Guidelines on out-of-band server management via integrated Lights-out services (iLO, iDRAC etc.)

Question

Several CVEs (CVE-2012-3271, CVE-2011-4158, and earlier) point out vulnerabilities in remote server administration firmware; what are the guidelines on hardening this extremely useful component of modern data centers, beyond the obvious regular (and urgent) firmware updates, firewalling and setting up audit trails?

Answer 1

Most important thing: don't put them on the internet :). Make a seperate network or vlan for them.