System and method for monitoring and securing a baseboard management controller
In certain embodiments, a method for monitoring and securing a baseboard management processor is provided. The method includes coupling to a baseboard management controller of a computer system via a console port, maintaining a persistent connection to the baseboard management controller, monitoring data from the console port, determining from the data whether an unauthorized access has occurred, and sending an alert if the unauthorized access has occurred.
1. A method, comprising:
coupling a monitoring system to a baseboard management controller of a computer system via a console port;
maintaining a persistent connection from the monitoring system to the console port of the baseboard management controller regardless of whether the computer system is powered off, the persistent connection preventing any other connection from accessing the console port;
monitoring data received at the monitoring system from the console port;
determining, by the monitoring system, from the data whether an unauthorized access has occurred;
determining, by the monitoring system, a type of the unauthorized access if the monitoring system determines that the unauthorized access has occurred; and
sending, by the monitoring system, an alert if the unauthorized access has occurred, the alert indicating the determined type of the unauthorized access.
2. The method of claim 1 , further comprising:
securing access to the baseboard management controller.
3. The method of claim 1 , further comprising:
displaying the alert using a graphical user interface.
4. The method of claim 1 , the determining from the data whether the unauthorized access has occurred further comprising:
determining that a number of login failures have occurred; and
establishing the number of login failures exceeds a login failure threshold.
5. The method of claim 1 , the determining from the data whether the unauthorized access has occurred further comprising:
detecting a keyword in the data that indicates unauthorized access.
6. The method of claim 1 , the determining from the data whether the unauthorized access has occurred further comprising:
detecting a plurality of repeated requests from an Internet Protocol (IP) address for a plurality of different ports of the baseboard management controller.
7. The method of claim 1 , the determining from the data whether the unauthorized access has occurred further comprising:
detecting one or more register values corresponding to a signature of a malicious program.
8. The method of claim 1 , wherein the computer system is a virtual computer system.
9. The method of claim 1 , wherein:
the alert comprises one of a pop-up window or an email message; and
the alert is sent for viewing on a second computer system communicatively coupled to the monitoring system.
10. The method of claim 1 , wherein the baseboard management controller is operable to pass communications not directed to the baseboard management controller to the computer system.
11. A method, comprising:
coupling a monitoring system to a baseboard management controller of a computer system via a console port;
maintaining a persistent connection from the monitoring system to the console port of the baseboard management controller regardless of whether the computer system is powered off, the persistent connection preventing any other connection from accessing the console port;
monitoring data received at the monitoring system from the console port;
determining, by the monitoring system, from the data that an unauthorized access has occurred;
determining, by the monitoring system, a type of the unauthorized access if the monitoring system determines that the unauthorized access has occurred; and
sending, by the monitoring system, an alert that the unauthorized access has occurred, the alert indicating the determined type of the unauthorized access.
12. The method of claim 11 , further comprising:
securing access to the baseboard management controller.
13. The method of claim 11 , further comprising:
logging the data from the console port.
14. The method of claim 11 , further comprising:
displaying the alert using a graphical user interface.
15. The method of claim 11 , the determining from the data that the unauthorized access has occurred further comprising:
determining that a number of login failures have occurred; and
establishing the number of login failures exceeds a login failure threshold.
16. The method of claim 11 , the determining from the data that the unauthorized access has occurred further comprising:
detecting a keyword in the data that indicates unauthorized access.
17. The method of claim 11 , the determining from the data that the unauthorized access has occurred further comprising:
detecting a plurality of repeated requests from an Internet Protocol (IP) address for a plurality of different ports of the baseboard management controller.
18. The method of claim 11 , the determining from the data that the unauthorized access has occurred further comprising:
detecting one or more register values corresponding to a signature of a malicious program.
19. The method of claim 11 , wherein the computer system is a virtual computer system.
20. Software embodied in a non-transitory computer-readable medium and when executed operable to perform operations comprising:
coupling a monitoring system to a baseboard management controller of a computer system via a console port;
maintaining a persistent connection from the monitoring system to the console port of the baseboard management controller regardless of whether the computer system is powered off, the persistent connection preventing any other connection from accessing the console port;
monitoring data received at the monitoring system from the console port;
determining from the data that an unauthorized access has occurred;
determining a type of the unauthorized access if the monitoring system determines that the unauthorized access has occurred; and
sending an alert that the unauthorized access has occurred, the alert indicating the determined type of the unauthorized access.
21. The software of claim 20 further comprising:
securing access to the baseboard management controller.
22. The software of claim 20 further comprising:
logging the received data from the console port.
23. The software of claim 20 further comprising:
displaying the alert using a graphical user interface.
24. The software of claim 20 , the determining from the data that the unauthorized access has occurred further comprising:
determining that a number of login failures have occurred; and
establishing the number of login failures exceeds a login failure threshold.
25. The software of claim 20 , the determining from the data that the unauthorized access has occurred further comprising:
detecting a keyword in the data that indicates unauthorized access.
26. The software of claim 20 , the determining from the data that the unauthorized access has occurred further comprising:
detecting a plurality of repeated requests from an Internet Protocol (IP) address for a plurality of different ports of the baseboard management controller.
27. The software of claim 20 , the determining from the data that the unauthorized access has occurred further comprising:
detecting one or more register values corresponding to a signature of a malicious program.
28. The software of claim 20 , wherein the computer system is a virtual computer system.
29. A system, comprising:
one or more processing units operable to:
couple a monitoring system to a baseboard management controller of a computer system via a console port;
maintain a persistent connection from the monitoring system to the console port, of the baseboard management controller regardless of whether the computer system is powered off, the persistent connection preventing any other connection from accessing the console port;
monitor data received at the monitoring system from the console port;
determine from the data that an unauthorized access has occurred;
determine a type of the unauthorized access if the monitoring system determines that the unauthorized access has occurred; and
send an alert that the unauthorized access has occurred, the alert indicating the determined type of the unauthorized access.
30. The system of claim 29 , further comprising:
secure access to the baseboard management controller.
31. The system of claim 29 , further comprising:
display the alert using a graphical user interface.
32. The system of claim 29 , the determining from the data that the unauthorized access has occurred further comprising:
determine that a number of login failures have occurred; and
establish the number of login failures exceeds a login failure threshold.
33. The system of claim 29 , the determining from the data that the unauthorized access has occurred further comprising:
detect a keyword in the data that indicates unauthorized access.
34. The system of claim 29 , the determining from the data that the unauthorized access has occurred further comprising:
detect a plurality of repeated requests from an Internet Protocol (IP) address for a plurality of different ports of the baseboard management controller.
35. The method of claim 29 , the determining from the data that the unauthorized access has occurred further comprising:
detect one or more register values corresponding to a signature of a malicious program.
36. The system of claim 29 , wherein the computer system is a virtual computer system.