SOLVED FreeNAS Mini (C2750D4I) BMC Update Fails

[cshake]

The motherboard in my Mini failed a little over a year ago, potentially from the watchdog issue, after working for a year straight before that. iXsystems cross-shipped a replacement for me, were very helpful, and I had the Mini working again quickly and haven't had any problems since.

I saw the warnings recently about the watchdog issue and BMC firmware update, and the critical alert is flashing at me. I'm currently running 9.10.2-U3, have the watchdogd_enable=NO tunable set, and watchdog is disabled in the BIOS (v2.90). I know with all of that going I don't have to worry about the board failing due to this issue, but I still would like to update the BMC firmware from 00.27.00 to 00.30.00 to get rid of the flashing alert and email about it after reboots.

The problem I'm having is that the image fails verification in the BMC update process every time I try. I've downloaded the image directly from ASRock Rack (http://www.asrockrack.com/general/productdetail.asp?Model=C2750D4I#Download) following the link in the critical alert, from both the US and EU links, in Firefox and Chrome, and every time it gives me the same checksums (but since ASRock doesn't provide the correct sums, I can't directly compare):

Code:

  File: C2750D4I(00.30.00)BMC.zip
CRC-32: c3d9e984
   MD4: 48b0bbf23249699f66023e71f9c2c105
   MD5: 9647ff0ffeece8f780916d25e87211ee
SHA-1: a718f40f99961f74ac97db47c34e2452292b45f9

I have logged in to the IMPI interface and gone to firmware update in both Firefox and Chrome again (latest of both), and get the same "Image Verification unsuccessful" error every time, and have no idea how to get it to work. Screenshot from Chrome if it helps:

Has anyone else had this issue, or know what else I can try to get it to work?

 

[zoomzoom]

MD4 & MD5 should never be used, nor should SHA1​

Hashes are wrong... should be:

Code:

	# C2750D4I(00.30.00)BMC.zip #
#---------------------------------------
SHA1:   0F58177A4833F8EB37662AE93956A81BC729C7BB
SHA256: 651311189EECDAC7E7BAB31FE0C7ABD925C157D09A00E08DA34A2AE950BFD3B0
SHA512: CBBA983A882CA4469911604BE62987C31DEFB57BBA869437C503099B7FDADFA71760B34EC50A54BB2779A233AE0DA83F8EC16DD90EB33062A531AAAD96FD21A8


	# C2550D4I_P0.30.00.ima #
#---------------------------------------
SHA1:   E708A9B04BE039D44AD701F22DA77E0726EB2E13
SHA256: 8AA64ED2589EA237C384F03DEBC7C2E0BC4CC789684CD2E3729B020854252794
SHA512: 22A15B778C70D8D314EE53F86B0E613A156F29AF499F490CE961E87BE98B295D17173044B283C6FBB537022DD1A16A3865604C5A9B9480A27642567372E9EF37

Ensure you're booted to the BIOS PRIOR TO flashing, as once the BMC is flashed, you need to hit F10 to save in the BIOS as well.

• See: BMC Firmware Update by IPMI
• Failing to do this could result in a corrupted BMC flash, leaving the IPMI GUI inaccessible.

 

[cshake]

Well, now I feel like an idiot. I was trying to flash the zip file, not the extracted image.

Apparently ASRock personalizes their zip downloads or something, because I just downloaded the zip again today, got the same hashes as I'd gotten before, but once I extracted the image it matched the hashes you provided above, and has been flashed successfully now. I had filled in the blanks about being in the BIOS first (given that I had to save and exit at the end), it would be nice for their instructions to explicitly say you should boot to BIOS before starting.

I know that MD4 and MD5 are thoroughly compromised, having done some network security and coding in the past, the only reason I posted all of them is that's the full output from the version of the HashCheck shell extension that I had installed. I looked around and got the newer version that has SHA3-256/512 now. As for SHA-1, I was under the impression that it's still plenty good enough when checking that a file is or isn't corrupted (partial download, etc.), but I guess I wasn't thinking about malicious injection in this case.

Regardless, thanks for posting the hash of the extracted image and making me realize my boneheaded mistake!

 

[zoomzoom]

...it would be nice for their instructions to explicitly say you should boot to BIOS before starting.

That's a great point, as if you're following the how to step by step, it doesn't say anything about the BIOS until step #6.