Hacker News Reader

Comment by amelius | Hacker News Reader

Suggested additions: 1. Don't use a CPU equipped with Intel ME or equivalent, or other system-level management engines like HP's iLO. 2. Look out for keylog devices.

Also, from a practical point of view: sshguard is very useful and easy to install.

View on HN

You mean, you want to drive to your data centre every single time something fails to boot, or have the awkward debugging session over the phone with remote hands? Or come in with a physical copy of the firmware update every time? Remote management is necessary in some situations. KVMs, ILO, and others have their issues, but it's a tradeoff. "Don't use" is not a great suggestion.

Ok, if you have to use something like iLO, then make sure to connect it only to an internal network. And update the thing frequently.

People expose IPMI to the internet?

lol you people. the internal network concept doesn't exist in any targeted threat model.

I do exactly this. Granted I only have 50 chassis to deal with and can emergency boot to rescue via PXE. After 1st generation ILO and the enforced insecurity of vendor KVM options I saw the light.

> Don't use a CPU equipped with Intel ME or equivalent, or other system-level management engines like HP's iLO.

This is a nice dream, but absolutely not practical in the real world. All the major hardware vendors have an equivalent, eg. CMIC for Cisco UCS, DRAC for DELL, etc etc.

Not to mention the impracticality of not having these when your equipment is locked inside a cage in a datacenter on the other side of town.

Google is purportedly aware of ME and working on removing it: https://www.tomshardware.com/news/google-removing-minix-mana...

But yeah, good luck convincing anyone that it's a good idea to run me_cleaner on production hardware.

I don't think you actually do this.

After thinking about it some more, I guess there are very special cases in which you might want to avoid Intel ME. Mostly if your adversary is the US Gov.

Reply on news.ycombinator.com