IPMI / Out-of-Band Management: Remote Power, OS Install, and KVM

Use the OS-independent IPMI/BMC to power-cycle, inspect hardware, and reinstall from a virtual CD — all remotely.

If you run physical or dedicated servers, sooner or later you hit a situation where SSH simply won't connect: the OS is frozen, the kernel won't boot, or a firewall rule has locked you out. The thing that saves you in those moments is out-of-band management — commonly known as IPMI.

What Is IPMI / BMC?

IPMI (Intelligent Platform Management Interface) is a management interface built into the server's motherboard, implemented by a dedicated chip called the BMC (Baseboard Management Controller). Vendors ship it under their own brand names — iDRAC, iLO, a generic IPMI/BMC web console — but the underlying capabilities are broadly the same.

The key idea is this: the BMC is a tiny, self-contained computer of its own. As long as the server has power and a management network cable attached, the BMC is running — regardless of whether your operating system has booted. That is what "out-of-band" means: the management channel is kept separate from the production data channel.

Why "Independent of the OS" Matters

  • A kernel panic or blue screen takes down the main OS, but the BMC stays online and shows you the current screen.
  • No OS installed yet? The BMC still works, so you can install from bare metal.
  • If the network is misconfigured or the SSH port is firewalled off, the dedicated management port still lets you in.

In short, out-of-band management gives you a back door that never goes offline for operating the machine.

Common Capabilities

Remote Power and Reset

Power on, power off (graceful or hard cut), and reboot (including a cold reset) — exactly as if you were standing at the front panel pressing buttons.

Hardware Health Monitoring

Read sensor data — temperatures, fan speeds, voltages, PSU status — plus the SEL (System Event Log) of hardware events, which makes diagnosing failing components far easier.

Remote KVM Console

KVM over IP redirects the server's monitor, keyboard, and mouse to your browser over the network. You can watch BIOS/UEFI POST, the GRUB boot menu, and the login prompt — just as if you were sitting in front of the box.

Virtual Media for OS Installs

Using "Virtual Media," you mount a local .iso image as the server's virtual optical drive. Combined with the KVM console, this lets you reinstall the operating system entirely remotely — no one has to visit the data center to plug in a USB stick.

ipmitool Examples

ipmitool is the go-to command-line tool for driving IPMI from Linux:

# Check power status
ipmitool -I lanplus -H <BMC_IP> -U <user> -P <pass> power status

# Remote power on / off / cycle
ipmitool -I lanplus -H <BMC_IP> -U <user> -P <pass> power on
ipmitool -I lanplus -H <BMC_IP> -U <user> -P <pass> power off
ipmitool -I lanplus -H <BMC_IP> -U <user> -P <pass> power cycle

# Read sensors and the hardware event log
ipmitool -I lanplus -H <BMC_IP> -U <user> -P <pass> sensor
ipmitool -I lanplus -H <BMC_IP> -U <user> -P <pass> sel list

# Boot from the (virtual) CD next time — pairs with a mounted ISO
ipmitool -I lanplus -H <BMC_IP> -U <user> -P <pass> chassis bootdev cdrom

Here -I lanplus selects the encrypted IPMI 2.0 network channel — always prefer it over the cleartext lan interface.

Security Notes

The BMC is extremely privileged — it can cut power, watch the screen, and reinstall the OS — so a compromised BMC means the whole machine is owned. Lock it down:

  • Keep the management port on a private network / VPN. The IPMI port should never be exposed directly to the public internet; allow access only over an internal network or VPN, ideally on a dedicated management VLAN.
  • Change the default credentials. Factory defaults like admin/admin or ADMIN/ADMIN are the first thing scanners try — set a strong password the moment you take delivery.
  • Keep the BMC firmware updated. Older firmware carries known vulnerabilities.
  • Prefer the encrypted lanplus (IPMI 2.0) channel and disable any legacy protocols you don't need.

Summary

Out-of-band management (IPMI/BMC) is your server's independent lifeline: it runs on a dedicated chip, doesn't rely on the operating system, and lets you power the box up or down, read hardware health, watch the real screen over KVM, and even mount a virtual CD to install an OS from scratch. Master ipmitool and a great deal of "drive to the data center" work collapses into a single remote command. But because the BMC is so powerful, two security rules are non-negotiable: keep the IPMI port on a private network or VPN, and change the default password immediately.