3

I have some SuperMicro servers which I use MAAS to provision.

I'm intrigued that upon PXE-booting them, they auto-magically gain a 'maas' user in their local BMC users DB, with a random password which is clearly set by the MAAS server, as it's then able to control the servers over IPMI.

This happens despite having modified the factory default 'admin' credentials on the BMCs. It's very convenient but leaves me wondering how MAAS achieves this? Some kind of in-band interface between the main server and the BMC?

So my questions are:

  1. Is this safe/expected behaviour or does it suggest the servers haven't been properly secured?
  2. Is there a way to influence the role of the user MAAS creates on the BMC? At present it's created with 'Administrator' role; I'd rather have smth less privileged, such as 'Operator', which would still allow power operations that MAAS requires.

Related question: How do you add a machine to MAAS with IPMI power using CLI Note that I did not use the CLI mentioned on that question; all I did was PXE-boot my servers on a network enrolled in MAAS DHCP.

MAAS 2.3 (2.0-2.2 had same behaviour)

  • Are you sure this wasn't added locally after OS-installation? Accessing /dev/ipmi* should always work without password as far as I know. – Sebastian Stark Jul 16 '18 at 16:31
  • Ah yes that makes perfect sense thank you! So that's probably smth MAAS does during its "commissioning" stage (ie: before the actual OS is rolled out). I think this qualifies as an answer to my original question - at least the first half - care to promote it? – sxc731 Jul 17 '18 at 16:43
1

With e. g. ipmitool it is possible to directly access the ipmi controller using the /dev/ipmi0 device (or similar). Since this can be done only as root and locally, it does not require an IPMI user name and password. Presumably this is what MAAS does an deployment of a new machine.

As to how to define how MAAS creates an account for its own management needs I can not answer, but it should be possible to change later using this command:

$ maas-cli maas node update <system-id> power_type="ipmi" \
power_parameters_power_user=<user> \
power_parameters_power_pass=<password>

In any case: In general it is advised to set the default IPMI password to something sane and in addition have the LAN port of IPMI devices in a separate vlan or physical network.

| improve this answer | |
  • Thanks Sebastian. Taking your pointer a little further seems to suggest it's not possible to change the IPMI user profile or at least it's not totally obvious how to do it. Here's the dict returned by the MAAS cli when querying those power-parameters: maas $PROFILE node power-parameters $sysid Machine-readable output follows: { "power_user": "maas", "power_address": "<ip_address>", "power_pass": "<redacted>", "power_driver": "LAN_2_0", "mac_address": "" } – sxc731 Jul 17 '18 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.