IPMI and BMC: remote server management

Your server has a second, tiny computer that never sleeps and can press the power button for you. Treat it with the respect that deserves.

The short answer

A BMC (baseboard management controller) is a small, separate controller on a server board that manages the machine at hardware level, even when the operating system is down. IPMI (Intelligent Platform Management Interface) is the long-standing interface specification that the BMC speaks [1][3]. Should you expose it to the internet? No. CISA advises restricting IPMI access to specific management addresses, preferably in a separate network segment [1]. Our assessment: use it for power control, sensors and logs, but keep it off the open internet.

How it works

1. What the BMC does. CISA describes IPMI as a low-level interface that lets an administrator manage servers at hardware level; it runs on the BMC and gives access to the BIOS, disks and other hardware, including remote boot and monitoring of the server environment [1]. Out-of-band means it works even if the server's operating system is not running.
2. Where IPMI comes from. The IPMI specification, version 2.0, is published by Intel [3]. Many hardware makers adopted it [1]. HPE calls its implementation iLO (Integrated Lights-Out), Dell calls it iDRAC, and other makers use other names (our summary, unverified for each maker here).
3. The tool. ipmitool manages IPMI functions of the local system or a remote one, including FRU information, LAN configuration, sensor readings and remote chassis power control [2]. Remote management requires that the IPMI-over-LAN interface is enabled and configured [2].
4. Interface choice. For remote sessions, the manual describes lan and lanplus; the lanplus interface uses IPMI v2.0 and, by default, cipher suite 17 (RAKP-HMAC-SHA256, AES-CBC-128). Versions up to 1.8.18 defaulted to suite 3, which the manual calls insecure [2]. Our assessment: use lanplus and a current version.
5. The risk. CISA lists weaknesses reported by researcher Dan Farmer: passwords saved in clear text, one password working for a whole IPMI group, little monitoring for a compromised BMC, and some unencrypted traffic [1]. An attacker with BMC access can reboot the machine or install a new operating system, bypassing the operating system's own controls [1]. That text dates from 2013 (revised 2016), so read your vendor's current advisories [1].
6. Redfish as the newer way. The DMTF's Redfish specification defines a REST-based management interface, and many vendors offer it next to IPMI [4]. Our assessment: where your BMC supports Redfish, prefer it and switch IPMI-over-LAN off if you do not need it.
7. Your vendor's console. HPE documents the settings of its iLO in the iLO user guide [5]. Whether IPMI over LAN is switched on by default for your generation is unverified here, so read it in your own iLO.

A homelab example

The Bytearium homelab runs rack servers (HPE ProLiant DL360 Gen9 and DL380 Gen10) and a QNAP NAS, as of 14 to 18 Oct 2026. We have not recorded their iLO or IPMI settings, so we say nothing about them. A general walkthrough for your own server: put the management port into a separate network or VLAN, give it a reserved address, and check in the controller's access settings whether IPMI over LAN is on. If you use it, query it from a trusted machine with ipmitool -I lanplus -H <address> -U <user> -a chassis power status and enter the password at the prompt [2]. Avoid typing the password into the command line, where other users of the machine could see it (our assessment).

Checklist

• Find the management port of your server and connect it to a separate network.
• Check that the management address is not forwarded or reachable from the internet [1].
• Change default accounts and use a long, unique password.
• Check whether IPMI over LAN is enabled and switch it off if you do not need it [2][5].
• Use lanplus and an ipmitool version newer than 1.8.18 [2].
• Update the BMC firmware after reading the vendor's advisories.
• Test power status and the event log from a trusted machine.
• Prefer Redfish where your BMC offers it [4].