IPMI, iDRAC and iLO: server remote management explained

IPMI, iDRAC and iLO are the tools admins use to control servers remotely: power on, look into the BIOS, install an OS, read out faults – without a trip to the data centre. Under the hood there is always a baseboard management controller (BMC). Below: how the vendors differ, which licences matter and how to secure access.

What is a BMC, and what is IPMI?

The BMC is a separate microcontroller on the motherboard with its own firmware, memory and usually its own network port. Powered from the standby rail, it runs as soon as the cord is plugged in – even with the server off or the OS hung. It reads temperature, fan and voltage sensors, controls the fans, logs hardware events and powers the server on and off. Practically every rack server from Dell, HPE, Lenovo or Supermicro has one.

IPMI (Intelligent Platform Management Interface) is the older industry standard that tools such as ipmitool use to talk to the BMC – locally or over the network on UDP port 623. Version 2.0 dates back in its essentials to 2004 and has known weaknesses in authentication. Vendors build their own interfaces on top – iDRAC, iLO, XClarity Controller – while Supermicro simply calls its implementation IPMI.

What a BMC can do

• Virtual console: the server’s screen, keyboard and mouse in your browser, from power-on to the running system. Current BMCs use HTML5, older ones Java.
• Virtual media: mount an ISO image from your PC or a network share, for example to install Proxmox instead of VMware.
• Power control: power on, graceful shutdown, hard power-off, reset.
• Sensors: temperatures, fan speeds, voltages and power draw in watts.
• Logs: the system event log (SEL), plus the Lifecycle Log on Dell and the Integrated Management Log on HPE.
• Firmware updates: update BIOS, controllers, network cards and the BMC itself without booting an OS.
• Alerts: email, SNMP trap or syslog when a fan, memory module or power supply fails.

iDRAC, iLO, XCC and IPMI compared

Dell iDRAC: generations and licences

The Integrated Dell Remote Access Controller is built into every PowerEdge server. For used machines the relevant versions are iDRAC 7 (12G, e.g. R620 and R720), iDRAC 8 (13G, e.g. R630 and R730) and iDRAC 9 (14G onwards, e.g. the Dell PowerEdge R640, R740 and R750). iDRAC 9 adds an HTML5 interface and full Redfish support.

Dell unlocks features through licence tiers: Basic on smaller models, Express, Enterprise and, on iDRAC 9, Datacenter. Roughly, Express covers monitoring, logs and power control; iDRAC Enterprise adds the virtual console and virtual media on most rack servers; Datacenter targets large estates with features such as telemetry streaming. The exact split depends on generation, model line and firmware – if in doubt, check Dell’s current overview. The licence is tied to the server’s service tag.

HPE iLO: Standard or Advanced

HPE ProLiant servers use Integrated Lights-Out, or iLO: iLO 4 in Gen8 and Gen9, iLO 5 in Gen10 and Gen10 Plus, iLO 6 in Gen11. iLO 5 added an HTML5 interface, a firmware repository and a hardware-anchored firmware check at boot. A typical example is the HPE ProLiant DL360 Gen10.

iLO Standard is included from the factory: sensors, logs, power control and the console during boot and BIOS setup. For the console once the operating system is running and – depending on generation – further features such as extended virtual media or directory integration, you need iLO Advanced. The licence is entered into iLO as a key; transfer and reinstallation are governed by HPE’s terms.

Lenovo XClarity Controller and Supermicro IPMI

Lenovo ThinkSystem servers such as the SR630 and SR650 use the XClarity Controller (XCC), successor to the IMM2 of the System x range; the V3 models come with XCC2. Here too there are tiers – Standard, Advanced and Enterprise – unlocked with Features on Demand keys. The factory tier depends on model and original order.

Supermicro simply calls its BMC IPMI. The graphical console and virtual media are usually available without an extra licence; individual features such as BIOS updates through the web interface need a key depending on board generation. That makes Supermicro attractive for a homelab.

Redfish: one REST API for all vendors

Because IPMI hits its limits on security and features, the industry body DMTF published Redfish in 2015: a REST interface over HTTPS with JSON data and a common schema. The path /redfish/v1/Systems returns the same basic structure on Dell, HPE, Lenovo and Supermicro – model, serial number, power state, CPUs and memory.

That lets you inventory, switch, update and configure servers from different vendors with scripts or Ansible. iDRAC 9, iLO 5 and 6 and XCC support Redfish comprehensively; older controllers such as iDRAC 8 and iLO 4 support a smaller subset from certain firmware versions. Some features stay tied to the licence tier even over Redfish.

Security: how to protect the BMC

A BMC has full control of the server: it can power it off, boot it from a foreign ISO or flash firmware. It also runs its own operating system, often patched less frequently than the rest. All major vendors have had serious vulnerabilities in BMC firmware in the past.

• Separate management network: put the dedicated BMC port in its own VLAN or physical network. Use shared LOM, where the BMC borrows a regular port, only deliberately.
• Change default credentials: older machines shipped with well-known logins such as root/calvin on Dell or ADMIN/ADMIN on Supermicro, newer ones with a unique password on a label.
• Keep firmware current: BMC updates regularly close holes; schedule them like OS updates.
• Disable what you do not need: IPMI over LAN, old SNMP versions and unencrypted protocols.

Buying a used server: check the remote management

On a used server, the remote management licence is part of its value. Clarify three points before you buy; general buying criteria are in the guide Buying used servers.

• Licence included? Which tier is installed, such as iDRAC Enterprise or iLO Advanced? A screenshot of the licence page settles it.
• Licence transferable? Dell licences are tied to the service tag and stay with the server. HPE and Lenovo keys are subject to the vendor’s terms. Upgrades can often be added later.
• BMC reset? A properly refurbished server arrives without the previous owner’s accounts, network settings and certificates – see Refurbished: meaning and process.

Once it arrives, set up access like this: