ipmi-config.conf(5)
π NAME π
ipmi-config β IPMI configuration file details
(also hiii, you're reading ipmi-config.conf(5) out of the System Commands manual, section 5, bestie π
)
πΈ DESCRIPTION πΈ
okay so, real talk: before you can use a whole bunch of IPMI tools over a network, the Baseboard Management Controller (BMC) on that machine has to be configured first. Like, non-negotiable. And the config situation can be genuinely so daunting if you don't already know a ton about IPMI ππ
This manpage exists to fix that β the whole point is to give you enough info on BMC configuration that you can actually go configure the BMC for your own system, and when it makes sense, it'll suggest typical BMC configurations for you to copy. π«Ά
So, here's the vibe: what follows is an example configuration file that was partially generated by running the --checkout option with the ipmi-config(8) command β¨ This particular config comes from the core category of configuration values (that's the default, iykyk). This example config should be enough for most users β you just have to plug in the appropriate local IP and MAC addresses and you're basically good to go π
After this example, the manpage breaks things down section by section (separate sections of this manpage, that is) and goes deeper into each part of the configuration file, explaining how the BMC can be configured for all the different environments out there π
β οΈ heads up bestie: a LOT of these options may or may not actually be available on your particular machine. Case in point β Serial-Over-Lan (SOL) only exists on IPMI 2.0 machines. So if you're trying to configure an IPMI 1.5 machine, a whole bunch of the SOL / IPMI 2.0 related options just won't be available to you π The number of configurable users can also vary depending on your particular machine.
Also, the configuration file below (and most of this manpage, fr) assumes you're interested in configuring a BMC for use with IPMI over LAN. Various configuration options from ipmi-config(8) have been left out or skipped because it's considered unnecessary. Future versions of this manpage will try to include more information π
Section User1
## Give username
## Username NULL
## Give password or leave it blank to clear password
Password mypassword
## Possible values: Yes/No or blank to not set
Enable_User Yes
## Possible values: Yes/No
Lan_Enable_Ipmi_Msgs Yes
## Possible values: Callback/User/Operator/Administrator/OEM_Proprietary/No_Access
Lan_Privilege_Limit Administrator
## Possible values: 0-17, 0 is unlimited; May be reset to 0 if not specified
## Lan_Session_Limit
## Possible values: Yes/No
SOL_Payload_Access Yes
EndSection
Section User2
## Give username
Username user2
## Give password or leave it blank to clear password
Password userpass
## Possible values: Yes/No or blank to not set
Enable_User No
## Possible values: Yes/No
Lan_Enable_Ipmi_Msgs No
## Possible values: Callback/User/Operator/Administrator/OEM_Proprietary/No_Access
Lan_Privilege_Limit No_Access
## Possible values: 0-17, 0 is unlimited; May be reset to 0 if not specified
## Lan_Session_Limit
## Possible values: Yes/No
SOL_Payload_Access No
EndSection
Section Lan_Channel
## Possible values: Disabled/Pre_Boot_Only/Always_Available/Shared
Volatile_Access_Mode Always_Available
## Possible values: Yes/No
Volatile_Enable_User_Level_Auth Yes
## Possible values: Yes/No
Volatile_Enable_Per_Message_Auth Yes
## Possible values: Yes/No
Volatile_Enable_Pef_Alerting No
## Possible values: Callback/User/Operator/Administrator/OEM_Proprietary/No_Access
Volatile_Channel_Privilege_Limit Administrator
## Possible values: Disabled/Pre_Boot_Only/Always_Available/Shared
Non_Volatile_Access_Mode Always_Available
## Possible values: Yes/No
Non_Volatile_Enable_User_Level_Auth Yes
## Possible values: Yes/No
Non_Volatile_Enable_Per_Message_Auth Yes
## Possible values: Yes/No
Non_Volatile_Enable_Pef_Alerting No
## Possible values: Callback/User/Operator/Administrator/OEM_Proprietary/No_Access
Non_Volatile_Channel_Privilege_Limit Administrator
EndSection
Section Lan_Conf
## Possible values: Unspecified/Static/Use_DHCP/Use_BIOS/Use_Others
Ip_Address_Source Static
## Give valid IP Address
Ip_Address 192.168.1.100
## Give valid MAC Address
Mac_Address 00:0E:0E:FF:AA:12
## Give valid Subnet mask
Subnet_Mask 255.255.255.0
## Give valid IP Address
Default_Gateway_Ip_Address 192.168.1.1
