EU ebay: Supermicro X10SLE-F (Micro-Cloud node) usually under 10 Euro
- Thread starter DanAnd
- Start date
Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
Usually I find 8GB sticks for 15-20 Euro: (10600e,12800e,14900e) (32gb, 16gb, 8gb) -4gb -2gb -1gb | eBay
I would also love a summary of the pinout. From your investigation, it sounds like the following:
JP17:
- N/C
- GND
- N/C
- N/C
- 3.3V (Input)
- N/C
- 5V (Output?)
- N/C
- N/C
- 3.3V (Output?)
- N/C
- 3.3V (Output?)
My board arrived today, packed in peanuts. It seems the seller learned their lesson though, and put a paper in the CPU socket to prevent damage from the peanuts. Still, there is a bent pin
This board is nasty. I don't mean just dusty, it seems to have some kind of residue on it. It almost seems like it came from an environment with cigarette tar...
Decided to put it on github since i can't put pictures up on here. Some error.
Ragebone/nr64_supermicro_x10sle-f
@hmartin damn that pin. Looks fixable though.
But if you don't want to, you can tell the seller and in my own experience, they will send you another one.
Could send the broken one to me ;D
Ragebone/nr64_supermicro_x10sle-f
@hmartin damn that pin. Looks fixable though.
But if you don't want to, you can tell the seller and in my own experience, they will send you another one.
Could send the broken one to me ;D
Last edited:
I think I managed to bend the pin back. I'll test on the weekend, after I make a power cable for the board. The molex connector is the same as an ATX EPS power, so if you have an EPS extension cable around you can butcher that instead of hacking the cable from the backplane connector.
If my counting is correct, the bent pin is AU13 which is SA_MA0 (Intel PDF, page 118). I guess I will know pretty quickly if it doesn't recognize memory in channel A that I need to ask the seller for a replacement...
If my counting is correct, the bent pin is AU13 which is SA_MA0 (Intel PDF, page 118). I guess I will know pretty quickly if it doesn't recognize memory in channel A that I need to ask the seller for a replacement...
@hmartin Since it was bent upward, pushing it down should fix it. But i digress and you are the one doing it. So good luck and much success!
I just pushed the 4th 12V pin out of an EPS, put the 5VSB pin there, and added a switch to the PSON line.
Gona get a hopefully working ddr3 udimm ecc dimm this evening from a friend, so that i can hopefully report success on the hole operation.
I just pushed the 4th 12V pin out of an EPS, put the 5VSB pin there, and added a switch to the PSON line.
Gona get a hopefully working ddr3 udimm ecc dimm this evening from a friend, so that i can hopefully report success on the hole operation.
So i got the Ram from a friend and i can now happily say and confirm that those boards only work with udimm ecc, and in that pin bridged configuration.
Well, i just went into the bios and stayed there for a while. U11 didn't get noticeably hot but you should keep an eye on it.
So i now should actually buy some ram, when my budget refills next month.
pictures as proof are in the repo.
Well, i just went into the bios and stayed there for a while. U11 didn't get noticeably hot but you should keep an eye on it.
So i now should actually buy some ram, when my budget refills next month.
pictures as proof are in the repo.
So, my BMC has a static IP address (140.0.33.35) and the ADMIN account is disabled. It's beyond the firmware version where you can extract the admin login by using nc on port 49152. I don't have the Supermicro SUVI cable, so I don't have VGA, and there is no jumper on the motherboard to reset the BMC to defaults.
Otherwise, the power light is always on green, which is a bit strange. The board does squeal when it's on (even with the NIC installed), so it does seem to have some life, but without iKVM I won't get far.
Unless someone can crack the hashed password from an IPMI firmware dump, I guess I need to find a SUVI cable...
Edit: If someone has a SUVI cable and can tell me the pins used for RS-232, that would be super helpful!
Otherwise, the power light is always on green, which is a bit strange. The board does squeal when it's on (even with the NIC installed), so it does seem to have some life, but without iKVM I won't get far.
Unless someone can crack the hashed password from an IPMI firmware dump, I guess I need to find a SUVI cable...
Edit: If someone has a SUVI cable and can tell me the pins used for RS-232, that would be super helpful!
Last edited:
I think I can lend you such a cable. I will try to get mine up to running and then I can send it around. Are you based on Europe?
Hey DanAnd, I have some passwords for wsman too in the BMC SPI dump, but I don't think they're hashed?
Edit: never mind, they're obviously hashed. ADMIN/ADMIN, and the myloc_admin is unknown, currently trying to crack with my 1070 but it will take days at least...
