What is IPMI, and how is it used in homelabs?

• IPMI is the standard, around since 1998. Version 2.0 added encryption for using it over the network, which is what ipmitool -I lanplus speaks.
• The BMC is the chip that does the work: a tiny computer with its own network connection, its own firmware and its own users and passwords, separate from the server's operating system.
• The vendors' names: Dell calls its BMC iDRAC, HPE calls it iLO, and Supermicro boards just say IPMI or BMC. Each adds a web page and a remote console (virtual console, iKVM) on top of IPMI. There are walkthroughs for accessing Dell iDRAC and its virtual console, the HPE iLO remote console and Supermicro IPMI and the iKVM console.
• Redfish is the newer standard many BMCs also speak: an HTTPS API that is slowly taking over from IPMI for scripts and monitoring.

• Power: turn a server on, shut it down cleanly or reset it from your desk, so it can stay off when you don't need it.
• The screen from power-on: BIOS settings, the boot menu, or a kernel that won't boot, through the BMC's remote console.
• Installing an operating system without a USB stick: the console mounts an ISO file from your PC as a virtual drive.
• Health: temperatures, fan speeds, power supplies and the hardware event log, where memory and disk errors show up first.
• A text console over the network (serial over LAN) when there's no picture, or no operating system network at all.
• Scripts: power a backup server on at night, or check every server's sensors from one machine.

1. 1

   Step 1: Plug in the BMC's network port

   Most server boards have a separate port for the BMC, often above the USB ports or marked iDRAC, iLO or IPMI. Plug it into your management network if you have one, so the BMC stays apart from everything else. Some boards can share one of the server's own ports instead.

2. 2

   Step 2: Give it an address

   Set a fixed address (or DHCP with a reserved one) in the BIOS setup's IPMI, BMC, iDRAC or iLO section. From Linux on the server itself, ipmitool can read and set it. Channel 1 is the usual one, but some boards use another:

   sudo ipmitool lan print 1
   sudo ipmitool lan set 1 ipsrc static
   sudo ipmitool lan set 1 ipaddr 10.0.0.40
   sudo ipmitool lan set 1 netmask 255.255.255.0
   sudo ipmitool lan set 1 defgw ipaddr 10.0.0.1

3. 3

   Step 3: Sign in and change the password

   Open https:// and the BMC's address in a browser on the same network. The certificate is self-signed, so the browser warns you once. Default users vary by maker (ADMIN on Supermicro, root on Dell, Administrator on HPE), and recent hardware prints a unique password on a label. If yours still uses an old well-known default, change it first.

4. 4

   Step 4: Update the BMC firmware

   Get it from the server maker's support site. Newer firmware usually brings an HTML5 console that runs in the browser (older ones download a Java file instead) and fixes security holes.

5. 5

   Step 5: Install ipmitool on a machine next to it

   Any Linux box on the same network will do, even a Raspberry Pi: sudo apt install ipmitool on Debian, Ubuntu and Raspberry Pi OS, or sudo dnf install ipmitool on Fedora.

ipmitool talks to a BMC in two ways. On the server itself, as root, it uses the board's local interface, with no network and no password (if it can't find one, load the driver with sudo modprobe ipmi_devintf). From another machine, -I lanplus connects over the network to the BMC's address:

# On the server itself
sudo ipmitool mc info                # the BMC's firmware and IPMI version
sudo ipmitool sensor                 # every sensor with its reading and limits

# From another machine on the same network
ipmitool -I lanplus -H 10.0.0.40 -U admin -a chassis power status
ipmitool -I lanplus -H 10.0.0.40 -U admin -a chassis power on
ipmitool -I lanplus -H 10.0.0.40 -U admin -a chassis power soft     # ask the OS to shut down
ipmitool -I lanplus -H 10.0.0.40 -U admin -a chassis bootdev bios   # next boot goes to BIOS setup
ipmitool -I lanplus -H 10.0.0.40 -U admin -a sdr type Temperature
ipmitool -I lanplus -H 10.0.0.40 -U admin -a sel list               # the hardware event log
ipmitool -I lanplus -H 10.0.0.40 -U admin -a sol activate           # serial console, leave with ~.

-H is the BMC's address (not the server's own), -U the BMC user, and -a asks for the password instead of leaving it in your shell history. For scripts, -E reads it from the IPMI_PASSWORD variable. Serial over LAN only shows something when the server's BIOS and operating system send their console to the serial port.

On Dell and HPE servers, IPMI over the network is often switched off out of the box; turn it on in the iDRAC's or iLO's network settings if you want ipmitool to reach it. Makers also have their own tools on top, such as Dell's racadm and Supermicro's IPMIView desktop utility.

• Put BMCs on their own network or VLAN, not on the same network as guests or the internet.
• Use a long, unique password for every BMC user, and disable the users you don't need.
• If you only use the web page and console, turn IPMI over LAN off in the BMC's settings.
• Turn off the BMC services you don't use, and keep its firmware up to date.

The safe way in from outside is through something that's already on that network. With RemoteAccessApp, one of your own PCs there does the connecting, and everything travels through our relay. That PC only makes outgoing connections, so no port is opened on your router.

• The BMC's web page in a tab, through one of your PCs. In the RemoteAccessApp app for Windows, save the BMC as a web panel, then edit it and, under Advanced, Network, choose Through a PC and the PC on that network. If unattended access isn't on at that PC, someone there is asked to allow it. See connect through one of your PCs.
• A remote session with a PC on that network. Open it from the app or any browser and use the BMC in that PC's own browser. This also works when a remote console needs a port of its own that the web panel route doesn't carry.
• ipmitool from any browser. Save the Linux box with ipmitool as an SSH host, open it on the RemoteAccessApp website and choose Through my PC. Power and sensors from a phone, free.

In the RemoteAccessApp app for Linux, web panels open in your own browser, which can't go through a PC yet; SSH and remote sessions work the same. The same idea keeps other admin pages private too: see managing a pfSense or OPNsense firewall safely.

Ordinary desktop and laptop boards don't have a BMC, so there's no IPMI to turn on. Server boards and some workstation boards do; look for a separate network port and an IPMI or BMC section in the BIOS setup. A separate KVM-over-IP box can add a remote console to any PC, but it's one more device to keep updated and off the internet.

For a desktop, remote access software does most of the same jobs while Windows or Linux is running: see how to access your PC remotely for free. To turn it on from afar, wake a sleeping PC remotely with Wake-on-LAN. For a whole rack, see managing Proxmox, VMware and KVM hosts from one app.