ipmitool (1) - Linux Manuals
ipmitool: utility for controlling IPMI-enabled devices
Command to display ipmitool manual in Linux: $ man 1 ipmitool
NAME
ipmitool - utility for controlling IPMI-enabled devices
SYNOPSIS
ipmitool [ <options> ] <command> [ <sub-commands and sub-options> ]
<options> := [ <general-options> | <conditional-opts> ]
Any recognized option is accepted. Conditional options may be ignored or it's usage postponed until shell or exec processes relevant command.
<general-options> := [ -h | -V | -v | -I <interface> | -H <address> |
-d <N> | -p <port> | -c | -U <username> |
-L <privlvl> | -l <lun> | -m <local_address> |
-N <sec> | -R <count> | <password-option> |
<oem-option> | <bridge-options> ]
<conditional-opts> := [ <lan-options> | <lanplus-options> |
<command-options> ]
Bridging:
<bridge-options> := -t <target_address> [ -b <channel> |
[ -T <address> | -B <channel> ] ]
Options used with -I lan:
<lan-options> := [ -A <authtype> ]
Options used with -I lanplus:
<lanplus-options> := [ -C <ciphersuite> | <key-option> ]
Option groups setting same value:
<key-option> := [ -k <key> | -K | -y <hex_key> | -Y ]
<password-option> := [ -f <password_file> | -a | -P <password> | -E ]
<oem-option> := [ -o <oemtype> | -g | -s ]
Options used with specific command <command-options>:
<options-sdr> := [ -S <sdr_cache_file> ]
<options-sel> := [ -O <sel_oem> ]
<options-sol> := [ -e <sol_escape_char> ]
DESCRIPTION
This program lets you manage Intelligent Platform Management Interface
(IPMI) functions of either the local system, via a kernel device driver,
or a remote system, using IPMI v1.5 and IPMI v2.0. These functions include
printing FRU information, LAN configuration, sensor readings, and remote
chassis power control.
IPMI management of a local system interface requires a compatible IPMI
kernel driver to be installed and configured. On Linux this driver is
called OpenIPMI and it is included in standard distributions.
On Solaris this driver is called BMC and is included in Solaris 10.
Management of a remote station requires the IPMI-over-LAN interface to be
enabled and configured. Depending on the particular requirements of each
system it may be possible to enable the LAN interface using ipmitool over
the system interface.
OPTIONS
- -a
-
Prompt for the remote server password.
- -A <authtype>
-
Specify an authentication type to use during IPMIv1.5 lan
session activation. Supported types are NONE, PASSWORD, MD2, MD5, or OEM.
- -b <channel>
-
Set destination channel for bridged request.
- -B <channel>
-
Set transit channel for bridged request (dual bridge).
- -b <channel>
-
Set destination channel for bridged request.
- -B <channel>
-
Set transit channel for bridged request. (dual bridge)
- -c
-
Present output in CSV (comma separated variable) format.
This is not available with all commands.
- -C <ciphersuite>
-
The remote server authentication, integrity, and encryption algorithms
to use for IPMIv2.0 lanplus connections. See table 22-19 in the
IPMIv2.0 specification. The default is 3 which specifies RAKP-HMAC-SHA1
authentication, HMAC-SHA1-96 integrity, and AES-CBC-128 encryption algorithms.
- -d N
-
Use device number N to specify the /dev/ipmiN (or
/dev/ipmi/N or /dev/ipmidev/N) device to use for in-band
BMC communication. Used to target a specific BMC on a
multi-node, multi-BMC system through the ipmi device
driver interface. Default is 0.
- -e <sol_escape_char>
-
Use supplied character for SOL session escape character. The default
is to use ~ but this can conflict with ssh sessions.
- -E
-
The remote server password is specified by the environment
variable IPMI_PASSWORD or IPMITOOL_PASSWORD. The IPMITOOL_PASSWORD takes precedence.
- -f <password_file>
-
Specifies a file containing the remote server password. If this
option is absent, or if password_file is empty, the password
will default to NULL.
- -g
-
Deprecated. Use: -o intelplus
- -h
-
Get basic usage help from the command line.
