What Is IPMI?

IPMI, the Intelligent Platform Management Interface, is a set of specifications that defines how management software talks to a computer’s hardware without going through its main processor or operating system. Intel, Hewlett-Packard, NEC and Dell published the first version in 1998, and it became the common language of server management, adopted by a long list of server and motherboard makers.

IPMI is the interface, not the hardware. The work is done by a baseboard management controller, a small processor on the motherboard with its own firmware and power from the standby rail. The BMC reads temperature, voltage and fan sensors, keeps a log of hardware events, and controls power and reset. IPMI defines the commands it accepts and the ways in which they can reach it:

In-band, from the host operating system, through a system interface such as KCS (keyboard controller style) or SSIF over SMBus. Tools running on the server use this path to read sensors or configure the BMC.

Out-of-band, over the network or a serial port, using the RMCP and RMCP+ protocols on UDP port 623. This is the path administrators use when the operating system is down or the server is switched off.

Inside the chassis, the BMC can also reach other management controllers, such as those on power supplies or add-in boards, over the Intelligent Platform Management Bus (IPMB), which is based on I²C.

The IPMI specification covers a defined set of functions. Most server management tasks build on these:

IPMI has changed little since 2.0. The main releases are below, with Redfish, the DMTF standard that is replacing it, for comparison.

Most current BMCs support both IPMI and Redfish, so existing IPMI scripts keep working while new tools move to Redfish. Features such as a graphical remote console (KVM over IP) and virtual media are not part of the IPMI specification; they are added by each BMC’s own firmware and web interface.

A server’s BMC reaches the network in one of two ways. A dedicated management port is a separate Ethernet socket used only by the BMC, which makes it easy to put management on its own network. A shared port lets the BMC use one of the server’s normal network interfaces through a sideband connection, saving a cable but mixing management and data traffic on one link. Many boards let you choose either in the BIOS or BMC settings.

IPMI over LAN uses UDP port 623. The open-source ipmitool utility is the usual command-line client on Linux and Windows: a command such as ipmitool -I lanplus -H <BMC address> -U <user> chassis power status checks the power state, while sdr list, sel list and sol activate read the sensors, read the event log and open the serial console. The same tool talks to the local BMC in band when it runs on the server itself. Most BMCs also serve a web interface over HTTPS for day-to-day use.

The BMC has full control of the server, so anyone who reaches its IPMI interface can power it off, change firmware settings or watch the console. IPMI 2.0 also has known weaknesses. The RAKP key exchange in RMCP+ lets a remote attacker obtain a salted hash of a user’s password and try to crack it offline, a flaw in the specification itself rather than in one product. Some implementations have accepted cipher suite 0, which skips authentication, and older BMCs often shipped with well-known default passwords.

The usual advice is to keep IPMI off any network that untrusted users can reach: put BMC ports on an isolated management VLAN, disable cipher suite 0 and anonymous users, set long unique passwords, turn off IPMI over LAN if it is not used, keep BMC firmware up to date, and use Redfish over HTTPS where the BMC supports it.

IPMI is found wherever a server-class board has a BMC. Several of our rack mount servers carry an ASPEED AST2600 BMC with IPMI management over a dedicated LAN port, and one dual AMD EPYC GPU server adds Redfish and iKVM on a shared or dedicated port. Our server motherboards include Intel Xeon Scalable boards offered in IPMI builds, with a BMC module and a dedicated management LAN port, and among our edge AI servers a rugged AMD EPYC system uses an ASPEED AST2500 BMC for management.

Compact fanless and box PCs built on Intel Core processors rarely have a BMC. Where they need remote recovery, it usually comes from Intel vPro with Active Management Technology or from an add-on management module, as our white paper on Intel AMT and out-of-band management for industrial PCs explains.

We set up the BMC and remote management on the servers we supply as part of the standard build, including the management network settings and user accounts your site needs.