Bmc on Backend Engineering Strategy Tools

IPMI

Fri, 22 May 2026 00:00:00 +0000

IPMI (Intelligent Platform Management Interface) is a hardware-level management standard built into most server-class hardware. It runs on a dedicated processor on the motherboard — the BMC (Baseboard Management Controller) — independently of the host OS. The BMC has its own NIC, its own firmware, and its own IP address. You can power a server on or off, read sensor data, and access a serial console even if the host is completely dead.

Current version is IPMI 2.0, which added encryption and stronger authentication over 1.5.

BMC implementations by vendor

IPMI is the standard; each vendor ships their own BMC firmware on top of it:

Vendor	BMC / OOB product	Notes
Dell	iDRAC (Integrated Dell Remote Access Controller)	iDRAC 6/7/8/9; newer versions add Redfish
HP / HPE	iLO (Integrated Lights-Out)	iLO 2/3/4/5; iLO 4+ adds Redfish
Sun / Oracle	ILOM (Integrated Lights-Out Manager)	Sun Fire series (X4150, X4450, etc.)
Supermicro	IPMI / BMC	Web UI + IPMI; newer boards also Redfish
Lenovo / IBM	XClarity / IMM	IMM2 on older systems
HP BladeSystem	Onboard Administrator (OA)	Enclosure-level management (C7000, C3000) — separate from individual blade iLO

Most also expose a web UI and some form of virtual KVM (keyboard/video/mouse over network) in addition to IPMI over LAN.

Network setup

The BMC NIC is usually shared with a host NIC (shared/failover mode) or dedicated (preferred for management). Configure via BIOS/UEFI or the vendor’s setup utility before the OS boots.

Assign a static IP — a BMC on DHCP is workable but inconvenient. Keep BMCs on a dedicated management VLAN if possible; they have historically had security issues and shouldn’t be exposed to general traffic.

ipmitool

The standard CLI for IPMI over LAN. Available in most Linux package repos.

# Power control
ipmitool -I lanplus -H <bmc-ip> -U <user> -P <pass> power status
ipmitool -I lanplus -H <bmc-ip> -U <user> -P <pass> power on
ipmitool -I lanplus -H <bmc-ip> -U <user> -P <pass> power off
ipmitool -I lanplus -H <bmc-ip> -U <user> -P <pass> power cycle
ipmitool -I lanplus -H <bmc-ip> -U <user> -P <pass> power reset

# Sensor readings (temperatures, voltages, fan speeds)
ipmitool -I lanplus -H <bmc-ip> -U <user> -P <pass> sensor list

# System Event Log
ipmitool -I lanplus -H <bmc-ip> -U <user> -P <pass> sel list
ipmitool -I lanplus -H <bmc-ip> -U <user> -P <pass> sel clear

# Serial over LAN (SoL) — console access without KVM
ipmitool -I lanplus -H <bmc-ip> -U <user> -P <pass> sol activate
# Exit SoL: ~.

Use -I lanplus (IPMI 2.0 with encryption) rather than -I lan (IPMI 1.5, unencrypted) where supported.

Serial over LAN (SoL)

SoL forwards the server’s serial port over the IPMI connection — giving you a text console to the host without a KVM or physical access. Requires the host OS to have serial console enabled:

# Add to GRUB_CMDLINE_LINUX in /etc/default/grub
console=tty0 console=ttyS1,115200n8

# Enable serial getty
systemctl enable serial-getty@ttyS1.service

Baud rate must match what’s configured in the BIOS/BMC (typically 115200).

Security

IPMI has a poor security history:

IPMI 1.5 sends credentials in cleartext
IPMI 2.0 has had multiple authentication bypass vulnerabilities (RAKP, cipher 0)
The BMC itself runs independent firmware that may have unpatched CVEs
Default credentials (admin/admin, ADMIN/ADMIN) are common and widely known

Minimum steps:

Change default credentials immediately
Use IPMI 2.0 (lanplus) only
Disable cipher suite 0: ipmitool -I lanplus ... lan set 1 cipher_privs XxxxxxxxxxxxxxxX
Isolate BMC network from internet and untrusted hosts — management VLAN with no external exposure
Keep BMC firmware updated

Redfish — the modern REST API replacement for IPMI
Out-of-band management overview
Hardware provisioning — PXE boot and bare-metal provisioning

Out-of-Band Management

Fri, 22 May 2026 00:00:00 +0000

Out-of-band (OOB) management means controlling a server independently of its operating system — via a dedicated processor on the motherboard called the BMC (Baseboard Management Controller). The BMC has its own NIC, its own firmware, and its own IP. You can power a server on, read temperatures, and access a console whether or not the host OS is running, hung, or even installed.

Used for: bare-metal provisioning, remote recovery, hardware monitoring, firmware updates, automated power management.

Standards

Two main protocols, one old and one new:

	IPMI	Redfish
Protocol	Binary, UDP 623	HTTPS / JSON (REST)
Era	1998–	2015–
Scripting	ipmitool	curl, Python, any HTTP client
Security	Weak (known CVEs)	TLS + token auth
Availability	Universal	Modern hardware (roughly post-2015)

IPMI — the established standard; ipmitool, SoL, sensor readings, security considerations
Redfish — the modern replacement; REST API, curl and Python examples, firmware updates

Vendor implementations

Most vendors ship their own BMC firmware on top of these standards:

Vendor	Product	Supports
Dell	iDRAC	IPMI + Redfish (iDRAC 8+)
HP / HPE	iLO	IPMI + Redfish (iLO 4+)
Sun / Oracle	ILOM	IPMI 2.0, web UI
Supermicro	BMC	IPMI + Redfish (X11+)
Lenovo	XClarity / IMM	IPMI + Redfish
HP BladeSystem	Onboard Administrator	Enclosure-level; individual blades use iLO

Hardware provisioning — PXE boot, bare-metal provisioning tools

Redfish

Fri, 22 May 2026 00:00:00 +0000

Redfish is a DMTF standard that defines a RESTful API for out-of-band server management. It replaces IPMI’s aging binary protocol with JSON over HTTPS — same capabilities (power control, sensors, firmware, console), but with a proper API, role-based access control, and standard authentication. Supported by all major server vendors on current-generation hardware.

Why Redfish over IPMI

	IPMI	Redfish
Protocol	Binary, UDP 623	HTTPS (REST/JSON)
Auth	RAKP (has CVEs)	HTTP Basic / Session tokens
Encryption	Optional (IPMI 2.0)	Always (TLS)
Discoverability	No	Yes (hypermedia)
Scripting	ipmitool flags	curl, Python, any HTTP client
Extensibility	Vendor OEM extensions	Structured OEM namespaces
Maturity	Established, aging	Modern, actively developed

Redfish is not universally available — older hardware (pre-2015 roughly) has IPMI only. Both coexist on many current systems; IPMI is still useful for compatibility. See IPMI.

Vendor implementations

Vendor	BMC	Redfish support
Dell	iDRAC 8+	Full, v1.0+
HPE	iLO 4+	Full (iLO 5 most complete)
Supermicro	BMC (X11+)	Full
Lenovo	XClarity	Full
Intel	BMC on server boards	Partial
OpenBMC	Open-source BMC firmware	Full (used by Facebook, Google infra)
AMI MegaRAC	OEM BMC firmware	Full

API structure

Redfish uses a consistent URL hierarchy rooted at /redfish/v1/. Navigation is hypermedia-driven — the root returns links to subsystems, and you follow them.

/redfish/v1/
├── Systems/ ← compute systems (servers)
│ └── 1/
│ ├── Processors/
│ ├── Memory/
│ ├── Storage/
│ └── Actions/ComputerSystem.Reset
├── Chassis/ ← physical chassis, power, thermal
│ └── 1/
│ ├── Power/ ← PSU status, power consumption
│ └── Thermal/ ← temperatures, fan speeds
├── Managers/ ← the BMC itself
│ └── 1/
│ └── NetworkInterfaces/
└── UpdateService/ ← firmware updates

Usage with curl

BMC="https://192.168.1.10"
USER="admin"
PASS="password"

# Get system overview
curl -sk -u "$USER:$PASS" "$BMC/redfish/v1/Systems/1" | jq .

# Power state
curl -sk -u "$USER:$PASS" "$BMC/redfish/v1/Systems/1" | jq .PowerState

# Power on
curl -sk -u "$USER:$PASS" -X POST \
 -H "Content-Type: application/json" \
 -d '{"ResetType":"On"}' \
 "$BMC/redfish/v1/Systems/1/Actions/ComputerSystem.Reset"

# Power off (graceful)
curl -sk -u "$USER:$PASS" -X POST \
 -H "Content-Type: application/json" \
 -d '{"ResetType":"GracefulShutdown"}' \
 "$BMC/redfish/v1/Systems/1/Actions/ComputerSystem.Reset"

# Force off
curl -sk -u "$USER:$PASS" -X POST \
 -H "Content-Type: application/json" \
 -d '{"ResetType":"ForceOff"}' \
 "$BMC/redfish/v1/Systems/1/Actions/ComputerSystem.Reset"

# Thermal — CPU temps, fan speeds
curl -sk -u "$USER:$PASS" "$BMC/redfish/v1/Chassis/1/Thermal" | jq '.Temperatures[] | {Name, ReadingCelsius}'

Reset types vary by vendor — check AllowableValues in the action schema:

curl -sk -u "$USER:$PASS" \
 "$BMC/redfish/v1/Systems/1" | jq '.Actions["#ComputerSystem.Reset"]["ResetType@Redfish.AllowableValues"]'

Python — sushy

sushy is the reference Python library for Redfish, used by OpenStack Ironic:

import sushy

client = sushy.Sushy("https://192.168.1.10", username="admin", password="password", verify=False)

system = client.get_system("/redfish/v1/Systems/1")
print(system.power_state) # On / Off
system.reset_system(sushy.RESET_ON)
system.reset_system(sushy.RESET_FORCE_OFF)

Session-based auth

For scripts making many requests, create a session to avoid re-authenticating on every call:

# Create session
SESSION=$(curl -sk -X POST \
 -H "Content-Type: application/json" \
 -d '{"UserName":"admin","Password":"password"}' \
 "https://192.168.1.10/redfish/v1/SessionService/Sessions" \
 -D -)

TOKEN=$(echo "$SESSION" | grep -i X-Auth-Token | awk '{print $2}' | tr -d '\r')

# Use token
curl -sk -H "X-Auth-Token: $TOKEN" \
 "https://192.168.1.10/redfish/v1/Systems/1" | jq .PowerState

Firmware updates

Redfish standardises firmware update via UpdateService:

# Check current firmware
curl -sk -u "$USER:$PASS" "$BMC/redfish/v1/UpdateService/FirmwareInventory" | jq .

# Push update (multipart, vendor-specific details vary)
curl -sk -u "$USER:$PASS" -X POST \
 -H "Content-Type: application/octet-stream" \
 --data-binary @firmware.bin \
 "$BMC/redfish/v1/UpdateService/update"

Vendor tooling (Dell racadm, HPE iLOrest) is often more reliable than raw curl for firmware updates.

IPMI — older binary protocol, still needed for pre-Redfish hardware
Out-of-band management overview
Hardware provisioning — PXE boot and bare-metal provisioning

Bmc on Backend Engineering Strategy Tools

IPMI

BMC implementations by vendor

Network setup

ipmitool

Serial over LAN (SoL)

Security

Related

Out-of-Band Management

Standards

Vendor implementations

Related

Redfish

Why Redfish over IPMI

Vendor implementations

API structure

Usage with curl

Python — sushy

Session-based auth

Firmware updates

Related