Updates to this article added below.
People love their remote admin, especially in lights-out datacenters and discreet home labs. Tucking a server away, without needing a locally attached keyboard/video/mouse ever, is a great advantage from a noise and heat perspective. Since you can mount ISO files remotely so easily, who needs DVDs/CDs anymore anyway.
Supermicro's flavor of on-board IPMI BMC for remote administration is called iKVM, Remote Console, or Console Redirection, depending upon where you look in the Browser UI. Some questions about Java arose recently, starting with what seemed like a simple tweet. It quickly got a bit more involved. Like Robert, I reluctantly used Java for iKVM in a separate browser rarely used for much of anything else, IE11. The logic here is that any IE11 vulnerabilities aren't a big concern since this iKVM Console Redirect function is internal network traffic intranet. But like Java, IE11 is not long for this world, with Edge Browser slowly taking its place in Windows base images, such as Windows 10 and Windows Server 2016. Much like the recent death of Adobe Flash, this demise is very long overdue.
So I moved to Firefox, knowing IE wasn't a long term solution to be including in how to videos I produce. But on Firefox, alas, I encountered a bit of instability, pictured above. I just hadn't gotten around to opening a ticket on that.
Let's just say it. Oracle doesn't exactly give me the warm fuzzies when their Java installer tries to sneak toolbars and junk onto my systems, or my family's systems. Also kind of harbors resentment against the Oracle brand, every single time IT Pros like myself get to fight with Java version updates on relatives PCs on holidays, who still "need" Java for some casual gaming.
Think you can get around Java dependencies with something like Supermicro's stand-alone utility called IPMI View? See also:
Turns out it's not only a 32 bit relic, but it also carries its own Java runtime. Yuck.
Using your "other" browser, or a stand-alone Windows-only application, is clumsy.
It is with great pleasure that I share this news today with you, about an HTML5 future for iKVM. A special thanks to @RERobbins for helping me stumble upon this gem of an FAQ from Supermicro, apparently published largely unnoticed, back on January 29 2016:
Regarding IPMI, do you have any view console or web browsers that can be used without the need for java?
Baseboard Management Controllers (BMC) running IPMI protocol is designed to make the management of servers easy for IT operations. Due to BMC's powerful capabilities, it is recommended that BMC network access be restricted to a protected subnet behind firewall. IPMI Security is an evolving topic and Supermicro has been actively working with security community and customers to provide timely patches and continuously improve security on our products. We encourage you to visit following links for most updated resources and information: Best Practices guide and recommended security firmware patches on our IPMI landing page.
Currently, you will need to use Java. However, since Oracle has announced they will discontinue support for Java plugin, we have HTML5 based KVM for testing and will release it soon.
You may want to visit that faq URL for yourself, to type in your comments to let Supermicro know how important development of this capability really is.
This kind of news makes me happy. And RERobbins too, apparently. Given much of my day job has been spent wrangling with Java versions for old-school SAN administration and iLO/AMM/iDRAC remote admin, I know many IT Pros like me would rather see that all go away. I'm relieved it might be the case that our home labs might be Java-free sooner than the enterprise. I'll believe it when I see it. Only then will I make the same joyous noise that's featured in this closely-related article:
I'll be curious to see how mounting ISOs from local filesystems works out, and whether the FPS holds up. I imagine those are just a few of the many barriers the developers must be facing. But wow, wouldn't it be nice to have a (hopefully) consistent experience across browsers, when launching iKVM from any of your home network operating systems, without having to worry about a constant barrage of Java updates, versions, and vulnerabilities? See just one example of Steve Gibson's many Java vulnerability mentions, in these shownotes for Security Now! Episode #393.
Q&A with Supermicro - this just in:
Any chance you have HTML5 based beta that can be tested yet? (presumably a new IPMI version)
Not at this moment.
And or any sort of vague estimate of when this HTML5 version might be released publicly? (subject to change of course)
Still in development stage so I don’t have ETA
- Will HTML5 work for all existing Supermicro mobos, or only recent models where IPMI updates are more likely to happen?
We are trying to kill two birds with one stone so whichever mb has redfish version that will have HTML5
This seems to be a good time to add what Supermicro has published about Redfish:
- Supermicro Server Management (Redfish API)
Supermicro will support Redfish RESTful APIs on its X10 Generation and future server product line. All the BMC firmware designated with 3.xx will support this technology.
So we're not so sure what will become of pre-X10 motherboards. Perhaps they're stuck with Java? We probably shouldn't put too much weight on what one Supermicro person has stated. Time will tell.
I never really got into how awkward it is to launch the iKVM applet currently, dealing with differing behaviors in each browser, white-listing IPs, and downloading a JNLP file that you use to launch it. But once you jump through all those hoops with you rmouse, it's so awesome, and so worthwhile.
Java is a very popular language. The vulnerability I'm focusing on here are those web integrations, where much of the inherent danger lies. Our browsers have no business opening full-featured applications like Java. You're an IT Pro, trying to run a secure datacenter, while weakening your administrative PC's security just to do so. Even Alanis knows that's ironic.
I avoid browser applets/plugins/extensions wherever possible, especially Java, for the reasons outlined at The Java Browser Plug-in is a Complete Disaster. Chrome is my current primary browser, see also what Oracle says at Java and Google Chrome Browser, given Chrome no longer supports the NPAPI that was required for Java applets. Similar to the issues VMware is facing with their vSphere Web Client's reliance on Adobe Flash that's being deprecated everywhere.
All we SYS-5028D-TN4T home lab enthusiasts really need is a safe way to do smooth remote control of our ASPEED AST2400 based iKVM.
I've now added some screenshots below showing portions of the latest Java installation routine. This is Java Version 8 Update 73, from Feb 05 2016.
Java installer telling us to go use IE11
It would seem we're getting closer to having something to try on our X10 Generation SYS-5028D-TN4T/X10SDV-TLN4F systems, see the following Twitter conversation:
See also the closely related article, just published:
Over at STH Forums:
- Supermicro HTML5 iKVM arrived
-JUN 22 2016 by Patrick Kennedy at STH.
We have a Supermicro SYS-5018D-LN4T in the lab and I saw something I think STH-ers will be excited about: an initial HTML5 iKVM!
The HTML5 KVM functions are working as are the power on/ off. Virtual media still requires the Java app or using the web page:
Supermicro X10SDV-2C-TP4F HTML5 and Java iKVM.PNG
Still, this is a very exciting development for those of us who want to move to a java-less environment
Supermicro Server Management (Redfish API)
- Download Supermicro IPMIView Latest Version
Mar 12 2012 by Patrick Kennedy at STH
Supermicro's beloved iKVM Console Redirection is dumping problem-ridden Java for HTML5, yay!
reddit thread by speckz with a great discussion: VNC, noVNC, ties with Avocent (KVM vendor), and more.
@RER_iTinker Win 10x64 Ver 1511 Build 10586.122, IE 11.103.10586.0 (but I use Firefox 44.0.2), and Java V8 Update 73 (build 1.8.0_73-b02)— Paul Braren (@paulbraren) March 8, 2016