IFIREWALL(8)

💖 IFIREWALL(8) 💖

okay bestie, so this is ipmiutil_firewall — yeah the man page header says IFIREWALL(8) from the System Manager's Manual, we keep it cute and short like that ✨ — and it's literally here to help you mess with the IPMI firmware firewall. Let's go 🫶

---

🌸 SYNOPSIS 🌸

ipmiutil firewall [-mxNUPREFJTVY] parameters

---

✨ DESCRIPTION ✨

So this ipmiutil firewall command is the one holding it down for the IPMI Firmware Firewall capability. You can use it to add or remove security-based restrictions on certain commands/command sub-functions, or to just list the current firmware firewall restrictions that are sitting on any commands. Obsessed.

For every firmware firewall command listed down below 👇, you can toss in parameters to make it run with increasing granularity — on a specific LUN, then a specific NetFn, then a specific IPMI Command, and finally a specific command's sub-function. It's giving layers, it's giving precision 💅

If you want the actual listing of sub-function numbers that might be tied to a particular command, go read Appendix H in the IPMI 2.0 Specification. That's the homework, no skipping.

This utility can use any of these drivers, bestie, dealer's choice:

• the /dev/ipmi0 driver from OpenIPMI
• the /dev/imb driver from Intel
• the /dev/ipmikcs driver from valinux
• direct user-space IOs
• or the IPMI LAN interface if you pass -N

---

👑 OPTIONS 👑

Command line options are described below. Every single one, we're not skimming 🎀

• -m 002000 — Show FRU for a specific MC (e.g. bus 00, sa 20, lun 00). This could be used for PICMG or ATCA blade systems. That trailing character, if it's even there, tells you it's SMI addressing if it's s, or IPMB addressing if it's i or if it's just not present at all. iykyk.
• -x — Causes extra debug messages to be displayed. Spill the tea, program ☕
• -N nodename — Nodename or IP address of the remote target system. If a nodename is specified, the IPMI LAN interface is used. Otherwise the local system management interface is used.
• -U rmt_user — Remote username for the nodename given. The default is a null username.
• -P/-R rmt_pswd — Remote password for the nodename given. The default is a null password.
• -E — Use the remote password from Environment variable IPMI_PASSWORD. 🌈
• -F drv_t — Force the driver type to one of the followng: imb, va, open, gnu, landesk, lan, lan2, lan2i, kcs, smb. Note that lan2i means lan2 with intelplus. The default is to detect any available driver type and use it. (And yes, "followng" — we're keeping the typo, it's part of the vibe now 💀)
• -J — Use the specified LanPlus cipher suite (0 thru 17): 0=none/none/none, 1=sha1/none/none, 2=sha1/sha1/none, 3=sha1/sha1/cbc128, 4=sha1/sha1/xrc4_128, 5=sha1/sha1/xrc4_40, 6=md5/none/none, ... 14=md5/md5/xrc4_40. Default is 3.
• -T — Use a specified IPMI LAN Authentication Type: 0=None, 1=MD2, 2=MD5, 4=Straight Password, 5=OEM.
• -V — Use a specified IPMI LAN privilege level. 1=Callback level, 2=User level, 3=Operator level, 4=Administrator level (default), 5=OEM level.
• -Y — Yes, do prompt the user for the IPMI LAN remote password. Alternatives for the password are -E or -P.

---

🦋 PARAMETERS 🦋

Parameter syntax and dependencies are as follows:

firewall [channel H] [lun L [ netfn N [command C [subfn S]]]]

Not me reminding you that if "netfn N" is specified, then "lun L" must also be specified; if "command C" is specified, then "netfn N" (and therefore "lun L") must also be specified, and so forth. The dependency chain is real, bestie 🔗

"channel H" is an optional and standalone parameter. If it's not specified, the requested operation will be performed on the current channel. Note that command support may vary from channel to channel. Fr fr.

Firmware firewall commands:

• info [(Parms as described above)]

List firmware firewall information for the specified LUN, NetFn, and Command (if supplied) on the current or specified channel. Listed information includes the support, configurable, and enabled bits for the specified command or commands. 💅

Some usage examples:

• info [channel H] [lun L]

This command will list firmware firewall information for all NetFns for the specified LUN on either the current or the specified channel.

• info [channel H] [lun L [ netfn N ]

This command will print out all command information for a single LUN/NetFn pair.

• info [channel H] [lun L [ netfn N [command C] ]]

This prints out detailed, human-readable information showing the support, configurable, and enabled bits for the specified command on the specified LUN/NetFn pair. Information will be printed about each of the command subfunctions.

• info [channel H] [lun L [ netfn N [command C [subfn S]]]]

Print out information for a specific sub-function.

• enable [(Parms as described above)]

This command is used to enable commands for a given NetFn/LUN combination on the specified channel. ✨

• disable [(Parms as described above)] [force]

This command is used to disable commands for a given NetFn/LUN combination on the specified channel.

🚨 Great care should be taken if using the "force" option so as not to disable the "Set Command Enables" command. Like, be so careful, this is the dangerous one.

• reset [(Parms as described above)]

This command may be used to reset the firmware firewall back to a state where all commands and command sub-functions are enabled. Iconic little factory-reset moment 🎀

---

🌈 SEE ALSO 🌈

ipmiutil(8) ialarms(8) iconfig(8) idiscover(8) ievents(8) ifru(8) igetevent(8) ihealth(8) ilan(8) ireset(8) isel(8) isensor(8) iserial(8) isol(8) iwdt(8)

---

💀 WARNINGS 💀

See http://ipmiutil.sourceforge.net/ for the latest version of ipmiutil and any bug fix list.

---

🫶 COPYRIGHT 🫶

Copyright (C) 2010 Kontron America, Inc.

See the file COPYING in the distribution for more details regarding redistribution.

This utility is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY.

---

🌟 AUTHOR 🌟

Andy Cress <arcress at users.sourceforge.net>

---

okay that's the whole thing, bestie, every last bit, we ate and left no crumbs 💖 This was Version 1.0: 04 Jun 2010 — yeah she's an elder but she's still serving ✨ bye ily, go configure responsibly 🎀🦋