## Give valid MAC Address
Default_Gateway_Mac_Address 00:0E:0E:FF:AA:18
## Give valid IP Address
Backup_Gateway_Ip_Address 192.168.1.2
## Give valid MAC Address
Backup_Gateway_Mac_Address 00:0E:0E:FF:AA:15
EndSection
Section Lan_Conf_Auth
## Possible values: Yes/No
Callback_Enable_Auth_Type_None No
## Possible values: Yes/No
Callback_Enable_Auth_Type_Md2 No
## Possible values: Yes/No
Callback_Enable_Auth_Type_Md5 No
## Possible values: Yes/No
Callback_Enable_Auth_Type_Straight_Password No
## Possible values: Yes/No
Callback_Enable_Auth_Type_Oem_Proprietary No
## Possible values: Yes/No
User_Enable_Auth_Type_None No
## Possible values: Yes/No
User_Enable_Auth_Type_Md2 Yes
## Possible values: Yes/No
User_Enable_Auth_Type_Md5 Yes
## Possible values: Yes/No
User_Enable_Auth_Type_Straight_Password No
## Possible values: Yes/No
User_Enable_Auth_Type_Oem_Proprietary No
## Possible values: Yes/No
Operator_Enable_Auth_Type_None No
## Possible values: Yes/No
Operator_Enable_Auth_Type_Md2 Yes
## Possible values: Yes/No
Operator_Enable_Auth_Type_Md5 Yes
## Possible values: Yes/No
Operator_Enable_Auth_Type_Straight_Password No
## Possible values: Yes/No
Operator_Enable_Auth_Type_Oem_Proprietary No
## Possible values: Yes/No
Admin_Enable_Auth_Type_None No
## Possible values: Yes/No
Admin_Enable_Auth_Type_Md2 Yes
## Possible values: Yes/No
Admin_Enable_Auth_Type_Md5 Yes
## Possible values: Yes/No
Admin_Enable_Auth_Type_Straight_Password No
## Possible values: Yes/No
Admin_Enable_Auth_Type_Oem_Proprietary No
## Possible values: Yes/No
Oem_Enable_Auth_Type_None No
## Possible values: Yes/No
Oem_Enable_Auth_Type_Md2 No
## Possible values: Yes/No
Oem_Enable_Auth_Type_Md5 No
## Possible values: Yes/No
Oem_Enable_Auth_Type_Straight_Password No
## Possible values: Yes/No
Oem_Enable_Auth_Type_Oem_Proprietary No
EndSection
Section Lan_Conf_Security_Keys
## Give string or blank to clear. Max 20 chars
K_G
EndSection
Section Lan_Conf_Misc
## Possible values: Yes/No
Enable_Gratuitous_Arps Yes
## Possible values: Yes/No
Enable_Arp_Response No
## Give valid number. Intervals are 500 ms.
Gratuitous_Arp_Interval 4
EndSection
Section Rmcpplus_Conf_Privilege
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_0 Unused
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_1 Unused
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_2 Unused
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_3 Administrator
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_4 Administrator
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_5 Administrator
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_6 Unused
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_7 Unused
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_8 Administrator
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_9 Administrator
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_10 Administrator
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_11 Unused
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_12 Administrator
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_13 Administrator
## Possible values: Unused/User/Operator/Administrator/OEM_Proprietary
Maximum_Privilege_Cipher_Suite_Id_14 Administrator
EndSection
Section SOL_Conf
## Possible values: Yes/No
Enable_SOL Yes
## Possible values: Callback/User/Operator/Administrator/OEM_Proprietary
SOL_Privilege_Level Administrator
## Possible values: Yes/No
Force_SOL_Payload_Authentication Yes
## Possible values: Yes/No
Force_SOL_Payload_Encryption Yes
## Give a valid integer. Each unit is 5ms
Character_Accumulate_Interval 50
## Give a valid number
Character_Send_Threshold 100
## Give a valid integer
SOL_Retry_Count 5
## Give a valid integer. Interval unit is 10ms
SOL_Retry_Interval 50
## Possible values: Serial/9600/19200/38400/57600/115200
Non_Volatile_Bit_Rate 115200
## Possible values: Serial/9600/19200/38400/57600/115200
Volatile_Bit_Rate 115200
EndSection
okay and that's the appetizer bb π β the next parts of this page go into each one of those sections in detail, so stick with me, there's more coming π
πΈ Section User1, User2, ... πΈ
Okay bestie, so the User sections of the BMC configuration file are all about username config for IPMI over LAN communication. The number of users your system can actually configure will vary by manufacturer β annoying but true. With the exception of the Username for User1, all sections are identical.
