IBM Support

Risk of using IPMI on IMM reported by Nessus - IBM Systems

Troubleshooting


Problem

Integrated Management Module (IMM) and IMM2 provide Intelligent Platform Management Interface (IPMI) access by default. Risks with the IPMI have been identified and documented. The RAKP protocol, which is specified by the IPMI standard for authentication, is vulnerable. If the user runs Nessus or another security tool to scan on IMM or IMM2, users see risk 'IPMI v2.0 Password Hash Disclosure' being reported. As IPMI is the standard platform management protocol and interface, there is currently no fix for the vulnerability.

Resolving The Problem

Source

RETAIN tip: H214790

Symptom

Integrated Management Module (IMM) and IMM2 provide Intelligent Platform Management Interface (IPMI) access by default. Risks with the IPMI have been identified and documented. The RAKP protocol, which is specified by the IPMI standard for authentication, is vulnerable.

If the user runs Nessus or another security tool to scan on IMM or IMM2, users see risk 'IPMI v2.0 Password Hash Disclosure' being reported.

As IPMI is the standard platform management protocol and interface, there is currently no fix for the vulnerability.

Affected configurations

The system can be any of the following servers:

  • Flex System x220 Compute Node, type 2585, any model
  • Flex System x220 Compute Node, type 7864, any model
  • Flex System x220 Compute Node, type 7906, any model
  • Flex System x222 Compute Node, type 2589, any model
  • Flex System x222 Compute Node, type 7916, any model
  • Flex System x240 Compute Node, type 7863, any model
  • Flex System x240 Compute Node, type 7863 E5-xxxxV2, any model
  • Flex System x240 Compute Node, type 8737, any model
  • Flex System x240 Compute Node, type 8737 E5-xxxxV2, any model
  • Flex System x240 Compute Node, type 8738, any model
  • Flex System x240 Compute Node, type 8956, any model
  • Flex System x280 X6 Compute Node, type 4259, any model
  • Flex System x280 X6 Compute Node, type 7903, any model
  • Flex System x440 Compute Node, type 2584, any model
  • Flex System x440 Compute Node, type 7917, any model
  • Flex System x480 X6 Compute Node, type 4259, any model
  • Flex System x480 X6 Compute Node, type 7903, any model
  • Flex System x880 X6 Compute Node, type 4259, any model
  • Flex System x880 X6 Compute Node, type 7903, any model
  • System x3100 M4, type 2582, any model
  • System x3100 M5, type 5457, any model
  • System x3250 M4, type 2583, any model
  • System x3250 M5, type 5458, any model
  • System x3500 M4, type 7383, any model
  • System x3500 M4, type 7383 E5-xxxxV2, any model
  • System x3530 M4, type 7160, any model
  • System x3530 M4, type 7160 E5-xxxxV2, any model
  • System x3550 M4, type 5459, any model
  • System x3550 M4, type 7914, any model
  • System x3550 M4, type 7914 E5-xxxxV2, any model
  • System x3630 M4, type 7158, any model
  • System x3630 M4, type 7158 E5-xxxxV2, any model
  • System x3650 M4 BD, type 5466, any model
  • System x3650 M4 HD, type 5460, any model
  • System x3650 M4, type 7915, any model
  • System x3650 M4, type 7915 E5-xxxxV2, any model
  • System x3690 X5, type 7147, any model
  • System x3690 X5, type 7148, any model
  • System x3690 X5, type 7149, any model
  • System x3690 X5, type 7192, any model
  • System x3750 M4, type 8718, any model
  • System x3750 M4, type 8722, any model
  • System x3750 M4, type 8733, any model
  • System x3750 M4, type 8752, any model
  • System x3755 M3, type 7164, any model
  • System x3850 X5, type 7143, any model
  • System x3850 X5, type 7145, any model
  • System x3850 X5, type 7146, any model
  • System x3850 X5, type 7191, any model
  • System x3850 X6, type 3837 (4-socket, 3 year warranty), any model
  • System x3850 X6, type 3839 (4-socket, 4 year warranty), any model
  • System x3950 X5, type 7143, any model
  • System x3950 X5, type 7145, any model
  • System x3950 X6, type 3837 (8-socket, 3 year warranty), any model
  • System x3950 X6, type 3839 (8-socket, 4 year warranty), any model

This tip is not software specific.

This tip is not option specific.

The following system firmware levels are affected: all versions of IMM/IMM2

Workaround

Several methods are recommended to mitigate the issue and improve system security.

  1. Change the pre-configured user name and password when the server is deployed. Doing so will prevent unauthorized users from gaining access to IMM or IMM2 through the pre-configured user account.
  2. If a user is not managing a server using IPMI, IMM or IMM2 can be configured to disallow IPMI network access from the user accounts. This can be accomplished by using the ipmitool utility or a similar utility for managing and configuring IPMI management controllers.

    Here is an example of an ipmitool command to disable the network access for an IPMI user:

      ipmitool channel setaccess 1 #user_slot# privilege=15

    Replace #user_slot# in the above command with the actual slot number (1 through 12) and repeat for each IMM or IMM2 user that has been configured. The example above details the command when it is run directly on the server itself. If the ipmitool command is run remotely over the network, or if a different utility is used, the command will be different. Consult the documentation for the utility in use to determine the correct command syntax. Disallowing IPMI network access will remove the ability to use the weakness present in the IPMI RAKP protocol to discover user account credentials.

  3. Use strong passwords, at least 16 characters long with a mixture of upper and lowercase letters, numbers, and special characters. By using longer, more complex passwords it makes it more difficult for malicious users to discover valid user credentials.
  4. Keep the management network separate from the public network. Keeping the management network separate lessens security exposures by reducing the number of individuals who can access IMM.

Additional information

The authentication process for IPMI requires the management controller to send a hash of the requested user's password to the client, prior to the client authenticating. This process is a key part of the IPMI specification. The password hash can be broken by using an offline brute force or dictionary attack.

Document Location

Worldwide

Operating System

System x:Operating system independent / None

PureFlex System and Flex System:Operating system independent / None

[{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU01DEW","label":"System x->System x3500 M4->7383"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU01DKP","label":"System x->System x3650 M4->7915"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU01FYU","label":"System x->System x3550 M4->5459"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU01GBW","label":"System x->System x3750 M4->8733"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU01GCQ","label":"System x->System x3530 M4->7160"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"QU01GQR","label":"PureFlex System and Flex System->x240 Compute Node->7863"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"QU01GRH","label":"PureFlex System and Flex System->x240 Compute Node->8737"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"QU01GRJ","label":"PureFlex System and Flex System->x220 Compute Node->7906"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"QU01GRM","label":"PureFlex System and Flex System->x440 Compute Node->7917"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"QU02BWN","label":"PureFlex System and Flex System->x222 Compute Node->7916"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU04SRF","label":"System x->System x3850 X5->7146"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU04SRO","label":"System x->System x3850 X5->7145"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU04SZB","label":"System x->System x3950 X5->7145"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU04WDX","label":"System x->System x3690 X5->7149"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU04WDY","label":"System x->System x3690 X5->7148"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU90ABE","label":"System x->System x3755 M3->7164"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU90ABO","label":"System x->System x3850 X5->7191"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU90ABQ","label":"System x->System x3690 X5->7147"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU90ABX","label":"System x->System x3850 X5->7143"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU90ACJ","label":"System x->System x3100 M4->2582"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU90ACK","label":"System x->System x3250 M4->2583"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU90ACM","label":"System x->System x3690 X5->7192"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU90ADT","label":"System x->System x3950 X5->7143"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU91IPI","label":"System x->System x3550 M4->7914"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU91NAJ","label":"System x->System x3750 M4->8722"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QU91NCW","label":"System x->System x3630 M4->7158"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"QU91OLT","label":"PureFlex System and Flex System->x220 Compute Node->2585"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"QUOEDBG","label":"PureFlex System and Flex System->x240 Compute Node->8738"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QUOEJ2R","label":"System x->System x3650 M4 HD->5460"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QUOEKUB","label":"System x->System x3250 M5->5458"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QUOEVPK","label":"System x->System x3850 X6->3837"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QUOEVSH","label":"System x->System x3950 X6->3837"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QUOEVSP","label":"System x->System x3950 X6->3839"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QUOEWIQ","label":"System x->System x3750 M4->8752"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QUOEWJD","label":"System x->System x3750 M4->8718"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"QUOEZVT","label":"PureFlex System and Flex System->x280 X6 Compute Node->4259"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"QUOEZVV","label":"PureFlex System and Flex System->x480 X6 Compute Node->4259"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"QUOEZVX","label":"PureFlex System and Flex System->x880 X6 Compute Node->4259"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"QUOEZZB","label":"PureFlex System and Flex System->x880 X6 Compute Node->7903"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"QUOEZZD","label":"PureFlex System and Flex System->x280 X6 Compute Node->7903"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"QUOEZZG","label":"PureFlex System and Flex System->x480 X6 Compute Node->7903"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QUOEZZO","label":"System x->System x3100 M5->5457"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU016","label":"Multiple Vendor Support"},"Product":{"code":"QUOFE4B","label":"System x->System x3650 M4 BD->5466"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"QUOFECN","label":"System x->System x3850 X6->3839"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}},{"Type":"HW","Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"QUOFM3R","label":"PureFlex System and Flex System->x240 Compute Node->8956"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
30 January 2019

UID

ibm1MIGR-5098284

Page Feedback