2

In REF to http://threatpost.com/ipmi-protocol-bmc-vulnerabilities-expose-thousands-of-servers-to-attack and the hacks of several companies and web hosts have been hit and had their servers wiped from remote management hacking.

What can one do to protect their web based remote management ports?

So far I've begun isolating them on VPN connections and limiting customers to their own private VPN and VLANS and keeping the remote interfaces on local IPs.

Is there anything else that can be done to improve their security?

1

The only solid way to protect a service against zero-day exploits is to keep that service from being accessible from the Internet. That includes network-internal barriers to keep other compromised servers from being used as a starting point for an attack -- firewalling off IPMI from the Internet is pointless if someone can pass through the firewall to your web server and use it to perform the attack.

1

You may be interested in reading the following document: http://fish2.com/ipmi/bp.pdf. Moreover, I encourage you to read the other documentation made by this security researcher on IPMI which are very interesting and well written.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.