Restrictive user privileges
An information handling system may include a host system and a management controller configured to provide out-of-band management of the information handling system. The management controller may be configured to: receive, via a management bus of the management controller, a user login request for access to a first user account associated with the management controller; determine a second user account corresponding to the first user account, wherein the second user account is associated with a security policy; and provide the user access to the management controller via the first user account, wherein a privilege level of the provided access is based on a set of privileges associated with the second account.
1. An information handling system comprising:
a host system; and
a management controller configured to provide out-of-band management of the information handling system;
wherein the management controller is configured to:
receive, via a management bus of the management controller, a user login request from a particular user for access to a first user account associated with the management controller, wherein the first user account is an Intelligent Platform Management Interface (IPMI) account;
determine a second user account of the particular user, the second user account corresponding to the first user account, wherein the second user account is associated with a security policy, and wherein the second user account is a Security-Enhanced Linux (SELinux) user account; and
provide the particular user access to the management controller via the first user account, wherein a privilege level of the provided access is based on a set of privileges associated with the second account.
2. The information handling system of claim 1 , wherein the login request is associated with a secure shell (SSH) server.
3. The information handling system of claim 1 , wherein the login request is associated with a secure file transfer protocol (SFTP) server.
4. The information handling system of claim 1 , wherein the security policy is a security policy of the management controller.
5. The information handling system of claim 1 , wherein the privilege level is selected from the group consisting of administrator, operator, read-only, and none.
6. The information handling system of claim 1 , wherein the management controller is further configured to:
receive a request to create a new user account associated with the management controller; and
create the new user account based on a privilege level of a designated user account that is associated with the security policy.
7. A method comprising:
in an information handling system comprising a host system and a management controller configured to provide out-of-band management of the information handling system:
the management controller receiving, via a management bus, a user login request from a particular user for access to a first user account associated with the management controller, wherein the first user account is an Intelligent Platform Management Interface (IPMI) account;
the management controller determining a second user account of the particular user, the second user account corresponding to the first user account, wherein the second user account is associated with a security policy, and wherein the second user account is a Security-Enhanced Linux (SELinux) user account; and
the management controller providing the particular user access to the management controller via the first user account, wherein a privilege level of the provided access is based on a set of privileges associated with the second account.
8. The method of claim 7 , wherein the privilege level is selected from the group consisting of administrator, operator, read-only, and none.
9. The method of claim 7 , further comprising:
receiving a request to create a new user account associated with the management controller; and
creating the new user account based on a privilege level of a designated user account that is associated with the security policy.
10. An article of manufacture comprising a non-transitory, computer-readable medium having computer-executable code thereon that is executable by a processor of a management controller of an information handling system for:
receiving, via a management bus, a user login request from a particular user for access to a first user account associated with the management controller, wherein the first user account is an Intelligent Platform Management Interface (IPMI) account;
determining a second user account of the particular user, the second user account corresponding to the first user account, wherein the second user account is associated with a security policy of the information handling system, and wherein the second user account is a Security-Enhanced Linux (SELinux) user account; and
providing the particular user access to the management controller via the first user account, wherein a privilege level of the provided access is based on a set of privileges associated with the second account.
11. The article of claim 10 , wherein the login request is associated with a secure shell (SSH) server.
12. The article of claim 10 , wherein the login request is associated with a secure file transfer protocol (SFTP) server.
13. The article of claim 10 , wherein the security policy is associated with the management controller.
14. The article of claim 10 , wherein the privilege level is selected from the group consisting of administrator, operator, read-only, and none.
15. The article of claim 10 , wherein the code is further executable for:
receiving a request to create a new user account associated with the management controller; and
creating the new user account based on a privilege level of a designated user account that is associated with the security policy.