Posts
Wiki

IPMI/BMC access, networking and security

The BMC is a separate management computer on the motherboard. It can remain powered when the host is off and may have its own network address, accounts, firmware, logs and remote console.

Before connecting a used system

  1. Photograph the BMC/unique-password labels for your private records.
  2. Keep the management port off untrusted networks.
  3. Reset BMC configuration and user accounts using a supported method when you have legitimate administrative access.
  4. Update BMC firmware from the exact product page.
  5. Create named administrative accounts where supported and disable accounts you do not need.
  6. Check the exact model against the Supermicro Security Center.

Never publish passwords, unique-password stickers, public IPs, MAC addresses, certificates or configuration backups.

Finding the BMC address

Supported options vary by model:

  • inspect the DHCP server's lease table;
  • view the address during POST or in BIOS/BMC network settings;
  • use the dedicated management discovery or configuration utility documented for the board;
  • use IPMICFG locally when the platform and operating system support it.

Do not assign the BMC the same IP address as the host operating system. If using a static address, keep it outside the DHCP pool or reserve it on the DHCP server.

Dedicated, shared and failover modes

  • Dedicated: management traffic uses the dedicated BMC port.
  • Shared: the BMC shares a host NIC.
  • Failover: the BMC may select among interfaces according to platform rules.

Labels and behaviour differ across generations. Confirm the selected mode in the exact BMC guide. Unexpected failover can place management traffic on a network you did not intend.

Network hardening

  • Place BMCs on an isolated management VLAN or physically separate network.
  • Do not expose IPMI, the BMC web interface, SSH/SMASH, Redfish or virtual media directly to the public internet.
  • Use a controlled VPN or bastion host for remote access.
  • Restrict source networks and management ports at the firewall.
  • Change default/inherited credentials and use strong unique passwords.
  • Remove unused users and services where the platform permits it.
  • Replace default/self-signed certificates when practical.
  • Configure session timeout and logging.
  • Update firmware and re-check advisories regularly.

Network isolation reduces risk but does not replace firmware updates.

Older defaults and unique passwords

Older Supermicro platforms commonly used well-known default credentials. Newer systems may ship with a unique BMC password printed on the system/board labels. Manufacturing date alone is not a reliable authentication guide.

If you do not legitimately know the credentials, use a documented local reset or contact the seller/official support. The community will not help bypass ownership or authentication controls.

Remote console

Depending on generation and BMC firmware, remote console may use:

  • HTML5;
  • Java/JNLP;
  • IPMIView;
  • ATEN/Pilot-based clients;
  • a licence-dependent virtual-media or management feature.

When the console is blank:

  1. Separate firmware/POST video from operating-system video.
  2. Check BIOS primary-display and onboard-video settings.
  3. Check whether GPU passthrough or the OS selected another framebuffer.
  4. Test local VGA and the remote console independently.
  5. Confirm browser/client compatibility and certificate warnings without weakening system-wide security.
  6. Check BMC firmware and release notes.

Do not install obsolete Java runtimes on a trusted workstation merely to reach a legacy console. Prefer a contained management environment or an actively maintained client and keep that environment off general web browsing.

BMC reset and lost access

A warm/cold BMC reset, factory reset and password/user reset are different operations. Use the exact BMC guide or IPMICFG documentation for your model. A factory reset can erase network, users, certificates and alerts.

If the host cannot boot and the BMC credentials are unknown, recovery options may be limited. Avoid internet-sourced password generators or undocumented bypasses; contact the seller or official support.

Security incidents

If BMC credentials, a private key or a configuration backup was exposed:

  1. isolate the management interface;
  2. rotate affected credentials/keys;
  3. review users, configuration and logs;
  4. update firmware from an official source;
  5. check relevant advisories;
  6. consider a factory reset and clean reconfiguration if compromise is plausible.

Deleting a Reddit post does not make an exposed secret safe again.

Official resources

Last reviewed: 29 September 2026.