I've seen this issue a few times in the past but don't have a solid handle on it. It seems that if the machine isn't running, then some IPMI functions appear on the interface. Possibly something for power-on net probes? I'm really not sure. Haven't had time to play with it enough to tell. THe 192.5.186.65 address is at least responding to SNMP (udp 161) requests. It may not be giving out useful information, but why is it even responding? --Gene "Adam (Max) Trefonides" made the following keystrokes:
Oh right, Thanks Corby.
I've done a probe of 192.5.186.80 from my desktop and that port is not = open. We are investigating our options for disabling the IPMI on this = machine, the server is on the chopping block for an upgrade and it's = going to be replaced soon.
-- Adam Max Trefonides CELS Systems [email protected]
On Jul 7, 2014, at 1:55 PM, "Schmitz, Corby B." <[email protected]> = wrote:
192.5.186.65 is the gateway for that network. I doubt it is "talking" = to anyone. Without the right CS or account, it will not get a response. = Additionally, it won't talk to any station not on the allowed list. =20 =20 --=20 corby =20 =20 -----Original Message----- From: [email protected] = [mailto:[email protected]] On Behalf Of Adam = (Max) Trefonides Sent: Monday, July 07, 2014 1:26 PM To: Rackow, Eugene A. Cc: [email protected] Subject: Re: IPMI and I2U2. =20 I'm trying to look into this ...=20 =20 I don't know what host 192.5.186.65 is. It's not in i2u2.org and it's = not in hostbase or dns. =20 192.5.186.80 should not be responding on those ports as far as I = know, all the ipmi interfaces should be on hidden net. =20 I'm making sure the ipmi is configured on node1.i2u2.org properly =20 =20 -- Adam Max Trefonides CELS Systems [email protected] =20 On Jul 7, 2014, at 12:05 PM, Gene Rackow <[email protected]> wrote: =20
It appears that with all the new vulns being reported in IPMI, = Shadowserver has taken up the task of scanning the world again. It appears they have found an IPMI service running on node1.i2u2.org. Running some netflow, this appears to be from a scan they did at = 0705.20:14:11 They poked UDP 192.5.186.80 623 via UDP and get a response back. They probed lots of other systems, but only this 1 responded. =20 = "timestamp","ip","port","hostname","tag","ipmi_version","asn","geo","regio= n","city","none_auth","md2_auth","md5_auth","passkey_auth","oem_auth","def= aultkg","permessage_auth","userlevel_auth","usernames","nulluser","anon_lo= gin","error","deviceid","devicerev","firmwarerev","version","manufactureri= d","manufacturername","productid","productname" "2014-07-06 = 01:14:11","192.5.186.80",623,"node1.i2u2.org","ipmi","1.5",683,"US","ILLIN= OIS","LEMONT","no","no","no","no","yes","-","disabled","disabled","yes","n= o","no",,,,,,,,, =20 I'm not exactly sure what they are reporing in this. =20 Any hope of just killing UDP access from outside on these subnets? In looking at the netflow logs for the past week, it appears the only legit traffic is=20 syslog going to 130.202.172.3 Argonne central server. syslog going to 128.135.125.120 con.ci.uchicago.edu. radius traffic going to auth.mcs.anl.gov:1812 dns traffic to 130.202.101.6 and 130.202.101.37 =20 Why is 192.5.186.65:161 talking to 192.117.188.130 random ports? = Israeli Traktor Company 0701.05:54:40.571 0701.05:54:40.571 5 192.117.188.130 19922 3 = 192.5.186.65 161 17 0 2 176 0701.05:54:40.578 0701.05:54:40.578 5 192.5.186.65 161 3 = 192.117.188.130 19922 17 0 1 134 0701.05:54:40.600 0701.05:54:40.600 6 192.5.186.65 161 3 = 192.117.188.130 19922 17 0 1 134 0701.06:39:40.532 0701.06:39:40.532 5 192.117.188.130 22913 3 = 192.5.186.65 161 17 0 2 176 0701.06:39:40.547 0701.06:39:40.547 5 192.5.186.65 161 3 = 192.117.188.130 22913 17 0 1 134 0701.06:39:40.571 0701.06:39:40.571 6 192.5.186.65 161 3 = 192.117.188.130 22913 17 0 1 134 0701.07:25:57.035 0701.07:25:57.035 5 192.117.188.130 26045 3 = 192.5.186.65 161 17 0 2 176 0701.07:25:57.058 0701.07:25:57.058 5 192.5.186.65 161 3 = 192.117.188.130 26045 17 0 1 134 0701.07:25:57.090 0701.07:25:57.090 6 192.5.186.65 161 3 = 192.117.188.130 26045 17 0 1 134 They probe, we respond. =20 There are many other probes that are not getting anywhere. The 2 below are the only others that got a response. 0705.09:21:15.302 0705.09:21:15.302 6 71.6.165.200 40000 3 = 192.5.186.80 5353 17 0 2 148 0705.09:21:15.300 0705.09:21:15.300 6 192.5.186.80 5353 3 = 71.6.165.200 40000 17 0 2 212 =20 0705.20:14:11.197 0705.20:14:11.197 6 192.5.186.80 623 3 = 184.105.247.230 53030 17 0 2 116 0705.20:14:11.174 0705.20:14:11.174 5 184.105.247.230 53030 3 = 192.5.186.80 623 17 0 2 102 =20 --Gene =20 =20 =20
--Apple-Mail=_95BBBA8A-FD19-4BA0-88C3-34FFB06114AF Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIL+zCCBeMw ggTLoAMCAQICBE3cxwUwDQYJKoZIhvcNAQEFBQAwYzELMAkGA1UEBhMCdXMxGDAWBgNVBAoTD3Uu cy4gZ292ZXJubWVudDEdMBsGA1UECxMUZGVwYXJ0bWVudCBvZiBlbmVyZ3kxGzAZBgNVBAsTEkVu ZXJneSBJVCBTZXJ2aWNlczAeFw0xNDAyMjcxMzQ4MTJaFw0xNzAyMjcxNDE4MTJaMIG3MQswCQYD VQQGEwJ1czEYMBYGA1UEChMPdS5zLiBnb3Zlcm5tZW50MR0wGwYDVQQLExRkZXBhcnRtZW50IG9m IGVuZXJneTEbMBkGA1UECxMSRW5lcmd5IElUIFNlcnZpY2VzMSQwIgYDVQQLExtBcmdvbm5lIE5h dGlvbmFsIExhYm9yYXRvcnkxDzANBgNVBAsTBlBlb3BsZTEbMBkGA1UEAxMSQWRhbSBBLiBUcmVm b25pZGVzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoct/XCFJFVAmwHIDOrmOP2+z TyLDnDRn2YXLyrlQmWsPWSGziVjWZyetUFEo1w05LRSWyLXA/KYNSapUK1CNFOb/d+RAUWne5215 jvzVPd6oqRyMsRGKw3oFMZ9rheH3b+b/86Hc0IYppFMx8BofYOGdE84d2mkuQipKu1fJnJkgBGaY hnmK9v5NPUrqWgzF7Rme4nVOq1tTdCPHY48ztMz5qFfz7OdtxOIbUNXABP2Oy0hI5Ka4aXlBjoT8 is8od+lO9jZ6youeuprIe6hrrekKagm8+tiAy3mYD56HOZHzCTVqsnBIHs9649aFwBW9Gv5X04X8 OnCVZ6zfsRd7ewIDAQABo4ICSDCCAkQwGgYDVR0RBBMwEYEPbWF4YWRhbUBhbmwuZ292MBsGA1Ud CQQUMBIwEAYJKoZIhvZ9B0QdMQMCARIwggGUBgNVHR8EggGLMIIBhzB7oHmgd6R1MHMxCzAJBgNV BAYTAnVzMRgwFgYDVQQKEw91LnMuIGdvdmVybm1lbnQxHTAbBgNVBAsTFGRlcGFydG1lbnQgb2Yg ZW5lcmd5MRswGQYDVQQLExJFbmVyZ3kgSVQgU2VydmljZXMxDjAMBgNVBAMTBUNSTDg2MIIBBqCC AQKggf+GgY9sZGFwOi8vZWd0bi1wa2lkaXItMDEuZG9lLmxvY2FsL291PUVuZXJneSUyMElUJTIw U2VydmljZXMsb3U9ZGVwYXJ0bWVudCUyMG9mJTIwZW5lcmd5LG89dS5zLiUyMGdvdmVybm1lbnQs Yz11cz9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0O2JpbmFyeYZraHR0cDovL3BraS5lbmVyZ3ku Z292L2NybHMvZG9lbGVnYWN5L2VuZXJneV9pdF9zZXJ2aWNlc19kZXBhcnRtZW50X29mX2VuZXJn eV9zLl9nb3Zlcm5tZW50X2NfdXNfY3JsZmlsZS5jcmwwCwYDVR0PBAQDAgUgMB8GA1UdIwQYMBaA FMNCFp38mi/4Q+SMlVqyL5Rn0Sl9MB0GA1UdDgQWBBRP9sRIL6TShj+agnxuke7Qq1SwGjAJBgNV HRMEAjAAMBkGCSqGSIb2fQdBAAQMMAobBFY4LjEDAgSQMA0GCSqGSIb3DQEBBQUAA4IBAQCso5hg BEo0VdqP/rIszGRg2S4V2qygomCc+k3drto4OVyuQfPonSCeYoYP5W52AeC9g9WT/ch4bWX6+1qN k5cOQBY895wPTtY+gY7azkskO+3a1b2t4AL+5R8joeB3Acg4Q3AtN9uF8BM4fAnIiYlRCbnPcUzj 9JMJubivrnvwA4Nf2cMynYPASphzLkDcFF0XWMdXVOofdpm2YpdGTZsqiiWH3Q5q47U6LzaYcBqY ddD53R96SDqpLGacSjjKFHfOVOjCKSH62OYKs2iYxTMErp7Q1sGXHtYqgyUF6J6PsW6FGEPtCkkm 1Ij+KFqlEWDTNfZWYgeMD8ghmL/yOMhPMIIGEDCCBPigAwIBAgIETdzJUjANBgkqhkiG9w0BAQUF ADBjMQswCQYDVQQGEwJ1czEYMBYGA1UEChMPdS5zLiBnb3Zlcm5tZW50MR0wGwYDVQQLExRkZXBh cnRtZW50IG9mIGVuZXJneTEbMBkGA1UECxMSRW5lcmd5IElUIFNlcnZpY2VzMB4XDTE0MDMwMzIw MTUwN1oXDTE3MDMwMzIwNDUwN1owgbcxCzAJBgNVBAYTAnVzMRgwFgYDVQQKEw91LnMuIGdvdmVy bm1lbnQxHTAbBgNVBAsTFGRlcGFydG1lbnQgb2YgZW5lcmd5MRswGQYDVQQLExJFbmVyZ3kgSVQg U2VydmljZXMxJDAiBgNVBAsTG0FyZ29ubmUgTmF0aW9uYWwgTGFib3JhdG9yeTEPMA0GA1UECxMG UGVvcGxlMRswGQYDVQQDExJBZGFtIEEuIFRyZWZvbmlkZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IB DwAwggEKAoIBAQC6V8Re4t2pOA1XGjlnt2PN/OrHxU+/EFUXUuTpVESl+Bc1bfzMgA4ZhYiQWiN8 l4VVdB8xT2yQAGeVit3PkWg5fvNlTai4avSY+S4huMarlMSyUnqmRIiGhUoeasB9ETUbT/khXCI+ N4zJ725T4795yf2+cvvkauGDvEHkrBe0FtL9U0Gtc5/OfE/68F5TZtbI35iVSAfE0fC4mfXc9aGr Bxafl+nRBCsfqGNH8r7IRndUwlG5HyoOYw+ZLa19kLHCryMzlqUN0wmvf5UxFCo0yMf7Mb0F41ZQ loV9TQjZE0qwgE6etPEWZKnGuHUtnhcLCexXoU0l60lseUT0IgvFAgMBAAGjggJ1MIICcTALBgNV HQ8EBAMCB4AwGgYDVR0RBBMwEYEPbWF4YWRhbUBhbmwuZ292MBsGA1UdCQQUMBIwEAYJKoZIhvZ9 B0QdMQMCARIwggGUBgNVHR8EggGLMIIBhzB7oHmgd6R1MHMxCzAJBgNVBAYTAnVzMRgwFgYDVQQK Ew91LnMuIGdvdmVybm1lbnQxHTAbBgNVBAsTFGRlcGFydG1lbnQgb2YgZW5lcmd5MRswGQYDVQQL ExJFbmVyZ3kgSVQgU2VydmljZXMxDjAMBgNVBAMTBUNSTDg2MIIBBqCCAQKggf+GgY9sZGFwOi8v ZWd0bi1wa2lkaXItMDEuZG9lLmxvY2FsL291PUVuZXJneSUyMElUJTIwU2VydmljZXMsb3U9ZGVw YXJ0bWVudCUyMG9mJTIwZW5lcmd5LG89dS5zLiUyMGdvdmVybm1lbnQsYz11cz9jZXJ0aWZpY2F0 ZVJldm9jYXRpb25MaXN0O2JpbmFyeYZraHR0cDovL3BraS5lbmVyZ3kuZ292L2NybHMvZG9lbGVn YWN5L2VuZXJneV9pdF9zZXJ2aWNlc19kZXBhcnRtZW50X29mX2VuZXJneV9zLl9nb3Zlcm5tZW50 X2NfdXNfY3JsZmlsZS5jcmwwKwYDVR0QBCQwIoAPMjAxNDAzMDMyMDE1MDdagQ8yMDE2MDQwOTAw NDUwN1owHwYDVR0jBBgwFoAUw0IWnfyaL/hD5IyVWrIvlGfRKX0wHQYDVR0OBBYEFBcu72mChnVx YnqQH0hxJnTW20m8MAkGA1UdEwQCMAAwGQYJKoZIhvZ9B0EABAwwChsEVjguMQMCBLAwDQYJKoZI hvcNAQEFBQADggEBAJ1iRLOfVrhHpscAq2lYRrBevmcWNiqZputrxyGCgY4xiirDWD7BEk3+tHQa IWYL+AYkiUUtDPMp5WuCy1ppPaYb+hLeGZTdBAidBC6aq3w7YK5J9++jKaZSKrUYyRe1RY4r9EPc zUNY4fu7A+O8zvZkEUVoqiuE0yZ4W6WvpW9OA0BAe1UvkPKIqwVRGm5Kl7nxCX0MuWGZkZta9GY2 hzwxEieGQrcmkmHAR/qJf9aI8vXzlGYrAHAkU5v2a98TisBeglJBoPWG3MHMTOcAuPyPwc4t0+4S ZZE6e0/ap/F4tmnnBHsUx0aNocNbl/MY7qwpooT5tWuX7+ELIszKq3QxggLtMIIC6QIBATBrMGMx CzAJBgNVBAYTAnVzMRgwFgYDVQQKEw91LnMuIGdvdmVybm1lbnQxHTAbBgNVBAsTFGRlcGFydG1l bnQgb2YgZW5lcmd5MRswGQYDVQQLExJFbmVyZ3kgSVQgU2VydmljZXMCBE3cyVIwCQYFKw4DAhoF AKCCAVcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTQwNzA3MTk0 OTMxWjAjBgkqhkiG9w0BCQQxFgQUFnVwkV5R03NOzSg3v7Q2G5mNWTwwegYJKwYBBAGCNxAEMW0w azBjMQswCQYDVQQGEwJ1czEYMBYGA1UEChMPdS5zLiBnb3Zlcm5tZW50MR0wGwYDVQQLExRkZXBh cnRtZW50IG9mIGVuZXJneTEbMBkGA1UECxMSRW5lcmd5IElUIFNlcnZpY2VzAgRN3McFMHwGCyqG SIb3DQEJEAILMW2gazBjMQswCQYDVQQGEwJ1czEYMBYGA1UEChMPdS5zLiBnb3Zlcm5tZW50MR0w GwYDVQQLExRkZXBhcnRtZW50IG9mIGVuZXJneTEbMBkGA1UECxMSRW5lcmd5IElUIFNlcnZpY2Vz AgRN3McFMA0GCSqGSIb3DQEBAQUABIIBAFkROM1uh/x17/T8QheDQYVh+Dv6RFMtOHZpmtcdsKd1 Nyy8eF6aEODNTXb9W8tIqwmfG8K5hx4uXlMHxWP7ZBTDVQAxsrgdg+09GyjK7HxcgCZoSZEkqDQJ w21/a/g5E0/bSmAJLnXlRcQJZzJiVgImxoB0LCi02wgWitiShgirqUj61ACtW49p0ndDAbVXh5mO utPeHFQPVmyotZbRrFc21ROwGEn8Z/oejGzQ8Sm/Khb/jjhJIN57TAU7DZXK0187SoPFr2Yu2Hpf //9SqbrLsxYsxmi2QeY8wrWWFl3UYU9MBOfdZ05vnWhMDaRRyeA8QZWtCkZvcVNTOy7yAnAAAAAA AAA=
--Apple-Mail=_95BBBA8A-FD19-4BA0-88C3-34FFB06114AF--