Out-of-band remote management station
View Patent ↗A management system for a computer data network comprises a remote management station connected to an analog communication system and connected to a device console port of a co-located computer device. The remote management station comprises (a) an embedded processor, (b) a connecting means to the analog communication system, and (c) a connecting means to the device console port. The remote management station is configured to detect a user connecting to or disconnecting from the device console port via the remote management station. The remote management station is configured for one or more of the following: (a) logging the user off the device console port when the user disconnects or is disconnected from the console port; (b) logging a previous user off the device console port before allowing a new user to access the device console port; or (c) monitoring messages sent to the device console port
1. A management device, comprising:
a first interface configured to receive, via a first network, a request to manage a network device;
a second interface configured to receive, via a second network, an encrypted request to manage the network device that is conveyed through the network device, wherein the second interface is configured to couple to the network device, and to communicate with an authentication server via the second network to determine whether a request to manage the network device is authorized;
a third interface configured to couple to a console port of the network device;
wherein the management device is configured, in response to a request to manage the network device being authorized, to:
receive management commands for the network device via the second interface, wherein the management commands are executable by the network device to change configuration settings of the network device;
convey the received management commands to the network device via the third interface; and
receive responses to the management commands from the network device via the third interface.
2. The management device of claim 1 , wherein the first interface includes a communication device configured to communicatively couple to a telecommunication network.
3. The management device of claim 1 , wherein the management device is further configured to receive management commands for the network device via the first interface.
4. The management device of claim 1 , wherein the management device is configured to notify an administrator in response to detecting a power failure.
5. The management device of claim 1 , wherein the management device is configured to convey the received management commands within one or more packets via the third interface.
6. The management device of claim 1 , wherein the management device is configured to filter what management commands are conveyed to the network device.
7. The management device of claim 1 , wherein the management device is configured to log management commands forwarded to the console port of the network device via the third interface.
8. A method, comprising:
a management device receiving an encrypted request to permit an administrator to manage a network device communicatively coupled to the management device;
in response to receipt of the request, the management device contacting an authentication server via a data network to determine whether the administrator is authorized to manage the network device;
the management device receiving management commands issued by the administrator, wherein the management commands are executable by the network device, wherein the management commands are conveyed to the management device through the network device; and
in response to determining that the administrator is authorized, the management device conveying the management commands to a console port of the network device to facilitate management of the network device, wherein the management commands are conveyed via an interface of the management device, wherein the interface is coupled to the console port.
9. The method of claim 8 , further comprising:
the management device receiving, via a telecommunication network, a request to manage the network device;
the management device detecting an inability to communicate with the authentication server via the data network; and
the management device contacting the authentication server via the telecommunication network.
10. The method of claim 9 , wherein the management device uses public-key encryption to contact the authentication server via the telecommunication network.
11. The method of claim 8 , wherein the management device receives the request via a telecommunication network interface of the management device, and wherein the method further comprises:
the management device detecting a failure associated with the telecommunication network interface; and
the management device notifying an administrator of the failure via the data network.
12. The method of claim 8 , wherein receiving the request includes:
the management device receiving a telephone call to establish a telephone connection;
the management device determining to answer the call based on received caller identification information associated with the call; and
the management device receiving the request via the telephone connection.
13. The method of claim 8 , wherein the management device receives the management commands via a secure shell protocol and conveys the management commands as clear text.
14. The method of claim 8 , wherein the management commands are associated with a network time protocol (NTP).
15. A management device, comprising:
a processor configured to facilitate controlling access to a console port of a network routing device by a remote administrator; and
a data network interface, wherein the management device is configured to communicate with an authentication server via the data network interface to authenticate the remote administrator to determine to cause management commands of the remote administrator to be conveyed to the console port, wherein the management commands include commands executable to change a configuration setting of the network routing device, wherein the data network interface is configured to receive an encrypted management request and management commands for the network routing device that are conveyed through the network routing device.
16. The management device of claim 15 , wherein the management device is configured to:
detect a communication failure associated with the data network interface;
in response to detecting the communication failure, send an authentication request for the administrator to the authentication sever via a terminal of the administrator; and
receive, via the terminal, a corresponding response to the authentication request.
17. The management device of claim 16 , wherein the authentication request includes a challenge for the authentication server, and wherein the corresponding response includes a hash responsive to the challenge.
18. The management device of claim 15 , wherein the management commands are associated with a simple network management protocol (SNMP).
19. The management device of claim 15 , wherein the management device is configured to cycle power provided to the network device from a power supply.
20. The management device of claim 15 , wherein the authentication server is configured to implement an access control server (ACS).
21. The management device of claim 15 , wherein the management device is configured to receive encrypted management commands from the administrator via a telecommunication network connection.
22. The management device of claim 15 , wherein the management device is configured to receive encrypted management commands from the administrator via a secure internet protocol tunnel established over the data network.