The usernames you want to set up on the BMC are defined with Username. The first username under Section User1 is typically the NULL username and cannot be modified β literally untouchable, no cap. The password for the username can be specified with Password. It can be left empty to define a NULL password. Each user you wish to enable must be enabled through the Enable_User configuration option. It is recommended that all usernames have non-NULL passwords or be disabled for security reasons β please donβt leave the door wide open, bestie π
Usernameβ the username you want to configure for that BMC user. First one underUser1is typically theNULLusername and cannot be modified.Passwordβ the password for that username. Leave it empty to define aNULLpassword.Enable_Userβ each user you want enabled has to be turned on through this. No sneaky auto-enables.Lan_Enable_Ipmi_Msgsβ enables or disables IPMI over LAN access for the user. Set it toYesif you want IPMI over LAN tools to actually work.Lan_Privilege_Limitβ the maximum privilege level limit the user is allowed. Different IPMI commands have different privilege restrictions, which is giving β¨rulesβ¨. For example, determining the power status of a machine only requires theUserprivilege level. However, power cycling requires theOperatorprivilege. Typically, youβll want to assign at least one user with a privilege limit ofAdministratorso that all system functions are available to at least one user via IPMI over LAN.Lan_Session_Limitβ the number of simultaneous IPMI sessions allowed for the user. Most users will wish to set this to0to allow unlimited simultaneous IPMI sessions. This field is considered optional by IPMI standards, and may result in errors when attempting to configure it to a non-zero value. If errors do occur, setting the value back to0should resolve problems.SOL_Payload_Accessβ specifies if a particular user is allowed to connect with Serial-Over-LAN (SOL). Set it toYesto allow this username to useSOL.
The example configuration above disables User2 but enables the default NULL (i.e. anonymous) user. Many IPMI tools β both open-source and vendor β do not allow the user to input a username and assume the NULL username by default. If the tools youβre interested in using allow usernames to be input, then it is recommended that one of the non-NULL usernames be enabled and the NULL username disabled for security reasons. It is recommended that you disable the NULL username in section User1, so that users are required to specify a username for IPMI over LAN communication. Security girl summer π
Some motherboards may require a Username to be configured prior to other fields being read/written. If this is the case, those fields will be set to <username-not-set-yet>. Not a vibe, but good to know.
π Section Lan_Channel π
The Lan_Channel section configures a whole variety of IPMI over LAN configuration parameters. Both Volatile and Non_Volatile configurations can be set. Volatile configurations are immediately configured onto the BMC and will have immediate effect on the system. Non_Volatile configurations are only available after the next system reset. Generally, both the Volatile and Non_Volatile should be configured identically β twins, basically.
Access_Modeβ configures the availability of IPMI over LAN on the system. Typically this should be set toAlways_Availableto enable IPMI over LAN.Privilege_Limitβ sets the maximum privilege any user of the system can have when performing IPMI over LAN. This should be set to the maximum privilege level configured to a username. Typically, this should be set toAdministrator.User_Level_Authβ typically should be set toYesfor additional security. DisablingUser_Level_AuthallowsUserprivileged IPMI commands to be executed without authentication. That isβ¦ a choice πPer_Message_Authβ typically should be set toYesfor additional security. DisablingPer_Message_Authallows fewer individual IPMI messages to require authentication.
π¦ Section Lan_Conf π¦
Those familiar with setting up networks should find most of the fields in this section self explanatory. The example BMC configuration above illustrates the setup of a static IP address. The field IP_Address_Source is configured with Static. The IP address, subnet mask, and gateway IP addresses of the machine are respectively configured with the IP_Address, Subnet_Mask, Default_Gateway_Ip_Address, and Backup_Gateway_Ip_Address fields. The respective MAC addresses for the IP addresses are configured under Mac_Address, Default_Gateway_Mac_Address, and Backup_Gateway_Mac_Address. Itβs giving network spreadsheet, but make it IPMI β¨
It is not required to setup the BMC IP_Address to be the same P_Address used by your operating system for that network interface. Yes, the manpage says P_Address β we are simply reporting the iconique typo, no editing. However, if you choose to use a different address, an alternate ARP configuration may need to be setup.
To instead setup your BMC network information via DHCP, the field IP_Address_Source should be configured with Use_DHCP.
It is recommended that static IP addresses be configured for address resolution reasons. See Lan_Conf_Misc below for a more detailed explanation. Static IPs stay booked and busy.
π Section Lan_Conf_Auth π
This section determines what types of password authentication mechanisms are allowed for users at different privilege levels under the IPMI 1.5 protocol. The currently supported authentication methods for IPMI 1.5 are:
Noneβ no username/password required.Straight_Passwordβ passwords are sent in the clear. Bestie, no.MD2β passwords are MD2 hashed.MD5β passwords are MD5 hashed.
