Securing IPMI without losing remote console access
Server management interfaces are scary thing. Please do not put IPMI directly to internet. Help.
My approach:
- dedicate VLAN 998 for IPMI only
- trunk port to management workstation
- no gateway on IPMI subnet
- for emergency access, jump box inside same VLAN with WireGuard to my laptop
This keeps console access via web/Java but removes exposure. Downside: need physical presence or VPN to site for recovery if network breaks.
What do others use? VPN-only? Air-gapped with serial console? Curious about learned experience.
8-char NTLM found in 4min 32sec