Edit2: since I have SPI access, I could just change the password for myloc_admin to the hashed password for ADMIN, but I'm not convinced this wsman conf file is also the login for the web admin users. It would be nice to know where the users are dis/enabled and then I could just re-enable the ADMIN account...
Code:
ADMIN:eCCR81e5DFfg6
myloc_admin:/g8OFglXcntsYEdit2: since I have SPI access, I could just change the password for myloc_admin to the hashed password for ADMIN, but I'm not convinced this wsman conf file is also the login for the web admin users. It would be nice to know where the users are dis/enabled and then I could just re-enable the ADMIN account...
Last edited:
mine are:
ADMIN:eCCR81e5DFfg6
myloc_admin:110478VFEgq0Q
ilo_user_I1xsB:I969cX77eN55.
ilo_user_gY42z:MgRYwofGaV/jk
The Hash algorythm is RAKP HMAC-SHA1, which could be decyphered with hashcat (Mode 7300). However I gave up trying, after I completed all keys from 1 to 6 characters. I assume it will be easier with local login/bios.
ADMIN:eCCR81e5DFfg6
myloc_admin:110478VFEgq0Q
ilo_user_I1xsB:I969cX77eN55.
ilo_user_gY42z:MgRYwofGaV/jk
The Hash algorythm is RAKP HMAC-SHA1, which could be decyphered with hashcat (Mode 7300). However I gave up trying, after I completed all keys from 1 to 6 characters. I assume it will be easier with local login/bios.
I tried @RageBone 's wiring and I see that my board Power-Button lids up. I still don't get any boot up screen. I am really confused what I did differently with my first blown-up board, which at least show me the SUPERMICRO screen.
I used RAM and a CPU which works fine on my X10SLM+-LN4F , which is standard micro-atx board also based on the Intel C224 as the X10SLE-F.
I am currently out of ideas.
I used RAM and a CPU which works fine on my X10SLM+-LN4F , which is standard micro-atx board also based on the Intel C224 as the X10SLE-F.
I am currently out of ideas.
Last edited:
I got the same result except the board didn't blew up. First launch got a SUPERMICRO screen, but I was lacking a heatsink. I installed one and after that power button stopped working. Very confusing.
What's the behaviour of your power button? Mine is on green all the time, even when the board is off (no heat from the PCH or CPU). Sometimes the BMC randomly stops responding on the network and I have to power cycle the board. It's very strange.
I'm wondering if the boards are actually working reliably, or if this is the reason they're being sold for so little...
I'm wondering if the boards are actually working reliably, or if this is the reason they're being sold for so little...
I had to resolder the large mio Rom on mine to get the ipmi working.
Noticed that it didn't enable unless i flexed the board or pushed it down on that mio rom, or near the BMC.
The joints looked matt and not shiny and had a bit of gunk on them.
My powerbutton is lit up green all the time.
The postcode displays FF, unless the system is turned on, then it posts ^^
Noticed that it didn't enable unless i flexed the board or pushed it down on that mio rom, or near the BMC.
The joints looked matt and not shiny and had a bit of gunk on them.
My powerbutton is lit up green all the time.
The postcode displays FF, unless the system is turned on, then it posts ^^
Last edited:
I did a few more investigations.
My first board must have been used in production and wasn't cleaned up, as I found the mentioned simple_auth passwd file of wsman in the BMC rom.
My replacement buy does not have users configured. I haven't found anything inside the BMC flash. Except: ipmi user list just includes the empty user '' (anonymous user) with the password "admin" (in low case instead of the usual supermicro uppercase ipmi passwords).
The empty user does not have administrator rights, so I didn't got forward on that.
I inspected the blown-up board again and figured out that my bmc flash chip does is shorted between +3V and GND. I don't know if this is the effect of the blown up U11 or if the flash chip had a shortened circuit which blown up the power stage (U11).
U11 is at least responsible for the 3V power of the BMC flash (and more components, I assume).
A nicer shot of the working board U11.
My first board must have been used in production and wasn't cleaned up, as I found the mentioned simple_auth passwd file of wsman in the BMC rom.
My replacement buy does not have users configured. I haven't found anything inside the BMC flash. Except: ipmi user list just includes the empty user '' (anonymous user) with the password "admin" (in low case instead of the usual supermicro uppercase ipmi passwords).
The empty user does not have administrator rights, so I didn't got forward on that.
