Would either of these work? I'm concerned that if I choose a IP address like 192.168.0.0 it could cause an issue if someone was to directly connect to the port and send packets to the network address.
If they have physical access to do this, you have much larger problems.
The issue with choosing a random IP address is that essentially anyone will be able to eventually find it. But if they have access to plug in to it, they probably have access to reset the IPMI and just use the defaults. But if they have access to reset the IPMI interface, they have access to just yank the drives out and run with them.
And then there's the fact that IPMI can be configured to share an interface rather than use the internal interface, which means that even unplugging it and epoxying up the interface might not be enough to do what you want.
Oh, right, and then there's the fact that IPMI can be accessed locally using ipmitool. (I think you're actually referring to IPMI Over LAN which is a bolt-on to IPMI).
So, although I sympathise with your situation, I don't think you're going to have much success totally eliminating IPMI from your system. To minimise the IPMI surface area:
- Disable guest IPMI accounts, set a very very strong password on the administrator account (throw the password away if you want)
- Unplug the IPMI port (gunk it up if you really want to with some epoxy).
That's really about the best you can do. By setting a strong password, you're able to stop people from getting in and setting the IPMI to use a shared interface and stopping them from using ipmitool, and by unplugging and managing the physical security of the server you should be able to stop remote attacks directly against the IPMI Over LAN interface.
