The Making of OnMetal

34 points by rphillips 11 years ago | 9 comments

cmsj 11 years ago |

Still want to know how they're mitigating firmware attacks :)

pquerna 11 years ago | |

I'd like us (Rackspace) to publish a full whitepaper about what we have done, but I'll break down things into two topical areas:

1) Requiring signing of all firmwares, and putting those firmware private keys in control of Rackspace whenever possible.

2) Disabling systems of integration between the BMC and Operating system -- for example we completely disable the HECI bus, removing a major surface area for the operating system to affect the BMC.

cmsj 11 years ago | | |

Thanks for the reply :)

I suspect an ideal state to be in would be that there was no firmware flashing at all, the various bits of hardware would have some version of the firmware in ROM and could load a replacement firmware into RAM, but never be able to store that in a PROM, thus guaranteeing that no malicious code could ever persist between tenants. Probably a lot harder to arrange with hardware people though.

I guess my concern with signed firmware is that it's increasing the attack surface of the firmware by adding in crypto code. Identifying malicious code is going to be hard enough to start with, let alone hunting down its attack vector, let alone getting a decent fix from some vendor in a useful timeframe!

ryanburk 11 years ago | | |

was firmware signing a big factor in the decision to go with OCP hardware?

thanks for telling the story. it is encouraging for us as we are bringing up ironic support ourselves.

tzury 11 years ago |

OnMetal Compute v1 - comes out as $560 per month which is not that expensive at all for a 10 cores instance!