System and method for enabling and disabling of baseboard management controller configuration lockdown
An information handling system includes a processor and a baseboard management controller (BMC). The BMC receives a secure copy protocol (SCP) file including configuration information for the processor, determines whether the BMC is in a lockdown mode in response to receiving the SCP file, and applies the configuration information to change a configuration of the processor in response to determining that the information handling system is not in the lockdown mode.
1. An information handling system, comprising:
a processor; and
a baseboard management controller (BMC) configured to:
receive a secure copy protocol (SCP) file including configuration information for the processor;
determine whether the information handling system is in a lockdown mode in response to receiving the SCP file;
apply the configuration information to change a configuration of the processor in response to determining that the information handling system is not in the lockdown mode;
determine whether the SCP file includes a first digital signature in response to determining that the information handling system is in the lockdown mode; and
reject the configuration information in response to determining that the SCP file does not include the first digital signature.
2. The information handling system of claim 1 , the BMC further configured to:
validate the first digital signature to determine whether the first digital signature is authentic in response to determining that the SCP file includes the first digital signature; and
reject the configuration information in response to not validating that the first digital signature is authentic.
3. The information handling system of claim 2 , the BMC further configured to:
determine whether the SCP file includes a second digital signature in response to validating that the first digital signature is authentic.
4. The information handling system of claim 3 , the BMC further configured to:
apply the configuration information to change the configuration of the information handling system in response to determining that the SCP file does not include the second digital signature.
5. The information handling system of claim 3 , the BMC further configured to:
validate the second digital signature to determine whether the second digital signature is authentic in response to determining that the SCP file includes the second digital signature; and
reject the configuration information in response to not validating that the second digital signature is authentic.
6. The information handling system of claim 5 , the BMC further configured to:
store a public key associated with the second digital signature in response to validating that the second digital signature is authentic; and
apply the configuration information to change the configuration of the information handling system.
7. The information handling system of claim 1 , the BMC further configured to:
determine whether the configuration information includes lockdown information to disable the lockdown mode;
disable the lockdown mode in response to determining that the configuration information includes the lockdown information; and
delete a public key in response to determining that the configuration information includes the lockdown information.
8. The information handling system of claim 2 , the BMC further configured to:
determine that the first digital signature is associated with a first configuration setting of the information handling system in response to validating that the first digital signature is authentic;
determine that the configuration information is associated with the first configuration setting; and
apply the configuration information to change the first configuration setting in response to determining that the first digital signature and the configuration information are associated with the first configuration setting.
9. The information handling system of claim 8 , the BMC further configured to:
determine that the configuration information is not associated with the first configuration setting; and
reject the configuration information in response to determining that the first digital signature is associated with the first configuration setting and that the configuration information is not associated with the first configuration setting.
10. The information handling system of claim 2 , wherein the configuration information includes a factory default reset setting to restore the configuration to factory default settings.
11. A method comprising:
receiving, by a baseboard management controller (BMC) of an information handling system, a secure copy protocol (SCP) file including configuration information for the information handling system;
determining, by the BMC, whether the information handling system is in a lockdown mode in response to receiving the SCP file;
applying the configuration information to change a configuration of the information handling system in response to determining that the information handling system is not in the lockdown mode;
determining, by the BMC, whether the SCP file includes a first digital signature in response to determining that the information handling system is in the lockdown mode; and
rejecting the configuration information in response to determining that the SCP file does not include the first digital signature.
12. The method of claim 11 , further comprising:
validating, by the BMC, the first digital signature to determine whether the first digital signature is authentic in response to determining that the SCP file includes the first digital signature; and
rejecting the configuration information in response to not validating that the first digital signature is authentic.
13. The method of claim 12 , further comprising:
determining, by the BMC, whether the SCP file includes a second digital signature in response to validating that the first digital signature is authentic.
14. The method of claim 13 , further comprising:
applying, by the BMC, the configuration information to change the configuration of the information handling system in response to determining that the SCP file does not include the second digital signature.
15. The method of claim 13 , further comprising:
validating, by the BMC, the second digital signature to determine whether the second digital signature is authentic in response to determining that the SCP file includes the second digital signature; and
rejecting the configuration information in response to not validating that the second digital signature is authentic.
16. The method of claim 15 , further comprising:
storing, by the BMC, a public key associated with the second digital signature in response to validating that the second digital signature is authentic; and
applying the configuration information to change the configuration of the information handling system.
17. The method of claim 11 , further comprising:
determining, by the BMC, whether the configuration information includes lockdown information to disable the lockdown mode;
disabling, by the BMC, the lockdown mode in response to determining that the configuration information includes the lockdown information; and
deleting, by the BMC, a public key in response to determining that the configuration information includes the lockdown information.
18. The method of claim 12 , further comprising:
determining, by the BMC, that the first digital signature is associated with a first configuration setting of the information handling system in response to validating that the first digital signature is authentic;
determining, by the BMC, that the configuration information is associated with the first configuration setting;
applying the configuration information to change the first configuration setting in response to determining that the first digital signature and the configuration information are associated with the first configuration setting;
determining, by the BMC, that the configuration information is not associated with the first configuration setting; and
rejecting the configuration information in response to determining that the first digital signature is associated with the first configuration setting and that the configuration information is not associated with the first configuration setting.
19. The method of claim 12 , wherein the configuration information includes a factory default reset setting to restore the configuration to factory default settings.
20. An information handling system, comprising:
a management system; and
a baseboard management controller (BMC) configured to:
receive a secure copy protocol (SCP) file from the management system;
determine whether the BMC is in a lockdown mode in response to receiving the SCP file;
apply the configuration information to change a configuration of the processor in response to determining that the information handling system is not in the lockdown mode;
determine whether the SCP file includes a first digital signature in response to determining that the information handling system is in the lockdown mode; and
reject the configuration information in response to determining that the SCP file does not include the first digital signature.