amt-tools

amt-tools configures Intel Active Management Technology (AMT) and provides out-of-band management: power control, Serial-over-LAN (SOL) console access, and KVM redirection over VNC.

Network connections are secured with mutual TLS using a dedicated certificate authority (CA). Plaintext ports are closed during provisioning.

The package provides two components:

• python3 -m amt: Configuration utility. Runs on the target machine as root and communicates with AMT locally via /dev/mei0. Requires only the Python standard library.
• amtctl: Administrative client. Runs on the management machine to issue certificates, execute power operations, and open console sessions.

Tested on HP EliteDesk 800 G6 SFF with Intel AMT 14.1.77 build 2497 under Linux. Provided as-is.

Requirements

Target host:

• Intel AMT activated in Admin Control Mode (see Target host initialization).
• Linux MEI driver (mei_me) providing /dev/mei0.
• Python 3 standard library.
• Root execution privileges.

Management host:

• Python >= 3.12.
• cryptography package.

Installation

Management host:

uv tool install .     # or: pipx install .

Target host: The target host does not require package installation; copying the amt directory is sufficient.

Target host initialization

Initial configuration requires physical console access to enter the Management Engine BIOS Extension (MEBx).

Firmware update

Apply vendor BIOS/ME firmware updates before configuring AMT. ME firmware updates reset AMT to an unprovisioned state, discarding existing configuration.

Password requirements

The MEBx password must satisfy the following constraints:

• Length: 8 to 32 characters.
• Complexity: At least one uppercase letter, one lowercase letter, one digit, and one non-alphanumeric symbol.
• Layout: Characters must be enterable via standard ASCII physical keyboard layout at firmware level.

Upon MEBx activation, this password becomes the default password for the AMT admin account.

MEBx configuration

1. Enter MEBx: Press Ctrl-P during POST. On HP platforms, navigate to BIOS Setup (F10) -> Security -> Intel Management Engine Setup.
2. Change MEBx password: Replace the default password (admin).
3. Select Admin Control Mode (ACM): Client Control Mode (CCM) enforces physical user consent prompts on every redirection session without override. ACM allows disabling consent prompts via software configuration.
4. Configure network interface: By default, AMT uses the primary wired Ethernet port with passive DHCP, sharing the operating system's IP address.
5. Disable provisioning certificate hashes (optional): The ME firmware includes pre-installed root hashes for commercial CAs used in remote zero-touch provisioning. Deactivate these hashes if remote zero-touch provisioning is not used.
6. Set power policy: Ensure AMT is enabled across power states S0 through S5. Restricting AMT to S0 disables out-of-band power-on operations.

Confirm that plaintext HTTP responds over the local network:

nc -z -w2 192.168.1.55 16992 && echo reachable

Key generation

amtctl keygen generates missing credentials in the local store: the CA on first execution, client credentials, and host credentials.

amtctl keygen --name my-server --address 192.168.1.55

• --name: Common Name (CN) written to the AMT certificate.
• --address: Subject Alternative Name (SAN) and network address where AMT listens.

Subsequent invocations reuse existing CA and client credentials to issue certificates for additional hosts.

Provisioning

Transfer the CA certificate, host certificate, and host private key to the target host:

scp ~/.config/amt/ca.crt ~/.config/amt/hosts/my-server/amt.{crt,key} my-server:

Execute on the target host as root:

export AMT_PASSWORD=...
python3 -m amt provision --authority ca.crt --certificate amt.crt --key amt.key
python3 -m amt features --kvm --sol --no-ider --consent none
python3 -m amt state

amt reads the password from AMT_PASSWORD or standard input.

AMT stores the private key and certificate in firmware NVRAM; amt.key may be deleted from the filesystem after provisioning.

Provisioning operations

amt provision executes the following sequence:

1. Synchronizes the AMT clock to host system time.
2. Installs the CA certificate as a trusted root.
3. Installs the host key and certificate.
4. Binds the host certificate to the TLS endpoint.
5. Enables mutual TLS on network interfaces.

Plaintext ports 16992 (HTTP) and 16994 (Redirection) are disabled. TLS ports 16993 (HTTPS) and 16995 (TLS Redirection) accept only connections authenticated by client certificates signed by the configured CA.

Provisioning is idempotent. If the firmware state matches the requested configuration, no changes are made unless --force is specified.

--close-local enforces mutual TLS on the local interface (/dev/mei0). By default, the local interface accepts plaintext to allow recovery if client credentials are lost.

Verification

From the management host, verify that port 16993 is open, port 16992 is closed, and power status can be queried:

amtctl power status --name my-server --address 192.168.1.55

A TCP port scan does not distinguish an unactivated AMT interface from a provisioned mutual-TLS interface because both close plaintext ports. On the target host, python3 -m amt state queries the MEI interface directly to report control mode and TLS status.

Operating system serial console (SOL)

The AMT Keyboard and Text (KT) redirection UART maps to ttyS0 (PCI function 0000:00:16.3). Serial-over-LAN displays output only after the operating system is configured to attach a console to this device.

For Debian-based systems, create /etc/default/grub.d/serial-console.cfg:

GRUB_TERMINAL_INPUT="console serial"
GRUB_TERMINAL_OUTPUT="console serial"
GRUB_SERIAL_COMMAND="serial --port=$(cat /sys/class/tty/ttyS0/port) --speed=115200 --word=8 --parity=no --stop=1"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX console=tty0 console=ttyS0,115200n8"

Apply the configuration and start the console getty:

update-grub
systemctl enable --now serial-getty@ttyS0

Technical details:

• Dynamic port base: The KT redirection UART does not reside at standard legacy ISA port 0x3f8. GRUB's --unit=0 argument selects legacy ISA; the --port argument reads the hardware-assigned base from /sys/class/tty/ttyS0/port.
• Dual output: Defining both console and serial preserves output on physically connected displays while forwarding to the redirection UART.
• Graphical output: Firmware setup, bootloader splash screens, and ME user consent prompts are graphical and route exclusively to the KVM console.

Remote management

Execute from a host containing client credentials:

export AMT_NAME=my-server AMT_ADDRESS=192.168.1.55
export AMT_PASSWORD=...

amtctl power status            # on, off, cycle, reset
amtctl console                 # Serial-over-LAN; disconnect with ^]
amtctl kvm                     # VNC redirection via local proxy

KVM redirection

AMT KVM supports a maximum color depth of 16 bits. TigerVNC requires -AutoSelect=0 and -ColorLevel=2. amtctl kvm sets these options automatically when invoking vncviewer.

User consent

The --consent {none,kvm,all} setting is available only in Admin Control Mode. When user consent is enabled, redirection sessions block until a one-time numeric code displayed on the target machine's physical screen is entered into the client session.

Credential store

amtctl keygen writes PEM files to ~/.config/amt. Use --store or AMT_HOME to select an alternate path.

Environment variables take precedence over filesystem paths. Values must be raw PEM or base64-encoded PEM.

amtctl export prints credentials formatted as environment variable assignments.

amt (target side) reads files only; credentials stored in environment variables must be written to disk before running provision.

Loss of ca.key requires re-provisioning all managed hosts with a new CA.

Authentication

Supply the AMT admin password via AMT_PASSWORD or a command that prints it:

amtctl power status --password-command 'pass show amt/my-server'
export AMT_PASSWORD_COMMAND='op read op://infra/my-server/password'

Passwords are not accepted as command-line arguments to prevent exposure in process tables.

Recovery and de-provisioning

Software de-provisioning

Because amt communicates via /dev/mei0, network TLS misconfigurations can be reverted locally on the target host:

python3 -m amt unprovision

This disables mutual TLS and removes all installed certificates, keys, and interface bindings.

Hardware de-configuration

If the target operating system cannot boot or the AMT password is lost, unconfigure AMT via the vendor BIOS menu (e.g., HP BIOS Setup -> Unconfigure AMT on next boot or via the hp-bioscfg Linux kernel driver). Hardware unconfiguration resets AMT to factory default unactivated status and requires repeating physical MEBx initialization.

Development

python -m unittest discover -s tests -t .
ruff check . && ruff format --check .