I inspected the blown-up board again and figured out that my bmc flash chip does is shorted between +3V and GND. I don't know if this is the effect of the blown up U11 or if the flash chip had a shortened circuit which blown up the power stage (U11).
U11 is at least responsible for the 3V power of the BMC flash (and more components, I assume).
A nicer shot of the working board U11.
Could anyone send me a dump of their BMC ROM with known admin credentials?
Is the simple_auth.passwd config file the credentials for the WebUI? If so, I don't understand how users are disabled.
Otherwise, I was able to find a mirror of older Supermicro BMC firmwares for the X10 series. If I can't get a dump from someone else, I'm going to try the following:
The ETA on brute forcing an 8 character password on my 1070 is 127 days, so I'm going the physical access route now.
Edit: Well, #1 is out:
Is the simple_auth.passwd config file the credentials for the WebUI? If so, I don't understand how users are disabled.
Otherwise, I was able to find a mirror of older Supermicro BMC firmwares for the X10 series. If I can't get a dump from someone else, I'm going to try the following:
- Editing the username/passwords in the JFFS2 partition of the BMC firmware and reflashing that (probably using devicenull/ipmi_firmware_tools )
- Flashing an older X10 BMC firmware release and trying some known exploits (here is a mirror of older BMC firmware releases: ftp://ftp.abacus.cz/support/FW/MB/SUPERMICRO/IPMI/A1/STARSI/ )
- Oscilloscope on the JKVM1 connector to try and locate the RS-232 pins
The ETA on brute forcing an 8 character password on my 1070 is 127 days, so I'm going the physical access route now.
Edit: Well, #1 is out:
Code:
$ python read_header.py --extract ../x10sle-f_bmc.bin
Read 33554432 bytes
Warning: bootloader (first 64040 bytes of file) md5 doesn't match. This parser may not work with a different bootloader
Expected 166162c6c9f21d7a710dfd62a3452684, got c72bf051f0569a6ca809eb7750364562
Dumping bootloader to data/bootloader.bin
Error: Unable to determine what type of IPMI firmware this is!
Last edited:
So, I managed to reset the BMC back to factory defaults and login. I took a dump of the 32MB SPI for the BMC firmware, extracted the JFFS2 region, mounted it (in Linux) and then deleted the files listed in the environment variables rm_files (found in the cramfs rootfs in bin/define_var.sh )
Unmount the JFFS2 after deleting the above files and use dd to replace the JFFS2 region in the BMC dump with the modified filesystem. Reflash. Boot, and the BMC will be reset to factory defaults (DHCP, ADMIN/ADMIN). You will however, lose any installed licenses.
Unfortunately now that the BMC and remote console are working, I find that my board is dead. It does not pass POST. I'm using a CPU and RAM from another server which I know work.
I have the POST codes 15 3B 32 4F on the remote console and then the board resets. I've contacted the vendor to replace the board and I'll update when I have something more to share.
BTW, PSBlock seems to be the file of interest for the web admin authentication. It was the file that on older BMC firmwares could be gotten with a simple nc on port 49152, which Supermicro patched. The new file seem to be in some kind of binary format, file claims it's a dbView III file, but dbview cannot read it.
Removing the PSBlock file from the JFFS2 filesystem will result in /lib/libipmi.so recreating the file with the default ADMIN/ADMIN login.
Code:
export rm_files="lighthttpd.conf OEMPSBlock service.conf bmc_hostname ddns PSBlock FWBlock SDRBlock network ntp/ntp.conf SELBlock server.pem timezone vm_image.conf wsman enSSL.config sysmacaddr.conf wsman/simple_auth.passwd wsman/openwsman.conf ipctrl/rultbl.sav snmpd.conf ddns/DDNS_CONFIG ddns/ddns.key ddns/ddns.private IKVMViewerLang stunnel.conf redfish/event.ini"Unfortunately now that the BMC and remote console are working, I find that my board is dead. It does not pass POST. I'm using a CPU and RAM from another server which I know work.
I have the POST codes 15 3B 32 4F on the remote console and then the board resets. I've contacted the vendor to replace the board and I'll update when I have something more to share.
BTW, PSBlock seems to be the file of interest for the web admin authentication. It was the file that on older BMC firmwares could be gotten with a simple nc on port 49152, which Supermicro patched. The new file seem to be in some kind of binary format, file claims it's a dbView III file, but dbview cannot read it.
Removing the PSBlock file from the JFFS2 filesystem will result in /lib/libipmi.so recreating the file with the default ADMIN/ADMIN login.
Last edited: