0

When enabling Emergency Management Services on Windows, one can access a limited terminal from a serial port, by default there's no authentication required.

To leave the limited environment, you need to authenticate with an account.

This limited environnement can still :

  • Reboot and shutdown the service immediately (like the power button was long-pressed)
  • Kill process
  • See running process
  • Change date
  • Change network configuration
  • Create memory dump from kernel and selected process

Is there a document I missed on securing the access of this feature or is it 100% up to third party means to secure this access?

1 Answer 1

1

At least according to Wikipedia, for EMS specifically, it says:

EMS is enabled per default in case BIOS serial console redirection is supported and enabled beforehand

I don't know if that specifically applies to SAC as well, according to the same article, EMS and SAC are separate things as quoted below:

Although EMS and SAC are separate and distinct concepts, EMS itself is also sometimes referred to as SAC, due to the prompt presented (SAC>) to the user once the OS is booted.

Off the top of my head, I would bet that this is indeed the case for SAC as well - I don't think that any OS (even Windows) is going to willy-nilly start spewing data over a serial port on boot unless it's explicitly configured to do so by enabling redirection in the BIOS if your system supports it - otherwise, especially in environments with legacy serial hardware, it could cause damage or worse - imagine a CNC machine receiving random data when the system boots up and interpreting it as commands and moving around potentially causing damage or hurting someone or worse.

If your not using a proper server-type system, than likely you have no redirection options or support anyhow. If you are, then it should be easy to disable redirection in the BIOS and/or management tool (eg. IPMI, iDRAC, etc)

Also, security-wise it's only an issue if someone could physically access the serial port of the server or alternatively if you have redirection enbaled and you're also using something like SOL (serial-over-LAN), in which case standard firewall/VLAN considerations would apply.

To answer the part of your question:

"is it 100% up to third party means to secure this access?"

I assume that it would indeed be 100% up to you and/or third party means to secure such access. It's considered a debugging tool and, otherwise, generally securing a serial port is not often considered due to physical access requirements and in such cases where physical access is an issue, one can simply disable it by disabling redirection after boot in the BIOS and only enabling it if/when needed.

As a low-level/debug/recovery tool, having any sort of authentication and authorization would be likely excessive and, for recovery issues, potentially cause problems locking you out - for example, if you had to create a user/pass and it was stored on your HD w/your Windows installation or even on the EFI partition somewhere, if your disk corrupts or crashes, you'd not be able to log in to do any recovery/debugging tasks.

As an aside, to me it seems also that it's not inconceivable that there could be an OS-level option to specify a serial port for such use, though I also question the usefulness of that ability since EMS/SAC is most likely mostly used for recovery situations - you can still enable redirection in the BIOS if the system needs recovery/isn't booting, whereas configuring such an option may not be possible in that case. If such an option exists in Windows, it might then may not require the BIOS to support redirection but then likely would rely on some sort of storage, causing it to have the same potential issues I mentioned previously for authentication and authorization.

Unfortunately, while I've been using Windows almost daily since v3.1, I'm more of a Linux/Unix guy and thus not so well versed with some of the internal/low level things like this - I didn't even know it existed until today; I assumed something like it probably existed for Windows stuff but I was Googling some stuff about my servers serial settings and console redirection when I came across the EMS/SAC terms, which curiosity, rabbit hole, et cetera + now we're here.

I've not been able to find too much documentation regarding EMS/SAC other than a page here with some commands and information in what is apparently a manual for a program called nPartition.

There's also a few pages about it in some cloud providers' docs like AWS, Azure and Google Cloud which makes sense as I'm sure it's one of the few cases where it might truly be useful. Also doesn't help that "Smart App Control" is a Windows feature that's also shortened to SAC often.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .