Re: [Ipmitool-devel] set cipher

[<hol...@ts...>]

Generic hint: you can always get additional debug information with -vv or -vvvv from ipmitool

 

You have to specify the cipher suite you want to use as command line parameter (default is 3 which you seemed to have disabled). The BMC needs to support the specified cipher suite and of cause it should not be currently disabled. 

 

If you want to use the optional/additional HMAC256 cipher suites from the DCMI spec. / IPMI spec. Errata 6 you would need a version of ipmitool which supports them.

 

e.g. ipmitool -I lanplus -C 17 -U user -P password -H host mc info

 

P.S: Since you did not specify which cipher suites your BMC actually supports this is just guessing…

 

 

 

From: VJ [mailto:pur...@gm...] 
Sent: Tuesday, February 07, 2017 8:49 PM
To: Liebig, Holger; ipm...@li...
Subject: Re: [Ipmitool-devel] set cipher

 

when i set some of the cipher suites e.g., lan set 1 cipher_privs XXaXXaXXXXXXXXX , I am not able to access the ipmi device at all.

The error i get :

Error in open session response message : no matching cipher suite

 

Error: Unable to establish IPMI v2 / RMCP+ session 

 

On Tue, Jan 31, 2017 at 12:42 AM, hol...@ts... <hol...@ts...> wrote:

Typically a BMC lists only the cipher suites it supports with ipmitool lan print e.g.

# ipmitool lan print | grep Cipher

RMCP+ Cipher Suites     : 0,1,2,3,6,7,8,17

Cipher Suite Priv Max   : XaaaaaaaXXXXXXX

                        :     X=Cipher Suite Unused

                        :     c=CALLBACK

                        :     u=USER

                        :     o=OPERATOR

                        :     a=ADMIN

                        :     O=OEM

 

Cipher suite 17 in the example above corresponds with the 8th character. 

 

From: VJ [mailto:pur...@gm...] 
Sent: Tuesday, January 31, 2017 4:10 AM
To: ipm...@li...
Subject: Re: [Ipmitool-devel] set cipher

 

esp., Iam looking to enable Ciper Suite ID 17 : RAKP-HMAC-SHA256;HMAC-SHA256-128;AES-CBC-128

 

How can I set 17 when the man page says : privlist must be 15 characters in length

 

I get error:

lan set 1 cipher_privs XXXaXXXXXXXXXXXaa

Invalid privilege specification length: 17

Thanks.

On Mon, Jan 30, 2017 at 6:53 PM, VJ <pur...@gm...> wrote:

How do I set cipher using ipmitool ?

 

I see ipmitoool getcipher but I dont see set cipher

 

 

Thanks.