Intel Software Network articles feed

Intel® WS-Management Translator

Mon, 05 Oct 2009 16:20:49 -0700

Introduction

Beginning with Intel® Active Management Technology (Intel® AMT) release 3.0, Intel introduced support for the industry standard WS-Management protocol. This allows management software to use a combination of standard CIM classes, as well as Intel specific classes, to perform Intel® AMT operations. Support for the WS-Management specification enables software developers and IT professionals to leverage off-the-shelf infrastructure and tools to interact with Intel® AMT platforms. But what about using WS-Management based software in conjunction with Intel® AMT platforms older than release 3.0? Intel has shipped many platforms that can only support a firmware version of 2.6 or below. Can WS-Management based software be used with these older Intel platforms?

Enter the Translator

The Intel® WS-Management Translator makes it possible for WS-Management based software to be used in conjunction with Intel® AMT platforms older than version 3.0. Using the translator, management software can send WS-Management commands to the translator, the translator will in turn perform the equivalent operation on an Intel® AMT device using a proprietary SOAP based protocol understood by all Intel® AMT platforms.

Download The Intel® WS-Management Translator for vPro™ Processor Technology

File Name:	WSTrans.msi *build 568
Date Published:	10/05/09
Download Size:	2.11 MB

Key features in the Translator 1.1 (build 568)

Validation with SCCM SP2
Enhanced legacy support for wireless profiles, 8021.x profiles, and 3party data storage
Enhanced Kerberos authentication and Kerberos ticket handling
You can upgrade from existing builds by using this VB Script or it can be installed on its own.

Download Source Code for The Intel® WS-Management Translator for vPro™ Processor Technology

File Name:	Source Code (wstrans_src_build_542.zip)
Date Published:	08/19/08
Download Size:	640 kb

Genscript

Genscript is a tool for activating Intel® Active Management Technology (Intel® AMT) features in a scriptable environment. Genscript generates Visual Basic® scripts that can be applied to a single machine or many machines. These scripts programmatically can activate various Intel AMT features using Windows Remote Management (WinRM). Genscript can also be used in conjunction with the Intel WS-Management Translator to perform initial setup of Intel AMT clients and programmatically activate features on AMT clients that don’t natively support WinRM. Intel AMT clients that are already setup, and natively support the WS-Management interface, will not require the assistance of the Intel WS-Management translator software.

Download Genscript for The Intel® WS-Management Translator for vPro™ Processor Technology

File Name:	genscript1_0_15.zip
Date Published:	02/13/09
Download Size:	62.2 kb

Additional Information

Troubleshooting the IMR_RES_TLS_CONNECTION_FAILED error in mutual TLS

Wed, 08 Apr 2009 03:36:05 -0700

Troubleshooting the IMR_RES_TLS_CONNECTION_FAILED error in mutual TLS

This article expands on the author’s previous blog post titled “Tips to check if the SCS, the DTK or your app doesn’t connect to an AMT Enterprise machine” . It includes some specific steps to troubleshoot this error message. This article is written by Javier Andres Caceres Alvis. Javier works as a Software Engineer for Aranda Software (ISV enabling for Intel AMT).

The Manageability DTK and other applications that use SOL and IDER-R capabilities utilize the functionality exposed by the Redirection Library. This library is included in the imrsdk.dll file and is the one in charge of establishing a TCP (port 16994) or TLS (port 16995) connection, so if you’re sure you’ve checked all the possible error sources mention in the post above followingnext steps will help.

Picture 1. Key values.

Verify that your SSL client and server certificates contain the keys shown in picture 1; these values must be 1.3.6.1.5.5.7.3.2 and 2.16.840.1.113741.1.2.1, or both (no matter if you used a customized template or a standard one). If your client application still has the same error, please find the imrsdk.ini file (which must be in the same folder that imrsdk.dll), open it and set the debug level to “2”:
[COMMON]
Debug_Level=2
Storage_Enabled=0

With Debug_Level=2 you will get a log file that specifies what the concrete error is. In this example, I got these entries in my log.txt found it to be due to a duplicated certificate in my store:
LOG STARTED Fri Mar 13 11:09:37 2009
NETMGR: added UDP socket to read socks: 1456
NETMGR: Signal socket created: 1500
SSLSocket::connect: failed to set certificate chain file file
SSLSocket::connect: func X509_STORE_add_cert, reason cert already in hash table
SSLSocket::connect: failed to set certificate chain file file
SSLSocket::connect: func X509_STORE_add_cert, reason cert already in hash table
LOG ENDED Fri Mar 13 11:13:07 2009

Picture 2. Duplicate certificate.

As shown in picture 2, in this example, the same certificate appeared twice in “Trust root certification Authorities“; To know which one to delete navigate to the IAMT machine’s WebUI, find the issuer certificates’ serial number (Picture 3), delete the bad one and the DTK will work fine.

Picture 3. Issuer certificate’s serial number.

Don’t forget that the DTK takes ALL the trusted root certificates to a *.pem file called “Trusted Root Certificates.pem” the first time is started, so if you changed something in your environment please delete this file and start the application again.

Building an Intel AMT Agent Monitor (Part 1)

Wed, 08 Apr 2009 03:32:35 -0700

This article explores the security benefits of Intel® Active Management Technology (Intel® AMT), specifically the System Defense feature, network security policies and heuristic filters to finally build an Agent monitor (or "Agent Presence"). This article is written by Javier Andres Caceres Alvis. Javier works as a Software Engineer for Aranda Software (ISV enabling for Intel AMT).

