The Intelligent Platform Management Interface is a set of computer interface specifications
for an autonomous computer subsystem that provides management and monitoring capabilities
independently of the host system's CPU, firmware and operating system. IPMI defines a set of
interfaces used by system administrators for out-of-band management of computer systems
and monitoring of their operation. For example, IPMI provides a way to manage a computer that
may be powered off or otherwise unresponsive by using a network connection to the hardware
rather than to an operating system or login shell.
The development of this interface specification was led by Intel Corporation and is supported
by more than 200 computer systems vendors, such as Cisco, Dell, Hewlett-Packard, Intel,
NEC Corporation, SuperMicro and Tyan.
Functionality Using a standardized interface and protocol
allows systems-management software based on IPMI to manage multiple disparate servers.
As a message-based, hardware-level interface specification, IPMI operates independently
of the operating system to allow administrators to manage a system remotely in the absence
of an operating system or of the system management software. Thus IPMI functions can work in
any of three scenarios: before an OS has booted
when the system is powered down after OS or system failure – the key characteristic
of IPMI compared with in-band system management such as by remote login to the operating system
using SSH System administrators can use IPMI messaging
to monitor platform status; to query inventory information; to review hardware logs of out-of-range
conditions; or to perform recovery procedures such as issuing requests from a remote console
through the same connections e.g. system power-down and rebooting, or configuring watchdog timers.
The standard also defines an alerting mechanism for the system to send a simple network management
protocol platform event trap. The monitored system may be powered off, but
must be connected to a power source and to the monitoring medium, typically a local area
network connection. IPMI can also function after the operating system has started, and
exposes management data and structures to the system management software. IPMI prescribes
only the structure and format of the interfaces as a standard, while detailed implementations
may vary. An implementation of IPMI version 1.5 can communicate via a direct out-of-band
local area network or serial connection or via a side-band local area network connection
to a remote client. The side-band LAN connection utilizes the board network interface controller.
This solution is less expensive than a dedicated LAN connection but also has limited bandwidth.
Systems compliant with IPMI version 2.0 can also communicate via serial over LAN, whereby
serial console output can be remotely viewed over the LAN. Systems implementing IPMI 2.0
typically also include KVM over IP, remote virtual media and out-of-band embedded web-server
interface functionality, although strictly speaking, these lie outside of the scope of
the IPMI interface standard. DCMI is a similar standard based on IPMI but
designed to be more suitable for Data Center management: it uses the interfaces defined
in IPMI, but minimizes the number of optional interfaces and includes power capping control,
among other differences. Side-band and out-of-band
As well as using a separate dedicated management LAN connection, IPMI also allows implementation
of a so-called "side-band" management LAN connection. This connection utilizes a System
Management Bus interface between the BMC and the board Network Interface Controller. This
solution has the advantage of reduced costs but also provides limited bandwidth – sufficient
for text console redirection but not for video redirection. For example, when a remote computer
is down the system administrator can access it through IPMI and utilize a text console.
This suffices for a few vital functions, such as checking the event log, accessing the BIOS
setup and performing power on, power off or power cycle. However, more advanced functions,
such as remote re-installation of an operating system, may require a full out-of-band management
approach utilizing a dedicated LAN connection. IPMI components
An IPMI sub-system consists of a main controller, called the baseboard management controller
and other management controllers distributed among different system modules that are referred
to as satellite controllers. The satellite controllers within the same chassis connect
to the BMC via the system interface called Intelligent Platform Management Bus/Bridge –
an enhanced implementation of I²C. The BMC connects to satellite controllers or another
BMC in another chassis via the Intelligent Platform Management Controller bus or bridge.
It may be managed with the Remote Management Control Protocol, a specialized wire protocol
defined by this specification. RMCP+ is used for IPMI over LAN.
Several vendors develop and market BMC chips. A BMC utilized for embedded applications may
have limited memory and require optimized firmware code for implementation of the full
IPMI functionality. Highly integrated BMCs can provide complex instructions and provide
the complete out-of-band functionality of a service processor. The firmware implementing
the IPMI interfaces is provided by various vendors. A field replaceable unit holds the
inventory, such as vendor ID and manufacturer, of potentially replaceable devices. A sensor
data record repository provides the properties of the individual sensors present on the board.
For example, the board may contain sensors for temperature, fan speed, and voltage.
Baseboard management controller
The baseboard management controller is the intelligence in the IPMI architecture. It
is a specialized microcontroller embedded on the motherboard of a computer, generally
a server. The BMC manages the interface between system management software and platform hardware.
Different types of sensors built into the computer system report to the BMC on parameters
such as temperature, cooling fan speeds, power status, operating system status, etc. The
BMC monitors the sensors and can send alerts to a system administrator via the network
if any of the parameters do not stay within preset limits, indicating a potential failure
of the system. The administrator can also remotely communicate with the BMC to take
some corrective action such as resetting or power cycling the system to get a hung OS
running again. These abilities save on the total cost of ownership of a system.
Physical interfaces to the BMC include SMBus buses, an RS-232 serial console, address and
data lines and an Intelligent Platform Management Bus, that enables the BMC to accept IPMI request
messages from other management controllers in the system.
A direct serial connection to the BMC is not encrypted as the connection itself is secure.
Connection to the BMC over LAN may or may not use encryption depending on the security
concerns of the user. There are rising concerns about the general
security regarding BMCs as a closed infrastructure. Security
On 2 July 2013, Rapid 7 published a guide to security penetration testing of the latest
IPMI 2.0 protocol and implementations by various vendors.
Vendors have provided patches that remediate most of the vulnerabilities, but the "IPMI
2.0 RAKP Authentication Remote Password Hash Retrieval" vulnerability has not yet been
addressed. This arises from the difficulty that the IPMI 2.0 specification is flawed
in that it reveals the password hash and salt to anonymous remote clients. This allows for
offline brute force attacks. Complete remediation will require a change to the IPMI specification.
Some sources are even advising against using IPMI at all, due to security concerns related
to the design and vulnerabilities of actual Baseboard Management Controllers.
Version history The IPMI standard specification has evolved
through a number of iterations: v1.0 was announced on September 16, 1998:
base specification v1.5, published on March 1, 2001: added features
including IPMI over LAN, IPMI over Serial/Modem, and LAN Alerting
v2.0, published on February 14, 2004: added features including Serial over LAN, Group
Managed Systems, Enhanced Authentication, Firmware Firewall, and VLAN Support
v2.0 revision 1.1, published on February 11, 2014: amended for errata, clarifications,
and addenda, plus addition of support for IPv6 Addressing
See also Out-of-band management)
Management Component Transport Protocol HP Integrated Lights-Out
Dell DRAC IBM Remote Supervisor Adapter
MegaRAC Avocent MergePoint Embedded Management Software
Intel Active Management Technology DMTF Alert Standard Format
DMTF Desktop and mobile Architecture for System Hardware
System Service Processor on some SPARC machines Wired for Management
References
External links