What is IPMI (KVM over IP) on a dedicated server?

What do IPMI and BMC mean?

IPMI, the Intelligent Platform Management Interface, is a low-level specification for managing servers at the hardware level. Many hardware vendors adopted it. It runs on the baseboard management controller, or BMC.

The BMC is a small computer of its own on the motherboard, with its own network connection. It reaches the BIOS, the disks and the sensors. CISA describes BMCs as working apart from the operating system and firmware, even when the system is shut down.

IPMI is the remote-control interface of a server's baseboard management controller: it reaches the machine below the operating system, even when it is off.

What is KVM over IP?

KVM over IP sends a server's keyboard, video and mouse over the network. You see the screen from the first second of boot, BIOS included, and type as if you sat at the machine.

BMC web interfaces usually include it as a viewer in the browser.

The letters mislead: KVM over IP has nothing to do with KVM, the Linux hypervisor.

What are iDRAC, iLO and Supermicro IPMI?

They are vendor names for the same kind of BMC. Dell calls its controller iDRAC, the integrated Dell Remote Access Controller. HPE calls its own iLO, for Integrated Lights-Out. Supermicro boards expose their BMC under the IPMI name, with a web interface.

All speak IPMI. The newer standard is Redfish, a web API published by DMTF. Dell and HPE chair DMTF's Redfish Forum, and Redfish Specification 1.25.0 came out on 14 September 2026.

What can you do with IPMI on a dedicated server?

With IPMI you manage the machine as if you stood next to it:

• Watch the screen from power-on, BIOS included, through KVM over IP.
• Control power: switch on, switch off or reset a server that hangs.
• Mount an ISO from your computer as a virtual drive and install any system.
• Change BIOS and RAID settings.
• Read sensors: temperatures, fans, power supplies and the hardware event log.
• Open a serial console with Serial over LAN.

The common command-line tool is ipmitool. Its -E option reads the password from the IPMI_PASSWORD variable, so it stays out of your shell history.

# power state, then a hard reset
ipmitool -I lanplus -H BMC_ADDRESS -U BMC_USER -E chassis power status
ipmitool -I lanplus -H BMC_ADDRESS -U BMC_USER -E chassis power reset
# sensor readings, then the serial console
ipmitool -I lanplus -H BMC_ADDRESS -U BMC_USER -E sdr list
ipmitool -I lanplus -H BMC_ADDRESS -U BMC_USER -E sol activate

Is IPMI a security risk?

Yes, when the BMC can be reached from the internet. In 2013, US-CERT, now part of CISA, warned that attackers can use IPMI to gain physical-level access to a server. They can reboot it, install a new system or reach its data, out of reach of the operating system's controls.

A BMC open to the internet gives an attacker physical-level access, in CISA's words: power, console and disks, below the operating system.

CISA's alert listed concrete flaws:

• IPMI passwords stored in clear text.
• "Cipher 0", on by default on many devices, which lets a client skip authentication.
• Old network services on the BMC, and few tools to detect a compromised BMC.

The problem has not gone away. In June 2023, CISA and NSA published joint guidance on hardening BMCs. On 25 June 2025, CISA added CVE-2024-54085 to its catalog of exploited vulnerabilities. That flaw in AMI's MegaRAC SPx BMC firmware lets a remote attacker skip authentication; NVD scores it 9.8 of 10.

CISA's advice holds: keep IPMI traffic, usually UDP port 623, on a separate management network. Use strong, unique passwords, disable cipher 0 and update the BMC firmware.

Does Ironatoll include IPMI or KVM over IP?

No. No remote console (IPMI or KVM over IP) is included: reboots and reinstalls are requested from your dashboard and done by the team. What you do instead: Reboot, reinstall and cancel are requested from your dashboard and carried out by the team; a reinstall erases the disks.

In practice:

• No BIOS access and no custom ISO. You pick from these systems: Debian 13, Debian 12, Ubuntu 24.04 LTS, AlmaLinux 10, Rocky Linux 10 and Proxmox VE 9.
• A reinstall erases the disks. There are no automatic backups, so every file you need to keep should also live somewhere you control.
• No BMC login of yours, so there is no BMC password of yours to leak or forget.

Who else can physically reach a rented machine is covered on can my hosting provider see the data on my dedicated server.

According to Ironatoll's check of 30 October 2026, Atoll 32 costs 25% less than its named reference, MonoVM at $96.20 a month. Every plan is on how much does an Ironatoll dedicated server cost.

How do I avoid locking myself out without a console?

Change network and firewall settings so that a mistake undoes itself. Without a console, SSH is your only way in.

• Keep a second SSH session open while you change the firewall or the SSH settings.
• Use netplan try on Ubuntu. It applies a network change and rolls it back after 120 seconds unless you confirm.
• Schedule a rollback of firewall rules a few minutes ahead, and cancel it once you are back in.
• If you are locked out anyway, request a reboot from your dashboard. A reinstall is the last resort, since it erases the disks.

Proxmox VE is one of the systems offered, so you do not need an ISO to run it. See how do I install Proxmox on a dedicated server.

Do I need IPMI on a rented server?

You need IPMI if you install systems from your own ISO, change BIOS settings or debug boot failures yourself. You do not need it to run Linux or Proxmox from the host's images and manage everything over SSH.

Linux only: Debian, Ubuntu, AlmaLinux, Rocky Linux, and Proxmox VE to run your own virtual machines. No Windows. If your plan depends on Windows or another system from an ISO, choose a host that includes a console. What a whole machine gives you is on what is a bare metal server.