Skip to main content
A BMC — IPMI, iDRAC, or iLO — is a separate controller inside the server providing power control, a virtual console, and virtual media. It controls the machine independently of the operating system, and requires the same configuration care as Ubuntu itself.

​
Change the credentials

Each vendor ships a documented default: Change it to a long, unique password per machine and store it with your other infrastructure credentials. Dell recommends a minimum of eight characters mixing cases, digits, and symbols. To list the accounts that exist and confirm the default is gone, run this on the host:
An account still named ADMIN or root is the one to change.
ipmitool reaches the BMC through a device node on the machine itself, so every ipmitool command on this page requires the machine to have a BMC. On a consumer or workstation board without one, ipmitool reports that it cannot open the device, and there is nothing on this page to configure.On a machine that does have a BMC, the same error means the IPMI kernel modules are not loaded. /dev/ipmi0 is created by ipmi_devintf.

​
Keep it off the public internet

Vendor guidance is consistent. Dell states the iDRAC “is not designed nor intended to be placed on, nor connected directly to the Internet.” Supermicro recommends a dedicated LAN interface so the BMC “is not exposed to the internet,” and recommends blocking UDP 623 on any network outside your control. To apply this:
  • Use the dedicated BMC NIC rather than the shared LOM port.
  • Do not forward any router port to the BMC.
  • Reach it over a VPN or from inside your management network.
  • Restrict it to known source addresses if the BMC supports it.
Check which interface it uses and what address it has:
Record that address. It is required for the next step.

​
Verify from outside, not from the machine

Checking from the machine does not test external reachability, because the machine is inside the network. Run this from your own computer, off that network, against the BMC’s address from the step above. If the BMC shares the host’s public address, scan that instead:
No reachable ports is the correct result. Then check IPMI itself, which is UDP:
open|filtered is the correct result. A UDP probe that receives no reply cannot be distinguished from one that was dropped, so nmap reports both the same way. A plain open means the BMC answered from outside the network, which requires action.

​
Keep the firmware current

BMC firmware does not update with the operating system. Check the running version against your vendor’s current release:
Apply BMC updates in the same maintenance window as a kernel upgrade, because some require a reboot.

​
Confirm you can still get in

Changing the credentials and moving the interface can both break your access. Before relying on the BMC as your fallback, log in to the console once over your management network and confirm it works.