As most people know, Intel have lost the plot and are behind AMD on everything CPU and GPU related (with the tiny exception of the N100 series CPUs from Intel which are perfect for low power and even fanless applications). As such, their CPUs are mostly bought by organisations updating previous environments with like for like replacements for whatever reason (like vSphere's EVC which allows you to run newer processors from the same manufacturer as if they were an older model, and enable hot migration between CPU architectures and thus minimum disruption on hardware refreshes). Pretty much everyone else is getting the better and cheaper (per processing power) AMD CPUs.

Intel NICs are pretty good overall (the X710 which spent a year+ with broken drivers causing silent network failures/downright crashes while still being in the hardware compatibility list of VMware and other "enterprise" vendors notwithstanding), and they're getting more popular for consumer devices too. An Intel CPU on a non-low cost PC/laptop almost always means an Intel NIC (WiFi and/or Ethernet).

For many organisations buying servers, Supermicro* is probably their best option. They're cheaper, have much higher flexibility in terms of form factors, chassis, components, number of whatever slots and mostly reliable. However their support is less reliable than the theoretical Dell/HPE support, so it works best for redundant setups.

Also, the IPMI specification is being replaced by Redfish which is much more complete, secure, normalised and presents normal usable APIs. Any mainline server from a few years ago should have Redfish alongside IPMI.

* There's recent research from Hindenburg, a short selling research firm, that exposes some shady stuff from Supermicro - but their hardware is still top notch and used by the hyperscalers. https://hindenburgresearch.com/smci/

* No support for ACPI sleep. In 2024. Seriously. * No support for 4 and 3 pins fans. 3 pins are 100% speed all the time. * IPMI web interface straight out of 2010. * NVME placement prevents you from using heatsinks. * Tons of opaque jumpers on the board, with no board labelling.

The ASRock Rack equivalent board is amazing in comparison.

If ASRock Rack got the SSH serial console redirection latency down from ~1 second to the low milliseconds like the other vendors (SuperMicro, Dell, HP, etc.) it would actually be useable without taking Valium before logging in.

Supermicro's BMC UI on X11 does feel like 2004, but it is decently reliable. On the H13 series is even more stable and doesn't feel outdated.

To be fair, these are meant for datacenter applications where it would be absolutely normal for these to be either fully on or off all of the time. You could make an argument for warm spare servers, but there's other ways to accomplish it than ACPI sleep, and I'd probably consider warm spares a relatively niche need, considering I'd rather leave them hot-but-outside-production for system monitoring purposes. Would be more annoying to wake a sleeping system and find it has a failing drive/RAM/NIC, bad switchport config, etc.

> No support for 4 and 3 pins fans. 3 pins are 100% speed all the time.

To be fair, these are meant for datacenter applications where it would be absolutely normal to run your fans at full speed all of the time.

> IPMI web interface straight out of 2010

Does it have HTML5 remote console, and basic component diagnostics? If so what else would you like? I've been a datacenter tech, a linux sysadmin, and a devops engineer, depending on the company for a decade now, and really only ever used IPMI for those two things so I'm curious where the other use cases are. I've also used Dell PowerEdge and HPE servers, which have slightly nicer looking UIs but perform the exact same functions more or less.

Case fans for rack mount chassis are very powerful, and also can take up a significant amount of energy when running full-bore (not to mention the mechanical wear).

I haven't used a server chassis in over a decade where the fans were running at full beyond a few brief seconds at startup. I'm not sure if they used a four-pin header or some other mechanism, but fan speed control is a normal and expected feature in server hardware.

> Does it have HTML5 remote console, and basic component diagnostics? If so what else would you like?

IPMI specifically is meant to be a standardized remote management interface. It (mostly) works for basic things, but more advanced functionality is hit-or-miss, or absent entirely, leaving you at the mercy of proprietary tools. Redfish is supposed to be better, although I personally haven't used it.

Web interfaces can be hit-or-miss in terms of functionality and UX. Additionally, I've often found these web interfaces to be unstable -- either being very slow or not loading at all, to certain features of the UI not loading data or hanging the interface.

The IPMI interface sure is nicer though

I have a pair of Supermicro H12SSL-NT boards to use for my next couple builds. I might be trading one set of issues for another, but I'm optimistic they'll work well for my purposes.

It's been this way for at least a decade, too. It's like it just forgets all its session variables sometimes.

This is a bigger problem when you have a huge fleet of these already rather than my few servers in my home lab that I can manually enroll my own keys in.

If that's your threat model you shouldn't trust your computers anyway. You don't know what things have been inserted into the chips on the motherboard. You don't know what code is in your operating system and applications. You don't know what code the controllers on your storage devices are running. You don't know if there is a cellular chip on your motherboard or a chip that is waiting for a certain frequency radio wave to leak all your shit. You don't know that all the code on your system is RCE free or LPE free. You don't know that there aren't any insiders at your software vendors signing bad code to send to you. You haven't personally audited the binaries on your system or even their source code.

It's not too big of a surprise for me because lifespan will eventually become an increasing problem as feature size goes down (e.g. a mobile defect can make more trouble more easily.) They say it is a problem of the microcode asking for too much voltage from the motherboard and that's true, but it is also true that chips are going to be more sensitive to environmental upsets. Ever since the industry went past 10nm I figured there was a chance I'd buy something that was affected by I guess I dodged the bullet going with AMD.

I remember loving Intel NICs for performance and Linux compatibility back in the day before you just used the NIC that came on the motherboard. For that matter I loved Intel SSDs but you had to read between the lines to see: (1) you got a little better performance in the P95-P99 range than cheaper competitors and (2) when you are getting frustrated that your computer is slow you are experiencing P95-P99. It's some of the reason why I both loved and hated Anandtech because they so often missed the plot.

Did the X710 actually become stable? I got burned with them pretty early in their life have ended up staying away from them ever since.

I automate keeping IPMI ssl certain up to date using redfish apis. Importing the new certs requires slightly different magic (cert naming, encoding, etc) on every single different vendor implementation of redfish. I have a collection of Python modules to deal with each vendors eccentricity just around uploading and swapping ssl certs when it should be a set of standard put requests that work everywhere (that is what the redfish API docs would convince you of!)

So not sure I would agree that it is either normalized or usable, as the whole point of something like redfish is that I shouldn’t have to do this. It is equally as annoying as it was when I had to drive their web interfaces directly.

I had to write code to mount an iso image to a server, set the server to boot from it once and reboot the server to start the install.

I had to do it for 4 vendors. Dell, Lenovo, Fujitsu and Supermicro.

4 different vendors, 4 different Redfish APIs.

And what's annoying is that Redfish always looks similar so it fools you into thinking all the vendors do things the same way but no, suddenly some endpoint just doesn't exist in this vendors implementation and you have to scour the docs for this vendors unique magic uri.

One option: you can get IPMI on an Atom-based Supermicro MicroATX board that can be cooled quietly with a small Noctua fan, in a short-depth 1U chassis.

I have an older one at home. The quietness and small size made it much more attractive than the Dell R2x0 models I saw. And it has server features like IPMI and ECC RAM that made it more attractive than a mini-PC, and it was also more reliable than a flimsy RasPi. (I'd be happy with a Dell quiet short-depth 1U with comparable characteristics, but I'm not aware of one.)

Personally, I wouldn't plug the IPMI port into my main LAN, but it's come in handy isolated from that, and was also a little fun to play with.

Restrict access as tightly as possible. If you only need to power up/down/reset the system and access the serial console most IPMI implementations expose that via SSH. A small SSH proxy that exposes only those features would be a good investment. e.g. `ssh bastion [status|up|down|cycle|reset|console] `. You could probably write it in <100 lines as SSH forced command. Deploy the SSH client to a different VRF (aka network namespace/vnet jail/rdomain) than the SSH server to make it harder to leak traffic from the bastion.

IPMI is like typical IoT, a rarely updated full system with often questionable code quality.

