Supermicro's beloved iKVM Console Redirection is dumping problem-ridden Java for HTML5, yay!

Posted by Paul Braren on Mar 8 2016 (updated on Jul 18 2016) in
  • HomeLab
  • HomeServer
  • Network
    • 21 Comments

    Updates to this article added below.

    People love their remote admin, especially in lights-out datacenters and discreet home labs. Tucking a server away, without needing a locally attached keyboard/video/mouse ever, is a great advantage from a noise and heat perspective. Since you can mount ISO files remotely so easily, who needs DVDs/CDs anymore anyway.

    This-plugin-has-security-vulnerabilities
    iKVM-cropped

    Supermicro's flavor of on-board IPMI BMC for remote administration is called iKVM, Remote Console, or Console Redirection, depending upon where you look in the Browser UI. Some questions about Java arose recently, starting with what seemed like a simple tweet. It quickly got a bit more involved. Like Robert, I reluctantly used Java for iKVM in a separate browser rarely used for much of anything else, IE11. The logic here is that any IE11 vulnerabilities aren't a big concern since this iKVM Console Redirect function is internal network traffic intranet. But like Java, IE11 is not long for this world, with Edge Browser slowly taking its place in Windows base images, such as Windows 10 and Windows Server 2016. Much like the recent death of Adobe Flash, this demise is very long overdue.

    So I moved to Firefox, knowing IE wasn't a long term solution to be including in how to videos I produce. But on Firefox, alas, I encountered a bit of instability, pictured above. I just hadn't gotten around to opening a ticket on that.

    Let's just say it. Oracle doesn't exactly give me the warm fuzzies when their Java installer tries to sneak toolbars and junk onto my systems, or my family's systems. Also kind of harbors resentment against the Oracle brand, every single time IT Pros like myself get to fight with Java version updates on relatives PCs on holidays, who still "need" Java for some casual gaming.

    IPMIView

    Think you can get around Java dependencies with something like Supermicro's stand-alone utility called IPMI View? See also:

    Turns out it's not only a 32 bit relic, but it also carries its own Java runtime. Yuck.

    Using your "other" browser, or a stand-alone Windows-only application, is clumsy.

    Announcing HMTL5 iKVM

    It is with great pleasure that I share this news today with you, about an HTML5 future for iKVM. A special thanks to @RERobbins for helping me stumble upon this gem of an FAQ from Supermicro, apparently published largely unnoticed, back on January 29 2016:

    supermicro.com/support/faqs/faq.cfm?faq=22376

    Question
    Regarding IPMI, do you have any view console or web browsers that can be used without the need for java?
    Important Note
    Baseboard Management Controllers (BMC) running IPMI protocol is designed to make the management of servers easy for IT operations. Due to BMC's powerful capabilities, it is recommended that BMC network access be restricted to a protected subnet behind firewall. IPMI Security is an evolving topic and Supermicro has been actively working with security community and customers to provide timely patches and continuously improve security on our products. We encourage you to visit following links for most updated resources and information: Best Practices guide and recommended security firmware patches on our IPMI landing page.
    Answer
    Currently, you will need to use Java. However, since Oracle has announced they will discontinue support for Java plugin, we have HTML5 based KVM for testing and will release it soon.

    https://blogs.oracle.com/java-platform-group/entry/moving_to_a_plugin_free

    You may want to visit that faq URL for yourself, to type in your comments to let Supermicro know how important development of this capability really is.

    This kind of news makes me happy. And RERobbins too, apparently. Given much of my day job has been spent wrangling with Java versions for old-school SAN administration and iLO/AMM/iDRAC remote admin, I know many IT Pros like me would rather see that all go away. I'm relieved it might be the case that our home labs might be Java-free sooner than the enterprise. I'll believe it when I see it. Only then will I make the same joyous noise that's featured in this closely-related article:

    I'll be curious to see how mounting ISOs from local filesystems works out, and whether the FPS holds up. I imagine those are just a few of the many barriers the developers must be facing. But wow, wouldn't it be nice to have a (hopefully) consistent experience across browsers, when launching iKVM from any of your home network operating systems, without having to worry about a constant barrage of Java updates, versions, and vulnerabilities? See just one example of Steve Gibson's many Java vulnerability mentions, in these shownotes for Security Now! Episode #393.

    2016-03-08_12-11-17
    click this screenshot to jump to the Supermicro webform so you can submit your own feedback

    Mar 09 2016 Update

    Q&A with Supermicro - this just in:

    1. Any chance you have HTML5 based beta that can be tested yet? (presumably a new IPMI version)

      Not at this moment.

    2. And or any sort of vague estimate of when this HTML5 version might be released publicly? (subject to change of course)

      Still in development stage so I don’t have ETA

    3. Will HTML5 work for all existing Supermicro mobos, or only recent models where IPMI updates are more likely to happen?

      We are trying to kill two birds with one stone so whichever mb has redfish version that will have HTML5

    This seems to be a good time to add what Supermicro has published about Redfish:

    • Supermicro Server Management (Redfish API)

      Supermicro will support Redfish RESTful APIs on its X10 Generation and future server product line. All the BMC firmware designated with 3.xx will support this technology.

    So we're not so sure what will become of pre-X10 motherboards. Perhaps they're stuck with Java? We probably shouldn't put too much weight on what one Supermicro person has stated. Time will tell.

    Mar 09 2016 Update #2

    I never really got into how awkward it is to launch the iKVM applet currently, dealing with differing behaviors in each browser, white-listing IPs, and downloading a JNLP file that you use to launch it. But once you jump through all those hoops with you rmouse, it's so awesome, and so worthwhile.

    Java is a very popular language. The vulnerability I'm focusing on here are those web integrations, where much of the inherent danger lies. Our browsers have no business opening full-featured applications like Java. You're an IT Pro, trying to run a secure datacenter, while weakening your administrative PC's security just to do so. Even Alanis knows that's ironic.

    The 'Java[tm] Plug-In SSV Helper' add-on from 'Oracle America, Inc.' is ready for use.
    Java_Update_Available_Popup

    I avoid browser applets/plugins/extensions wherever possible, especially Java, for the reasons outlined at The Java Browser Plug-in is a Complete Disaster. Chrome is my current primary browser, see also what Oracle says at Java and Google Chrome Browser, given Chrome no longer supports the NPAPI that was required for Java applets. Similar to the issues VMware is facing with their vSphere Web Client's reliance on Adobe Flash that's being deprecated everywhere.

    All we SYS-5028D-TN4T home lab enthusiasts really need is a safe way to do smooth remote control of our ASPEED AST2400 based iKVM.

    I've now added some screenshots below showing portions of the latest Java installation routine. This is Java Version 8 Update 73, from Feb 05 2016.

    Java installer telling us to go use IE11

    Oracle_Download_Java_for_Windows
    In Windows 10, the Edge browser does not support plug-ins and therefore will not run Java. Switch to a different browser [Firefox or Internet Explorer 11] to run the Java plug-in.

    Skeevy offer

    Oracle_Java_offers_Amazon_Assistant
    Please Amazon, please don't go to the dark side and continue to broker deals with such skeevy software installers. Makes us associate your brand with Yahoo and Ask Toolbars. Is that what you really want?

    June 04 2016

    It would seem we're getting closer to having something to try on our X10 Generation SYS-5028D-TN4T/X10SDV-TLN4F systems, see the following Twitter conversation:

    dmtf-redfish-logo

    See also the closely related article, just published:

    JUL 18 2016 Update

    Over at STH Forums:

    • Supermicro HTML5 iKVM arrived
      -JUN 22 2016 by Patrick Kennedy at STH.

      We have a Supermicro SYS-5018D-LN4T in the lab and I saw something I think STH-ers will be excited about: an initial HTML5 iKVM!

      The HTML5 KVM functions are working as are the power on/ off. Virtual media still requires the Java app or using the web page:
      Supermicro X10SDV-2C-TP4F HTML5 and Java iKVM.PNG

      Still, this is a very exciting development for those of us who want to move to a java-less environment

    See also at TinkerTry

    See also

    Supermicro's beloved iKVM Console Redirection is dumping problem-ridden Java for HTML5, yay!
    reddit thread by speckz with a great discussion: VNC, noVNC, ties with Avocent (KVM vendor), and more.

    Twitter

    All Comments on This Article (21)

    Chris Beasley

    Hi Paul,

    Wanted to explore this point further, if you set the gpu options to offboard does it allow the machine to boot using the discrete gpu as the primary display (#1) while still allowing iKVM on the BMC GPU (display 2)? I presume in this instance, that if you mirror the os then you can access the whole machine via the primary display or remotely? Did you need to use an emulator to make the BMC GPU think there was a screen connected?

    Lasha Pasieshvili

    Thank you Paul, i will read it.

    Paul Braren | TinkerTry.com

    Yeah, found similar problems when trying to prototype my SuperServer Workstation (with added GPU):
    https://TinkerTry.com/superserverworkstation
    Actually found things worked better when I added a step to the assembly/preparation procedure, disabling the onboard GPU whenever a PCI GPU card was added, see "VGA Priority [Onboard]" and change it to [Offboard]" at:
    https://TinkerTry.com/superserver-assemble-configure-install-windows-10

    Lasha Pasieshvili

    Today support told me, i cannot use Console Redirection with onboard dedicated video card. So i removed my R9 290X from the motherboard, then set primary video card to "onboard" and problem solved!

    unfortunately i cannot use Console Redirection with high-end video card such as R9 290X. i have to use low-end onboard GPU, which has blurry visual.

    Do you using Console Redirection only with onboard GPU?

    Paul Braren | TinkerTry.com

    Sorry, I don't own that system, and haven't experienced that issue, so likely you'll do best by contacting Supermicro support at https://www.supermicro.com/24Hour/24hour.cfm

    Lasha Pasieshvili

    hello
    i have Supermicro H8DGU-F with updated BIOS and IPMI Firmware (BIOS 3.5c. IPMI firmware 3.22)
    i have Windows 10 64-bit with installed latest version of Java 64-bit.
    i cannot solve this problem by myself.

    Java iKVM viever v1.69.21 - No signal...

    what can i do?

    also from my android, Supermicro IPMIView application shows only balck screen when i launch KVM...

    any idea?

    Paul Braren | TinkerTry.com

    Nice, thank you for sharing the news! https://twitter.com/paulbraren/status/736327978204860416

    Arun

    KVM/HTML5 is introduced in 3.31 firmware for X10 Generation. You can follow @Supermicro_SW for more updates.

    Paul Braren | TinkerTry.com

    Thank you so much for sharing your (extremely) affordable and logical solution, I appreciate it, and so will others who read your comments!

    gglockner

    I created an Ubuntu 14.04 VM whose sole purpose is to run SuperMicro IPMI View. I connect to the VM, open IPMI View, and get the iKVM console to the SuperMicro machine. HTML5 would be welcome but I need something that works now.

    Eric

    Problem solved, forever IPMI fans - http://xenappblog.com/2016/super-micro-ipmi-problem-solved/

    Paul Braren | TinkerTry.com

    Perhaps I should publish my 5 year old Java+Browser process killer scripts someday, eh?
    ;-)
    I use then for when teleconferences I'm participating in go wrong, helping me recover faster, essential these days with leftover browser and Java stubs hanging on even when you close a UI.

    Paul Braren | TinkerTry.com

    All valid points, I did get a little too far ahead of myself with this post, with only a "Time will tell" softening of the optimism. You're also likely right that HMTL5 isn't a magic panacea.

    I do believe it's encouraging that at least they're trying to move onward, despite what must be limited budgets due to lower margins than the big guys.

    Thank you for your candor. If everybody pretended everything is great as-is, things don't tend to change. I also appreciate your taking the time to type all this feedback up.

    Florian Heigl

    [moderator cleaned up the language with asterisks below, this post is otherwise unaltered]
    Honestly, it WON'T MATTER AT ALL:
    SuperMicro consistently f***d up for years,
    by not properly signing their code,
    by letting certs expire,
    by actually just using Java to download binary sh*t instead of Java code,
    by NOT fixing security issues within reasonable notice,
    by ignoring security issues,
    by not properly supporting different OS,
    by telling you to update Java when it's CURRENT instead of outdated,
    by making it hard to deploy a valid & chained certificate to the BMC,
    by using foreign code from ATEN,
    using crappy smash-clp,
    never properly testing ipmiview cross-client support
    and maybe even some other things I hadn't yet found out about....


    Can anyone seriously think that going to a HTML5 interface (which I *want* since it'll soothe the pain for a few months) will somehow magically change matters and stop SuperMicro from neglecting this code? For a longer period?
    Now they don't just gotta maintain a java application they OEMed but ALSO need to be on top of the web server in it...

    Oh - and I didn't mention the horribly sh*tty window resize that managed to kill Ubunty's unity desktop
    Or the stale java processes
    Or not being able to quit it because it's hanging


    Please raise your hand if you think this will be fine. And then don't forget to put it down again so you don't get dirty when the sh*t hit's the fan.



    João Feteira

    for sure. thanks for the reminder!

    Paul Braren | TinkerTry.com

    Hope you filled out the form with your feedback:
    http://supermicro.com/support/faqs/faq.cfm?faq=22376

    Paul Braren | TinkerTry.com

    Hope you filled out the form
    http://supermicro.com/support/faqs/faq.cfm?faq=22376
    indicating how much you want this, I believe it wouldn't hurt for Supermicro to know the demand is there!

    Paul Braren | TinkerTry.com

    I know, right? We don't know when yet though. See also Q&A with Supermicro in the updates https://TinkerTry.com/supermicro-superserver-ikvm-moving-from-java-to-html5#Mar-09-2016-Update

    Paul Braren | TinkerTry.com

    I agree! See also article updates:
    https://TinkerTry.com/supermicro-superserver-ikvm-moving-from-java-to-html5#Mar-09-2016-Update
    for some clarifications, and screenshots that may bring on PTSD.

    João Feteira

    this is great news omg, java is a nightmare to work on with all the strangeness between versions and the security holes

    cron

    FINALLY