Introduction

Intel AMT has two closely related features: System Defense and Agent Presence. Below is a brief description of what they are and how to use them:

• System Defense (previously known as "circuit breaker"): is in short the capacity of a machine to block the traffic of packets through a network security policy. A network security policy is the way to group filters and a filter is a test made to the incoming or outgoing traffic from one machine to verify if it meets certain conditions (for example, a common condition is to review the packages’ IP).

There are pre-loaded filters and the possibility of creating new ones. Heuristic filters are types of filter that can block the outgoing traffic from one machine to prevent it from infecting / attacking other machines on the network. This traffic blocking is done through the inspection of outgoing packets in order to find unusual operating conditions. Find more on this topic here (http://software.intel.com/en-us/articles/download-the-latest-intel-amt-software-development-kit-sdk/).

• Agent Presence: This feature allows an independent vendor’s software agent (like: a firewall, an anti viruses, an asset tracker) to report to Intel AMT that: 1) it is started, 2) it is running 3) it is shutdown. This very important because a user or an exceptional condition may terminate or stop a software agent unexpectedly.

The way Agent Presence and policies interact with an agent monitor is through state transitions. For example: when the monitor reports that an agent changes from "Running" to "Expired" state, it is possible to automatically activate/disable a policy to allow / block all inbound / outbound traffic.

Building an agent monitor

Agent monitors are built in two pieces: one in the AMT machine (local) and one in the monitoring console (remote). The remote piece is for agent monitor management functions: like creation, selection, and deletion. The local piece is for agent monitor registration (previously created in the remote interface) and reporting (of its currently state through “heartbeat” signals). The way in which both parts communicate is via a shared GUID.

Using the Intel Manageability DTK:

In the Manageability DTK, there is an application called “Intel AMT Outpost” which one simulates to be an agent monitor and it attracted my attention because it lets making a relation between the heartbeat signals and any application’s execution.

You can start by taking the DTK’s source code as a basis to write a C# solution made of a monitor console and an agent. Both the console and the agent consume Intel AMT machine’s web services (EOI, not WS-Man). Agent monitors are also known as watchdogs. The results of this exercise are two sample applications: a remote one (Figure 1) for watchdog creation, deletion and selection and a local one (Figure 2) for watchdog registration and reporting.

Figure 1. Agent monitor console.

Both applications share a GUID to uniquely identify each other. The application’s source code is available. Some agent monitor’s parameters (like heartbeats) are static. Note that this is a sample, so it does not meet best design practices.

Figure 2. Agent monitor.

During the development of this sample I learnt two things: 1) it’s necessary to increment the heartbeat sequence and 2) the relation between a heartbeat signal and an application’s execution shown in “Intel AMT Outpost” is merely descriptive; I mean, it is an agent monitor‘s task to perform any action to verify the application’s execution and it is not an built-in AMT function.

During the testing stage I found that it is not necessary to create a “watchdog” before performing a registration or a reporting action. General recommendations: 1) Use “localhost” instead of IP in Windows Vista machines, 2) Don’t use the remote interfaces from AMT host, 3) If you get a "Failed to parse the request" exception while calling any web service method it’s probably that you need to change the WSDL files’ version (in my case, I first added a web service reference to SDK 5.0.1.4 WSDL files and then I needed to change them) and 4) be careful with the heartbeat sequence increments because your unsigned int variable (that holds this value) can become huge.

Solving End User Problems with Intel® Active Management Technology

Tue, 24 Feb 2009 10:46:21 -0800

Download the article to learn how Intel® Active Management Technology features can be used to solve real world problems based on scenarios and how the addition of the hardware features engineered into Intel AMT delivers an effective and secure solution.

Using Intel® Active Management Technology in Small to Medium Business

Tue, 24 Feb 2009 10:44:41 -0800

Download this technical article to learn how to get started on leveraging Intel® Active Management Technologies in Small to Medium Businesses and how to utilize the now freely available Manageability Developer Tool Kit (DTK).

Technical Article: An introduction to Intel® Active Management Technology

Tue, 24 Feb 2009 10:43:02 -0800

Download this article now to understand the key capabilities, the different end user solutions that are built using Intel Active Management Technologies, its capabilities and key characteristics that differentiate this technology from traditional management based on OS agents.

Next-Generation Streaming Clients, Based on Intel® vPro™ Technology

Tue, 27 Jan 2009 16:05:00 -0800

Take a look at next-generation mechanisms for streaming the results of operating systems, data storage, and applications to client systems. Learn how Intel vPro technology provides industry-first solutions that can be used by IT organizations to build these streaming client platforms that offer the mobility and flexibility of personal computers.

Enabling Dynamic Virtual Client Computing with Intel® vPro™ Technology

Tue, 27 Jan 2009 16:03:59 -0800

See how the boundaries created by different hardware devices (for example, servers, desktop, and mobile computers) can be spanned by Dynamic Virtual Client (DVC) computing. The result is a sharp improvement in flexibility when reallocating IT resources.

Power Efficiency and Sustainable Information Technology

Tue, 27 Jan 2009 16:01:24 -0800

These authors tackle the ever-increasing problem of the cost of energy consumption in an enterprise. They show how the use of remote power-management technologies allow a business to manage energy consumption while ensuring that systems can be awakened in a reliable, secure manner.

Mobile Manageability in Low-Power and Operating-System-Absent States

Tue, 27 Jan 2009 16:00:13 -0800

Find out how Intel vPro technology overcomes the shortcomings of Alert Standard Format (ASF) in managing laptop computers both in Sx states and in the absence of an operating system in the S0 state.