset /system1
power warm     - Warm boot the server
CLP COMMAND    - reset /system1 soft

This thread on the HP forums also addresses the issue for Linux-based systems.

http://h30499.www3.hp.com/t5/General/Using-ipmitool-with-iLO-2/m-p/3921246/highlight/true#M14290

Security – Restrict IPMI access on Dell BMC and iDRAC to an allowed IP range

If you have switched environment and you need to restrict access to IPMI, the way to do it is to make ACL policy on the core switch, so this way you can restrict access from particular networks to this subnet or service. You can use only INPUT chain to do this, for example, if your IPMI is on 192.168.110.0/24 VLAN1 and your Desktop is on 10.0.0.0/24 VLAN2 and isolated LAN on 10.0.1.0/24 VLAN3, you can setup rule as on below example. However, if you want to restrict it on the same subnet, it is not done and cannot be done this way, the restricted client must be on different LAN (routable ip range).

So simply, on the core switch you can load the policy and specify

#Allow Broadcast
From Any To ff:ff:ff:ff:ff:ff Permit

#Allow Multicast
From Any To 224.0.0.0/4 Permit

#Anti-spoofing rules
From 192.168.110.0/24 to 0.0.0.0/0 VLAN1 Permit
From 0.0.0.0/0 to 192.168.110.0/24 VLAN1 Permit
From 10.0.0.0/24 to 0.0.0.0/0 VLAN2 Permit
From 0.0.0.0/0 to 10.0.0.0/24 VLAN2 Permit
From 10.0.1.0/24 to 0.0.0.0/0 VLAN3 Permit
From 0.0.0.0/0 to 10.0.1.0/24 VLAN3 Permit

#Permit IPMI from VLAN2
#You can narrow this rule to allow IPMI only
From 10.0.0.0/24 to 192.168.110.0/24 Permit
From 192.168.110.0/24 to 10.0.0.0/24 Permit

#Allow VLAN3 to VLAN1
From 10.0.1.0/24 to 10.0.0.0/24 Permit
From 10.0.0.0/24 to 10.0.1.0/24 Permit

#Block any other VLAN to VLAN communication, and allow internet browsing for VLAN3 (destination 0.0.0.0/0)
From 10.0.0.0/8 to 10.0.0.0/8 Deny
From 192.168.0.0/16 to 192.168.0.0/16 Deny
From 10.0.0.0/8 to 192.168.0.0/16 Deny
From 192.168.0.0/16 to 10.0.0.0/8 Deny

From 10.0.1.0/24 to 0.0.0.0/0 Permit
From 0.0.0.0/0 to 10.0.1.0/24 Permit

From 0.0.0.0/0 to 0.0.0.0/0 Deny

ps. Your core switch (router forwarding between VLANs) definitely supports this kind of ACL.

Best Answer

Related Solutions

Power management over IPMI and HP iLO2

Security – Restrict IPMI access on Dell BMC and iDRAC to an allowed IP range

Related Topic