SECURE NETWORK SYSTEM REQUEST SUPPORT VIA A PING REQUEST

• US 20130139223A1
• Filed: 11/30/2011
• Published: 05/30/2013
• Est. Priority Date: 11/30/2011
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Woodman, Larry, Bhargava, Prarit, Gospodarek, Andrew D.
• Granted Patent: US 9,053,311 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/42 using separate channels for security data

Abstract

Methods and systems for secure network system request (sysrq) via Internet Control Message Protocol (ICMP) are described. A remote computing system sends a query over a network to a target computing system and determines whether the target computing system is non-responsive to the query. When the target computing system is non-responsive to the query, the remote computing system sends an ICMP request to the target computing system over the network. The ping request includes a command to be performed by the target computing system and a key to verify authorization to perform the command.

Claims

1. A method, implemented by a remote computing system programmed to perform the following, comprising:

sending, by the remote computing system, a query over a network to a target computing system;

determining whether the target computing system is non-responsive to the query; and

when the target computing system is non-responsive to the query, sending a ping request to the target computing system over the network, wherein the ping request comprises a key and a command to be performed by the target computing system.

2. The method of claim 1, wherein said sending the ping request comprises sending a Internet Control Message Protocol (ICMP) echo request packet to signal a remote system request (sysrq) event and the command to be performed by the target computing system for the remote sysrq event.

3. The method of claim 2, further comprising receiving an ICMP response that indicates a success of the remote sysrq event.

4. The method of claim 3, wherein said receiving the ICMP response comprises receive an ICMP echo reply packet.

5. The method of claim 1, wherein the command is configured to capture system state information of the target computing system.

6. The method of claim 1, wherein the command is a remote system request (sysrq) event.

7. The method of claim 1, wherein the command is a command key that causes the target computing system to perform a kernel execution (kexec) reboot to permit system state information of the target computing system to be output to a console associated with the target computing system.

8. The method of claim 1, wherein the command is a command key that causes the target computing system to output current registers and flags of the target computing system to a console associated with the target computing system.

9. The method of claim 1, wherein the command is a command key that causes the target computing system to output memory information to a console associated with the target computing system.

10. The method of claim 1, wherein the command is a command key that causes the target computing system to terminate a process executing on the target computing system.

11. The method of claim 1, wherein the key is a digital value stored in memory of a debugger file system.

12. The method of claim 1, further comprising:

establishing a secure channel to the target computing system over the network; and

saving the key into a file stored on the target computing system over the secure channel, wherein the key stored in the file is compared against the key of the ping request by the target computing system to verify authorization to perform the command.

13. The method of claim 1, further comprising:

establishing a secure channel with the target computing system over the network;

mounting a debugger file system on the target computing system;

enabling a system request (sysrq) key;

storing the key in a file of the debugger file system; and

enabling the key.

14. The method of claim 12, wherein said establishing the secure channel comprises establishing a secure shell (SSH) channel with the target computing system over the network.

25. The method of claim 1, further comprising:

mounting a debugger file system on the target computing system;

enabling a system request (sysrq) key;

storing the key in a file of the debugger file system; and

enabling the key.

15. A method, implemented by a target computing system programmed to perform the following, comprising:

receiving, at the target computing system, a ping request from a remote computing system over a network, wherein the ping request comprises a command to be performed by the target computing system and a key to verify authorization to perform the command;

verifying the key of the ping request against a key stored in memory to authorize the command; and

performing the command when the key of the ping request is verified.

16. The method of claim 15, further comprising:

receiving, at the target computing system, the key from a console associated with the target computing system; and

storing the key in the memory of the target computing system.

17. The method of claim 15, wherein said receiving the ping request comprises receiving an Internet Control Message Protocol (ICMP) echo request packet to signal a remote system request (sysrq) event and the command to be performed by the target computing system for the remote sysrq event.

18. The method of claim 17, further comprising sending an ICMP response to indicate a success of the remote sysrq event.

19. The method of claim 15, wherein said performing the command comprises:

performing a kernel execution (kexec) reboot; and

outputting system state information of the target computing system to the console associated with the target computing system.

20. The method of claim 15, wherein said performing the command comprises outputting current registers and flags of the target computing system to the console associated with the target computing system.

21. The method of claim 15, wherein said performing the command comprises outputting memory information to the console associated with the target computing system.

22. The method of claim 15, wherein said performing the command comprises terminating a process executing on the target computing system.

23. The method of claim 15, further comprising:

establishing a secure channel with the remote computing system over the network; and

receiving the key from the remote computing system over the secure channel, and wherein said storing comprises storing the key into a file stored in the memory of the target computing system.

24. The method of claim 15, wherein said verifying comprises comparing the key of the ping request against the key stored in memory to verify authorization to perform the command.

26. The method of claim 23, wherein said establishing the secure channel comprises establishing a secure shell (SSH) channel with the remote computing system over the network.

27. A non-transitory computer readable storage medium including instructions that, when executed by a remote computing system, cause the remote computing system to perform a method comprising:

sending, by the remote computing system, a query over a network to a target computing system;

determining whether the target computing system is non-responsive to the query; and

when the target computing system is non-responsive to the query, sending a ping request to the target computing system over the network, wherein the ping request comprises a command to be performed by the target computing system and a key to verify authorization to perform the command.

28. The computer readable storage medium of claim 27, wherein the method further comprises:

establishing a secure channel to the target computing system over the network; and

saving the key into a file stored on the target computing system over the secure channel, wherein the key stored in the file is compared against the key of the ping request by the target computing system to verify authorization to perform the command.

29. A non-transitory computer readable storage medium including instructions that, when executed by a target computing system, cause the target computing system to perform a method comprising:

receiving, at the target computing system, a key from a console associated with the target computing system;

storing the key in memory of the target computing system;

subsequently receiving, at the target computing system, a ping request from a remote computing system over a network, wherein the ping request comprises a command to be performed by the target computing system and a key to verify authorization to perform the command;

verifying the key of the ping request against the key stored in memory to authorize the command; and

performing the command when the key of the ping request is verified.

30. The computer readable storage medium of claim 29, wherein the method further comprises:

establishing a secure channel to the remote computing system over the network; and

receiving the key from the remote computing system over the secure channel, and wherein said storing comprises storing the key into a file stored in the memory of the target computing system.

31. A target computing system, comprising:

a data storage device; and

a processing device, coupled to the data storage device, to execute a secure network system request (sysrq) module, wherein the secure network sysrq module is configured to;

receive, at the target computing system, a key from a console associated with the target computing system;

store the key in memory of the target computing system;

subsequently receive, at the target computing system, a ping request from a remote computing system over a network, wherein the ping request comprises a command to be performed by the target computing system and a key to verify authorization to perform the command;

verify the key of the ping request against the key stored in memory to authorize the command; and

perform the command when the key of the ping request is verified.

32. The target computing system of claim 31, further comprising the console associated with the target computing system.

33. The target computing system of claim 32, wherein the console is a remote console, and wherein the secure network sysrq receives the key over a secure channel between the remote console and the target computing system.

34. A method, implemented by a remote computing system programmed to perform the following, comprising:

communicating with a target computing system over a network by the remote computing system; and

sending a ping request to the target computing system over the network, wherein the ping request comprises a key and a command to be performed by the target computing system.

35. The method of claim 34, wherein said sending the ping request comprises sending a Internet Control Message Protocol (ICMP) echo request packet to signal a remote system request (sysrq) event and the command to be performed by the target computing system for the remote sysrq event, and wherein the key of the ping request is used by the target computing system to verify the ping request.