Improved Server Security with iDRAC9 and SELinux Abstract Dell EMC 14th generation PowerEdge servers offer greater risk mitigation in iDRAC9 using SELinux. This document introduces the new security features in iDRAC9.
Revisions Revisions Date Description September 2018 Initial release Acknowledgements This paper was produced by the following members of Dell EMC: Author: Florin Dragan, Michael E Brown Support: Kang Quan, Neel Parikh Other: Doug Iler, Nazira Carlage The information in this publication is provided “as is.” Dell Inc.
Acknowledgements Table of contents Revisions.............................................................................................................................................................................2 Acknowledgements .............................................................................................................................................................2 Executive summary...................................................................................................
Executive summary Executive summary This whitepaper introduces two new security initiatives that Dell EMC is providing in iDRAC9; SELinux and ‘non-root least privileges’. This whitepaper explains what these initiatives are, what Dell EMC did to implement them, and how they enhance customer experience by increasing the security of the embedded controllers.
1 Overview All Dell EMC PowerEdge servers contain an Integrated Dell Remote Access Controller (iDRAC). iDRAC enables seamless remote management of the server. 14th generation PowerEdge servers are shipped with the iDRAC9. iDRAC is essentially a computer subsystem that runs inside the server and can remotely control the server and re-install the operating system, among other features. Because of its extensive capabilities, hackers are incentivized to hack iDRAC to gain control over the system.
2 Security initiatives 2.1 SELinux framework The first initiative is the adoption of the SELinux security framework. Dell EMC wrote comprehensive security policies for every task that runs on the iDRAC and then ran comprehensive tests to ensure that no features were broken in the process. SELinux operates at the core kernel level on the iDRAC and does not need any input or configuration from the users.
3 Customer impact Together, these two initiatives offer defense against security threats and malicious attacks against iDRAC9. These security measures result in better protection of customer’s assets. Adding SELinux is a proactive measure to increase security of Dell EMC embedded systems management tools. However, it should be noted that SELinux constrains and mitigates certain classes of exploits but does not prevent them.
• • • • 3.3 enabled, the web server processes in iDRAC9 do not run under root user and are configured to have limited access to system files. CVE-2018-1211: Dell EMC iDRAC7/8 Versions earlier than iDRAC 2.52.52.52 contain a path traversal vulnerability in the web server’s URI parser that could be used to obtain specific sensitive data without authentication. A unauthenticated remote attacker might have been able to read configurations settings from the iDRAC by querying specific URI strings.
