What is a baseboard management controller?
A baseboard management controller (BMC) is a separate processor built into a server's motherboard, with its own firmware, memory and network connection. It runs whenever the server has power, even if the server itself is shut down or its operating system has crashed. Vendors brand their BMCs: Dell calls its version iDRAC, HPE calls it iLO and Lenovo calls it XClarity Controller. The older standard interface is IPMI, which listens on UDP port 623; the newer Redfish standard offers a REST API over HTTPS. Most BMCs also have a web interface and SSH.
What a BMC can do
- Power the server on, off or through a hard reset.
- Show the server's screen and accept keyboard and mouse input remotely, from power-on onward.
- Mount an ISO file as a virtual DVD so an operating system can be reinstalled from anywhere.
- Change BIOS or UEFI settings and flash firmware.
- Report fan speeds, temperatures, power supply and disk health, and keep a hardware event log.
Together, that amounts to physical access to the server without entering the data center.
Why attackers target BMCs
BMCs combine great power with weak upkeep. Many were deployed with factory credentials that are widely published, such as root/calvin on older Dell iDRACs; current models from the major vendors generally ship with a unique password per unit. IPMI 2.0 has a design flaw in its authentication handshake that lets anyone who can reach UDP 623 obtain a salted password hash for a valid user name and crack it offline. BMC firmware is patched far less often than the host operating system, and malware placed in BMC firmware can survive disk wipes and operating system reinstalls. Internet-wide scans routinely find BMC interfaces exposed to the public internet.
Example: a scan finding
A vulnerability scan run from the employee Wi-Fi reports UDP 623 open on 40 addresses, which Nmap labels asf-rmcp, and HTTPS iDRAC login pages on the same hosts. That is a high-priority finding: any compromised laptop on that network could pull password hashes from the BMCs or try default logins. The fix is to move the BMCs to the out-of-band management network, not to change their port numbers.
Hardening a BMC
- Connect the dedicated management port to the out-of-band network only. Avoid shared-NIC mode, which puts the BMC on the production network.
- Set unique credentials at deployment and use directory authentication with MFA where the platform supports it.
- Disable IPMI over LAN if Redfish or the web interface is enough, and turn off unused services such as virtual media.
- Keep BMC firmware in the patch cycle and track BMC addresses in the asset inventory.
- Send BMC login and configuration events to the SIEM.
Baseboard management controller on the CompTIA Security+ exam
BMCs are taught under SY0-801 objective 3.2, which covers managing the security architecture, as part of out-of-band management and the management zone. Their default passwords also come up with misconfigurations and default credentials in objective 2.4, which covers vulnerability types. Wording such as "iLO or iDRAC pages reachable from workstations", "UDP 623 open on the user network" or "the server management interface still uses the vendor's default password" points to a BMC problem, and the best answer isolates the controllers on a management network and changes their credentials. Distractors include moving the interface to a non-standard port; disabling RDP in the server's operating system; a TPM, which stores keys rather than managing the server; and a KVM switch, which is local hardware.