Private VLANs and separate interfaces on dedicated ports is not out of line.

Often shared interfaces with vlan isolation depends on the IPMI honoring that isolation.

By Private VLANs I am talking about RFC 5517 style, a switch level feature where IPMI cannot reach other IPMI interfaces.

1. A USB keyboard.

2. A USB mouse.

3. A USB flash drive (using a partition on its internal SD card) for storing bootable ISO to install/rescure systems.

4. A USB NIC which is very neat. I can use it on the PC to expose management SSH port just on that instead of the primary NIC, so that the PC has a sorta dedicated IPMI interface.

Newer versions of the device software come with WireGuard and Tailscale support, so I can just connect to it over VPN.

Still have some minor issues, but the developers are working fast to fix them.

I think there are some open source IPMI products, but that involves talking to an ODM about a run of thousands of boards which is a bit much for me; I just want two servers at home. I'm tempted by the Gigabyte MC12-LE0 boards that are low cost in Germany right now, but getting dedicated server boards disrupts my pattern of upgrade a desktop, and give the old board to my oldest server.

Wonder if they're serious about that?

Do they know places are around (or at least used to be) which will inflate the # of stars for a repo for some minimal amount of cash? Like $20 per thousand(?) or so when I was reading an expose about that years ago... ;)

Given how reference code for the x86 platform never dies I've often wondered how much of the current IPMI edifice dates back to this hardware and software. As a point of note, the default password for the Intel LANDesk Emergency Management Card was "calvin". If you worked with earlier versions of the Dell iDRAC this will be a familiar password. I assume it's not coincidence. (As an aside: I was told by an Intel employee that the code name for the EMC was "Hobbes" but I can't find that documented anywhere.)

You see versions of the EMC periodically on eBay.[1] There were both ISA and PCI versions. They're an x86 PC on a card. Some (all?) of them have an integral UPS. They had a PCMCIA slot to attach out-of-band management, an external power supply, and connected to the server motherboard through both the card's host bus interface and via proprietary connectors.

I've downloaded firmware for some of the EMC versions and looked it over. It looks like some of the EMC versions an embedded DOS machine. (This has been one of my idle "when I get to it" projects and I haven't actually tried to reverse-engineer any of the code or get it running under qemu, though I'd like to.)

Third-party companies who sold the Intel reference platforms (Unisys, Fujitsu, ALR/Gateway, NCR) offered these cards, too. It's a good giveaway that they're using an Intel reference platform when you see the card on-offer. References to "LDSM" are a giveaway.

It'd be really wild if anybody on here knows anything about the heritage.

[0] https://www.intel.com/pressroom/archive/releases/1998/ld1030...

[1] https://web.archive.org/web/20240903131630/https://www.ebay....

I believe that at least on some HPE ProLiants some part of this low-level initialization is in fact done by iLo, which at that boot stage also directly controls the framebuffer (on G10 you can even briefly see a flash of message like “handing over the console to host”, after which the display reinitializes and starts showing the function key legends). I assume that Dell does something similar, but in the early stages you simply get “Please wait” and giant throbber (and not any kind of progress indication).

One thing I miss about Sun SPARC (and other Unix) systems: you had 'proper' remote access at a very low level.

I always found BIOS/UEFI remote console very fiddly and hit and miss (you often have to play with GRUB/kernel settings to get input/output).

There was literally nothing that could go wrong. Then install the OS from the regular console port over the network with bootp/tftp/http.

The complexity of DRAC/iLO setups to control an emulation of a VGA PC setup blows my mind.

IPMI does rather more than than giving you console access, though it's serial, not VGA. Typical server BMCs which embed IPMI do more again. Not to defend the quality of various BMC firmware and support I've encountered...

It was more the remote power/boot/install process which seems unnecessarily complicated these days compared to serial.

An elegant weapon for a more civilised age, or something ;-)

Booting a live cd or installing windows at 1MByte/s speeds (late 1990s CDROMs were faster!) is horribly slow. Maybe iLO5 was a bit better.

usually found it easier (but annoying) to just walk over with a USB drive…

I've found iLO 4 virtual media support most useful for booting DOS-hosted firmware updates supplied as El Torito ISO images that aren't natively bootable from USB flash in a world where you can no longer find CD-R blanks at every corner drug store, and where newer machines commonly lack the legacy BIOS support required to boot the image at all.

It's also a fine way to boot minimal BSD or Linux rescue/netinstall images that don't involve live-booting a full desktop environment, or for installing smallish OSes like ESXi in cases where trading increased wallclock time for slightly reduced effort is justifiable.

A serial break is the only situation in which an RS232 line is driven +ve with greater than 90% duty cycle: charge a cap slowly on +ve, discharge quickly on -ve (diode), drive a mosfet gate to pull reset line low only when it's been +ve for quarter of a second or so.

Easily the hardest part of doing this is finding a 'clean' way to get a wire attached to the serial RX and GND pins from the inside the case rather than bodging something really ugly. Some boards have a front-facing serial port, though, which has a pin header and cable => easy to tap into.

I'd soldered onto the little legs on a stand off board DB9 port on one batch of machines I installed, and then ended up being thwarted on the next batch of boards which had a slightly different (more enclosed) style of DB9 port that made it much harder to get at the pins.

Whatever you do along these lines will be infinitely better than the insecure, overengineered catastrophe of vendor IPMI/BMC firmware. I wish someone less lazy than me would make a product along these lines... ;-)

If we could load our own OS on to the IPMI hardware, it's be worlds more useful, because we could safely connect it straight to the Internet. As it is, we need sideband communications (VPN, port forward over ssh, separate network segment, whatever), which makes it so that we end up with lots of extra hardware and configurations just to support IPMI. For large installations, the extra cost is better aggregated, but for small installations, it's a rather large burden. Heck - for colocating a single machine, it's not even worth it.

Since it's not possible to run IPMI directly on the Internet securely, I've ended up pairing machines with Pis of some sort. Doing this makes it just as easy - heck, easier - to use a serial port. That means we're back to the standard serial port control we've had since the days of VAXen and Sun and Alpha systems, which, the more I think about it, made much more sense than a network interface that's insecure.

On older devices (like Dell T20/T30) there is Intel AMT which is way less powerful and has security flaws, but at least SOME way to do remote administration when used with MeshCommander (unfortunately discontinued and releases deleted from everywhere - but I luckily saved the MSI and Node-Package on my server).

I'm planning to try out PiKVM (V2) with a Raspberry 4 and a simple 8 bucks USB-HDMI-Capture-Card (https://docs.pikvm.org/v2/). Besides the lack of some features, it looks promising and more universal for devices that do not support remote management in any form.

How much more power is dissipated clearly depends on the quality of the PSU (constructing a power supply which is efficient at high loads and idle is quite a challenge). I doubt the BMC (sometimes built-in to the NIC) takes nearly that much.

> I'm planning to try out PiKVM (V2) with a Raspberry 4

That'll exceed 5W though.

Yeah I know - while "quality" (I assume efficiency) is not the only factor, because low tier PSU (<200W, like Pico PSU) are far less consuming below 20W.

> That'll exceed 5W though.

Only running all the time. Paired with a Tasmota Shelly Plug it consumes near 0W. Additionally it is Board independent and together with a HDMI- / USB-KVM-Switch it can be used for multiple hosts.

I also thought about using PiKVM similar devices on my Banana PI 3 OpenWRT router, so this thing is running all the time and powerful enough to handle this.

OpenStack Ironic (ironicbaremetal.org) now ships a redfish driver that we have tested working on: - Dell machines - HPE machines (ilo 5 and 6) - SuperMicro - Most generic redfish endpoints as deployed by bulk "off label" server places

A lot of folks in the provisioning automation space worked hard to try and enhance the state of the art (including some folks at Dell who were great :D) and get redfish accepted.

It's a bit weird seeing this post; from our perspective, IPMI is a dangerous, attractive nuisance: it's nearly impossible to properly secure and has a lot more bad failure scenarios than a protocol built on http, that most of the time can support TLS with custom CAs and similar.

> In short, the authentication process for IPMI 2.0 mandates that the server send a salted SHA1 or MD5 hash of the requested user's password to the client, prior to the client authenticating.

ipmi also has a maximum password length of 20 characters. In realworld you have to note that we only expect hashes to remain secret from known pentesters who have a limited contractual runtime, not a real attacker with unlimited time on their hands.

I'm very critical of this. It's been in the spec for 20 years. Is not the whole point of software that it is easier to change than hardware? It's easy to say "you should put this on a vlan" but I pretty much ALWAYS see ipmi on the business network in my assessments. If you put dumb stuff in your defaults then you're gonna end up with dumb stuff all over the globe and that includes every business without a knowledgeable security administrator that decides to "buy a server".

The desktop would be there only for troubleshooting, not for normal stuff which would usually require an iGPU or better.

If yes, would it work out of the box with Ubuntu?

Most servers don't run an accelerated server desktop and do things like play AAA games and YouTube.

Most of them do that anyway, so... shrug

> Xfce and classic X11 might work.

You say that like it's a bad thing.

The most modern feature is probably double buffering. :-)

Obviously if you rent out whole physical machines and automate the provisioning by IPMI, then the last thing you want is the customer having admin access to the BMC.

Dell iDRAC has an interesting feature that allows you to make all of the BMC configuration read-only which can only be disabled by factory resetting the iDRAC by means of physical (and IIRC not exactly documented) switch on the BMC board. (Well, it is still _i_DRAC as in “integrated”, but on current higher-end PowerEdges the iDRAC is separate OCP-like card, but well, the system does not work without it)

I depend on idrac. The newer one is bearable. The old Java was torrid.

The integrated IPMI is pretty good on these and plays well with ipmitool. They'll usually have some Redfish stuff going on.

This is the danger of https only. http services may be insecure, but don't ever expire; https implementations will expire without updates, and there's not going to be updates on these, and it's unknowable when the expiration will be.

  about:config
  security.tls.version.min = 0

Sometimes (often?) you need a more 'advanced' OOB/LOM license to get remote console from Dell/HP/Lenovo/etc.

>"Out-of-band management, sometimes also called lights-out management, identifies a capability that is almost unheard of in clients. A separate, smaller management computer allows for remote access to a server even when it is, say, powered off. The terms out-of-band and in-band in this context emerge from their customery uses in networking and telecom, meaning that out of band management is performed without the use of the standard (we might say "data plane") network connection to a machine. But in practice they have drifted in meaning, and it is probably better to think of out-of-band management as meaning that the operating system and general-purpose components are not required. This might be made clearer by comparison: a very standard example of in-band management would be SSH, a service provided by the software on a computer that allows you to interact with it. Out-of-band management, by contrast, is provided by a dedicated hardware and software stack and does not require the operating system or, traditionally, even the CPU to cooperate."

[...]

>"The IPMI software runs on a processor conventionally called the baseboard management controller or BMC, and the terms IPMI and BMC are sometimes used interchangeably. Lights-out management or LOM is mostly an obsolete term but sticks around because HP(E) is a fan of it and continues to call their IPMI implementation Integrated Lights-Out. The BMC should not be confused with the System Management Controller or SMC"

[...]

"IPMI offers "sideband" networking. With sideband management, the BMC communicates directly with the same NIC that the operating system uses. The implementation is a little bit weird: the NIC will pretend to be two different interfaces, mixing IPMI traffic into the same packet stream as host traffic but using a different MAC address."

[...]

"Details of network features vary between IPMI implementations, but there is a standard interface on UDP 623 that can be used for discovery and basic commands. There's often SSH and a web interface, and VNC is pretty common for remote console."

This is arguably the best educational article on IPMI and related subsystems (I did not know about 90% of this!) that I've read for a long time.

Well worth a re-read in the future...