Different usernames at different privilege levels may be allowed to authenticate differently through this configuration. For example, a username with User privileges may be allowed to authenticate with a straight password, but a username with Administrator privileges may be allowed only to authenticate with MD5. Pick your fighters wisely.
The above example configuration supports MD2 and MD5 authentication for all users at the User, Operator, and Administrator privilege levels. All authentication mechanisms have been disabled for the Callback privilege level.
Generally speaking, you do not want to allow any user to authenticate with None or Straight_Password for security reasons. MD2 and MD5 are digital signature algorithms that can minimally encrypt passwords. If you have chosen to support the NULL username (enabled User1) and NULL passwords (NULL password for User1), you will have to enable the None authentication fields above to allow users to connect via None. Chaotic, but thatβs the rule.
π Section Lan_Conf_Security_Keys π
This section supports configuration of the IPMI 2.0 (including Serial-over-LAN) K_g key. If your machine does not support IPMI 2.0, this field will not be configurable. Sorry, icon.
The key is used for two-key authentication in IPMI 2.0. In most tools, when doing IPMI 2.0, the K_g can be optionally specified. It is not required for IPMI 2.0 operation.
In the above example, we have elected to leave this field blank so the K_g key is not used. Blank and unbothered.
π§ Section Lan_Conf_Misc π§
This section lists miscellaneous IPMI over LAN configuration options. These are optional IPMI configuration options that are not implemented on all BMCs β so if your board doesnβt have them, itβs not a personal attack, itβs just hardware π
Normally, a client cannot resolve the ethernet MAC address without the remote operating system running. However, IPMI over LAN would not work when a machine is powered off or if the IP address used by the operating system for that network interface differs from the BMC IP_Address. One way to work around this is through gratuitous ARPs. Gratuitous ARPs are ARP packets generated by the BMC and sent out to advertise the BMCβs IP and MAC address. Other machines on the network can store this information in their local ARP cache for later IP/hostname resolution. This would allow IPMI over LAN to work when the remote machine is powered off. The Enable_Gratuitous_Arps option allows you to enable or disable this feature. The Gratuitous_Arp_Interval option allows you to configure the frequency at which gratuitous ARPs are sent onto the network.
Instead of gratuitous ARPs, some BMCs are able to respond to ARP requests, even when powered off. If offered, this feature can be enabled through the Enable_Arp_Response option.
Generally speaking, turning on gratuitous ARPs is acceptable. However, it will increase traffic on your network. If you are using IPMI on a large cluster, the gratuitous ARPs may easily flood your network β not the cute kind of flood. They should be tuned to occur less frequently or disabled. If disabled, the remote machineβs MAC address should be permanently stored in the local ARP cache through arp(8).
See bmc-watchdog(8) for a method which allows gratuitous ARPs to be disabled when the operating system is running, but enabled when the system is down. Iconic behavior, honestly.
π Section Rmcpplus_Conf_Privilege π
Okay bestie, this section handles the IPMI 2.0 cipher suite IDs β and yes, that includes the Serial-over-LAN ones too. Quick heads up though: if your machine doesn't do IPMI 2.0, these fields literally won't be configurable. Vibe check failed, nothing you can do π
So each cipher suite ID is basically a little combo meal of three algorithms for IPMI 2.0:
- The authentication algorithm β used for user authentication with the BMC
- The integrity algorithm... wait, integrity algorithm β used for generating signatures on IPMI packets
- The confidentiality algorithm β used for encrypting data
What this section actually lets you do is enable or disable certain cipher suite IDs, plus set the maximum privilege level a username can authenticate with. Iconic behavior, honestly.
Here's the cipher suite ID β algorithms mapping, and I'm giving it to you exactly as it is, no cap:
0 - Authentication Algorithm = None; Integrity Algorithm = None; Confidentiality Algorithm = None
1 - Authentication Algorithm = HMAC-SHA1; Integrity Algorithm = None; Confidentiality Algorithm = None
2 - Authentication Algorithm = HMAC-SHA1; Integrity Algorithm = HMAC-SHA1-96; Confidentiality Algorithm = None
3 - Authentication Algorithm = HMAC-SHA1; Integrity Algorithm = HMAC-SHA1-96; Confidentiality Algorithm = AES-CBC-128
4 - Authentication Algorithm = HMAC-SHA1; Integrity Algorithm = HMAC-SHA1-96; Confidentiality Algorithm = xRC4-128
5 - Authentication Algorithm = HMAC-SHA1; Integrity Algorithm = HMAC-SHA1-96; Confidentiality Algorithm = xRC4-40
6 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = None; Confidentiality Algorithm = None
7 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = HMAC-MD5-128; Confidentiality Algorithm = None
8 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = HMAC-MD5-128; Confidentiality Algorithm = AES-CBC-128
9 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = HMAC-MD5-128; Confidentiality Algorithm = xRC4-128
10 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = HMAC-MD5-128; Confidentiality Algorithm = xRC4-40
11 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = MD5-128; Confidentiality Algorithm = None
12 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = MD5-128; Confidentiality Algorithm = AES-CBC-128
13 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = MD5-128; Confidentiality Algorithm = xRC4-128
14 - Authentication Algorithm = HMAC-MD5; Integrity Algorithm = MD5-128; Confidentiality Algorithm = xRC4-40
Now for the ranking discourse π β generally speaking, the HMAC-SHA1 based algorithms are stronger than HMAC-MD5, which are better than the MD5-128 algorithms. And the AES-CBC-128 confidentiality algorithms are stronger than the xRC4-128 ones, which are better than the xRC4-40 ones. So cipher suite ID 3 is typically considered the most secure. Slay. Some users may wish to set cipher suite ID 3 to a privilege level and disable all the remaining cipher suite IDs β that's a whole mood, and honestly valid.
In the example configuration above, it was decided that any user with "Administrator" privileges can use any Cipher Suite algorithm suite that requires an authentication, integrity, and confidentiality algorithm. Typically, the maximum privilege level configured to a username should be set for atleast one cipher suite ID β and typically that's the "Administrator" privilege. (Yes, "atleast" β that's the original's spelling, we're not touching it, we respect the source π)
β οΈ Heads up: a number of cipher suite IDs are optionally implemented, so the cipher suite IDs available on your system may vary. Don't come for me if a number's missing, it's giving "implementation defined" energy π
π¦ Section SOL_Conf π¦
This one's all about setting up Serial-Over-Lan (SOL) β and it's only available for configuration on those machines that actually have it. Gatekept, but in a hardware way π
Enable_SOLβ turns SOL on. That's it, that's the field β¨SOL_Privilege_Levelβ the minimum privilege level required for connecting with SOL. Set this to the maximum privilege level configured to a username that has SOL enabled. Typically, that's the"Administrator"privilege πForce_SOL_Payload_Authenticationβ force authentication, or don't, your callForce_SOL_Payload_Encryptionβ force encryption, or don't. It's recommended that both of these be set on π«Ά β buuut forced authentication and/or encryption support depends on the cipher suite IDs supported, so it's giving "it depends" π
Then there's the character output speed squad β Character_Accumulate_Interval, Character_Send_Threshold , SOL_Retry_Count and , SOL_Retry_Interval:
Character_Accumulate_Intervalβ determines how often serial data should be regularly sentCharacter_Send_Thresholdβ indicates the character count that, if passed, will force serial data to be sentSOL_Retry_Countβ how many times packets must be retransmitted if acknowledgements are not receivedSOL_Retry_Intervalβ the timeout interval
Generally, the manufacturer recommended numbers will be sufficient. But likeβ¦ you may wish to experiment with these values for faster SOL throughput. Go off, scientist π§
On the baudrate front:
Non_Volatile_Bit_RateandVolatile_Bit_Rateβ determine the baudrate the BMC should use. This should match the baudrate set in the BIOS and operating system, such asagetty(8). Generally speaking, both the Volatile and Non_Volatile options should be set identically β matchy-matchy, fr fr πΈ
π Also! Enabling SOL in this section isn't the whole story β individual users most also be capable of connecting with SOL. See the section Section User1, User2, ... above for the deets. (Yep, "most" instead of "must" β once again, source text, not me π)
π REPORTING BUGS π
Found a bug? Don't suffer in silence, bestie β report it to <freeipmi-users@gnu.org> or <freeipmi-devel@gnu.org>. The devs are literally waiting π«Ά
π SEE ALSO π
And the plug you know was coming: http://www.gnu.org/software/freeipmi/ π
Okay that's the whole page, you made it, I'm so proud of you π₯Ήβ¨ This little masterpiece is ipmi-config 1.6.20, dated 2026-10-05 β go forth and configure responsibly, mwah ππ
π¦ where this page comes from
- arch rolling: freeipmi 1.6.20-1 Β· GPL-3.0-or-later
- centos-stream 10: freeipmi 1.6.20-1.el10 Β· GPL-3.0-or-later
- centos-stream 9: freeipmi 1.6.20-1.el9 Β· GPLv3+
- centos-stream 9: freeipmi 1.6.20-1.el9 Β· GPLv3+
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms