Get in Touch

Course Outline

  • BMC Threat Model.
  • Attack surface of server BMCs.
  • Common vulnerabilities in legacy BMC firmware.
  • OpenBMC security architecture overview.
  • Compliance requirements (NIST, PCI-DSS).

Secure Boot

  • U-Boot verified boot chain.
  • Image signing with RSA and ECDSA.
  • Key hierarchy and revocation.
  • Measurement and attestation basics.

Firmware Update Security

  • Image signature verification flow.
  • Rollback protection and version policies.
  • Dual-bank update strategies.
  • Code update via Redfish and IPMI.

Certificate Management

  • Phosphor-certificate-manager architecture.
  • Installing and replacing HTTPS certificates.
  • Certificate Authority (CA) trust stores.
  • LDAPS and client certificate authentication.

Authentication and Authorization

  • Local user management and password policies.
  • LDAP and Active Directory integration.
  • PAM stack configuration.
  • Redfish RBAC and privilege mapping.

Network Security

  • Firewall rules and nftables.
  • TLS 1.3 configuration in bmcweb.
  • SSH hardening and key-based auth.
  • Network segmentation for BMC interfaces.

Audit and Response

  • Remote syslog configuration.
  • Security event logging.
  • SEL and audit trail management.
  • Incident response for compromised BMCs.

Security Testing

  • Static analysis with CodeQL and Bandit.
  • Fuzzing D-Bus interfaces.
  • Penetration testing REST and Redfish APIs.
  • CVE tracking and patch management.

Requirements

  • Understanding of PKI and TLS fundamentals.
  • Basic Linux security concepts.
  • Familiarity with embedded firmware update mechanisms.

Audience

  • Security engineers.
  • Firmware developers.
  • System administrators managing BMC infrastructure.
 14 Hours

Testimonials (4)

Related Categories