Re: Debian default desktop environment
John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> writes:
> On 04/07/2014 07:39 PM, Russ Allbery wrote:
>> Ah, BMC. Now every computer comes with an extra full-fledged computer!
>> The main computer is for your use, and the other computer is for the
>> use of the attacker.
> That's why we block the kvms in our firewall so they cannot be reached
> from outside. I'm sorry, but when you have hundreds of servers in your
> server room, there is no other way than using automatic deployment and
> kvm over network.
Oh, sure, I'm not disagreeing with that part.
Those built-in controller "subcomputers" have an absolutely awful security
profile, though. Be careful even of attackers on your same network. It's
a great way to get a toehold on your server in a way that won't show up
through any host-based intrusion detection system and lets the attacker
bypass all host and kernel security.
Basically, you want to disable them whenever possible and, failing that,
limit access to them as tightly as you possibly can. They have about as
much security as the maintenance port on your car.
And, of course, non-free software from top to bottom.
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: