vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(nh3-pve): AMT static on nh3-mgmt with KVM enabled and opt-in none; WS-Man helper

Browse Source 
- AMT re-IP'd over WS-Man to static 10.100.250.61/24 (gw/DNS .1): AMT keeps
  its old DHCP lease across a VLAN move, so it was unreachable until changed
  (reached via a temporary on-link /32 on vmbr0 + ssh tunnel, since removed).
- KVM redirection enabled, redirection listener on, IPS_OptInService
  OptInRequired=0; all read back. Password vaulted as nh3-pve/amt-admin.
- scripts/amt-wsman.py: stdlib WS-Man get/put/invoke client (digest auth,
  AMT 16 legacy-renegotiation TLS), password from $AMT_PW.
This commit is contained in:
vh
2026-09-25 23:08:53 -07:00
parent b3b75c16f4
commit 50f113cd7d
3 changed files with 107 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/nh3-pve/README.md
+21 -13
View File
@@ -57,19 +57,27 @@ not power back on by itself.
without checking which one has carrier (`ip -br link`). The bridge carries the
I226-V's MAC `…:96:0d` because it is the first port listed.
- **AMT: `https://10.100.250.61:16993`** (`nh3-pve-amt.nh3.internal`; Homepage
card *NH3-PVE-AMT* under Infra - NH3). Intel AMT 16.1.25. It came up at 2224
on 2026-09-25 as `10.100.0.151` and was moved to nh3-mgmt at 2237 on Prime's
order.
- ⏳ **Until its old lease runs out, AMT still holds `10.100.0.151`**, and
nothing reaches it at either address. AMT does not re-DHCP when its VLAN
changes.
- A link drop, real or `ethtool -r`, makes it send only one ARP for its old
gateway `10.100.0.1`, which gets no answer. It sends no DHCP.
- The lease is 24 h from 2224 on 09-25. Renewal at 12 h goes unicast to
`10.100.0.1`, which is unreachable from mgmt. The rebind at ~21 h
(~1920 on 09-26) or expiry (~2224 on 09-26) should NAK it or start a new
DHCP, and the reservation then gives `.61`.
- The faster route needs the AMT admin password (WS-Man) or the MEBx menu.
card *NH3-PVE-AMT* under Infra - NH3). Intel AMT 16.1.25, **Admin Control
Mode**. User `admin`; the password is in the vault as `nh3-pve/amt-admin`.
- **Static IP since 2026-09-25 2306:** `10.100.250.61/24`, gateway and DNS
`10.100.250.1`. It is set in AMT through WS-Man, and the UDM reservation
stays as a placeholder.
- Why static: AMT does not re-DHCP after a VLAN move. It kept its old
nh3-default lease, and a link drop makes it send only one ARP for its old
gateway. Static also means OOB does not depend on DHCP.
- How it was changed while AMT sat on the old address: a temporary
`10.100.0.250/32` plus a `/32` route on nh3-pve's vmbr0 (same L2), and an
ssh tunnel. The temporary address was removed afterwards.
- **Remote-screen settings, verified by reading them back:**
- KVM enabled (`CIM_KVMRedirectionSAP` EnabledState 6, ready).
- Redirection listener on (`AMT_RedirectionService` 32771, ListenerEnabled).
- **User Opt-in = None** (`IPS_OptInService.OptInRequired` 0), so no 6-digit
code is needed at the rack.
- The VNC port 5900 is off. Use MeshCommander.
- Tool: `scripts/amt-wsman.py`.
- ⚠ **Before the NanoKVM leaves this box, fit a dummy HDMI plug** on the iGPU
HDMI. AMT KVM draws only an active iGPU output. MS-01 owners commonly report
a black KVM screen without one.
- It uses a self-signed cert and TLS 1.2 with legacy renegotiation, so OpenSSL 3
clients need `Options = UnsafeLegacyRenegotiation`; browsers cope. 16992
(plain HTTP) is closed. 664 (TLS redirection: SOL/IDER/KVM) is open. It does