Hacker News Reader

Comment by Jonnax | Hacker News Reader

So I keep hearing that the IME can do remote KVM.

I've got an old laptop lying around, could I hook at up to my router and access it without remote desktop software from another PC on my network?

Or does this require some expensive intel software with a subscription?

View on HN

Standard VNC is enough. If you want other fancy features too (power control, remote media mounting, re-configuration), use Intel Manageability Commander (free): https://downloadcenter.intel.com/download/27807/Intel-Manage...

This would be a much better option: https://www.meshcommander.com/meshcommander

It works if the computer is fully vPro compliant. There are castrated versions of vPro for small businesses that lack the KVM feature. It’s all free and you just need to do the initial provisioning in the MEBx (post UEFI).

Again, having the ME in the CPU is not enough. The chipset, NIC, and BIOS/UEFI support matter.

> The chipset, NIC, and BIOS/UEFI support matter.

True but it has been shown a lot of motherboards that should not support these things do, or at least that they are software enabled features.

Some do have a subset of features enabled or that can be enabled (maybe, somehow). But my post was not meant to be generic or for a hacker, rather for a person who would like to use a Lenovo T450 with (AMT) KVM. While all Intel CPUs have the ME, this is not enough. The chances of "hacking" the rest of the features on such a system without explicit vPro support are slim to none for all intents and purposes.

Key words: AMT, vPro. You should have compatible CPU and board. Remote KVM is provided via VNC protocol, so any VNC viewer should work. You need to open web interface and proceed from there.

Basically it's a business feature and usually not available on consumer laptops.

And very annoyingly not available on the Intel NUC, even though remote-managing those would be very useful. I guess something about not wanting to canabalise their server market.

If IME could be reprogrammed then maybe there would be a way to add these features.

Intel NUC are weird little devices; for my home file server, which at most ever has one user accessing at a time, I replaced an old PC tower with a NUC and a 5 disk USB3 SATA dock. It works better, has excellent Linux support, and uses less power.

The device is weird because it strikes me as the perfect HTPC, and yet it isn't really marketed as such.

I've bought something like 10 of them (the oldest two are Gigabyte Brix, but I'll count those with them). There are a few home servers, but the main use is as a pool of machines to use for oVirt, Open Stack, Kubernetes and RHEL work. The machines get wiped and repurposed quite a bit.

They're a lot more convenient for this than actual 19" servers, since they take up a tiny fraction of the space and power of even a single server. However they would be so much more useful if I could remote IPMI into them rather than having to find a monitor, keyboard, HDMI cable and mouse every time I want to fix them.

They would also be reasonable for home theatre since they are silent and low power, while at the same time having decent CPUs, but they use Intel graphics so I guess they probably can't drive 4K + 60Hz displays, although I've never actually tried.

I only drive a 1080p display with it, so I couldn't comment on 4k; however, it runs most everything I throw at it from my Steam library, reasonably well. The newer Intel GPUs aren't that bad, and most games don't need much to be fun.

I’m running two 4k monitors with two+ year-old Intel gfx right now. Depends how old they are really.

Depends on the SKU. Lots of NUCs have full vPro (at least the Intel branded ones).

You are looking for NUC7i7DN(HE,KE). These SKUs do have AMT. They also have iSCSI support in UEFI. Yes, nice little machines.

There’s a real list: https://www.intel.com/content/www/us/en/support/articles/000...

Well, AMT looks very tempting because of the functionality.

On the other side because of security, I'm not sure whether I should be glad to use NUC models that don't have it at all.

So assuming I take the risk, what networking link does AMT require? Do I guess correctly that it works only over Ethernet? Thinking of mobile devices that have only a cellular modem link.

It works with ethernet and newer versions with wifi. The eth and wifi chips also must be the Intel ones.

It's a Lenovo ThinkPad T450, I would assume it's an "enterprise" laptop.

I'll give it a look, thanks.

You can easily tell from the CPU sticker on the corner of the laptop, below the keyboard. It should mention vPro.

Example: https://images-na.ssl-images-amazon.com/images/I/51FGMbh0rkL...

If it can be useful to others, my Thinkpad X240 mentions vPro on the sticker at the low left corner as well.

Lenovo had at least one model in each generation's lineup with vPro support since at least the X200/T400 (so just over 10 years).

Rule of thumb (as far as I know, not exhaustive): No i3 model has vPro support, i5 models may or may not have vPro depending on the particular CPU used, and more or less all i7 models have vPro.

Yes. You can do most anything you can do with IPMI which includes loading a CD over the network to reinstall the OS or redirecting the serial port.

On newer machines you can set the IME to connect to a IPsec tunnel when some conditions are met and keep the IME enabled when the machine is on battery power and a wireless network. This allows you to administer the device when it is "outside of the office."

> M.E.

> VNC

> IPsec tunnel

This being the state of enterprise, no wonder every Fortune listed company is getting their doors blown off.

You might find the following helpful, I followed a similar guide for testing on an old laptop a few years back:

https://www.cyberciti.biz/faq/remotely-access-intel-amt-kvm-...

I always wondered this and I never ever got to trying it. Ever since Intel introduced vPro.

Reply on news.ycombinator.com