- -H <address>
-
Remote server address, can be IP address or hostname. This
option is required for lan and lanplus interfaces.
- -I <interface>
-
Selects IPMI interface to use. Supported interfaces that are
compiled in are visible in the usage help output.
- -k <key>
-
Use supplied Kg key for IPMIv2.0 authentication. The default is not to
use any Kg key.
- -K
-
Read Kg key from IPMI_KGKEY environment variable.
- -l <lun>
-
Set destination lun for raw commands.
- -L <privlvl>
-
Force session privilege level. Can be CALLBACK, USER,
OPERATOR, ADMINISTRATOR. Default is ADMINISTRATOR.
This value is ignored and always set to ADMINISTRATOR when
combined with -t target address.
- -m <local_address>
-
Set the local IPMB address. The local address defaults to 0x20
or is auto discovered on PICMG platforms when -m is not specified.
There should be no need to change the local address for normal operation.
- -N <sec>
-
Specify nr. of seconds between retransmissions of lan/lanplus messages.
Defaults are 2 seconds for lan and 1 second for lanplus interfaces.
Command raw uses fixed value of 15 seconds.
Command sol uses fixed value of 1 second.
- -o <oemtype>
-
Select OEM type to support. This usually involves minor hacks
in place in the code to work around quirks in various BMCs from
various manufacturers. Use -o list to see a list of
current supported OEM types.
- -O <sel oem>
-
Open selected file and read OEM SEL event descriptions to be used
during SEL listings. See examples in contrib dir for file format.
- -p <port>
-
Remote server UDP port to connect to. Default is 623.
- -P <password>
-
Remote server password is specified on the command line.
If supported it will be obscured in the process list.
Note! Specifying the password as a command line
option is not recommended.
- -R <count>
-
Set the number of retries for lan/lanplus interface (default=4).
Command raw uses fixed value of one try (no retries).
Command hpm uses fixed value of 10 retries.
- -s
-
Deprecated. Use: -o supermicro
- -S <sdr_cache_file>
-
Use local file for remote SDR cache. Using a local SDR cache
can drastically increase performance for commands that require
knowledge of the entire SDR to perform their function. Local
SDR cache from a remote system can be created with the
sdr dump command.
- -t <target_address>
-
Bridge IPMI requests to the remote target address. Default is 32.
The -L privlvl option is always ignored and value set to ADMINISTRATOR.
- -T <address>
-
Set transit address for bridge request (dual bridge).
- -T <transmit_address>
-
Set transit address for bridge request. (dual bridge)
- -U <username>
-
Remote server username, default is NULL user.
- -v
-
Increase verbose output level. This option may be specified
multiple times to increase the level of debug output. If given
three times you will get hexdumps of all incoming and
outgoing packets. Using it five times provides details
on request and expected reply procesing. The hpm commands
targetcap compprop abort upgstatus
rollback rollbackstatus selftestresult increases
the verbosity level
- -V
-
Display version information.
- -y <hex key>
-
Use supplied Kg key for IPMIv2.0 authentication. The key is expected in
hexadecimal format and can be used to specify keys with non-printable
characters. E.g. '-k PASSWORD' and '-y 50415353574F5244' are
equivalent.
The default is not to use any Kg key.
- -Y
-
Prompt for the Kg key for IPMIv2.0 authentication.
- -z <size>
-
Change Size of Communication Channel. (OEM)
If no password method is specified then ipmitool will prompt the
user for a password. If no password is entered at the prompt,
the remote server password will default to NULL.
SECURITY
There are several security issues be be considered before enabling the
IPMI LAN interface. A remote station has the ability to control a system's power
state as well as being able to gather certain platform information. To reduce
vulnerability it is strongly advised that the IPMI LAN interface only be
enabled in 'trusted' environments where system security is not an issue or
where there is a dedicated secure 'management network'.
Further it is strongly advised that you should not enable IPMI for
remote access without setting a password, and that that password should
not be the same as any other password on that system.
When an IPMI password is changed on a remote machine with the IPMIv1.5
lan interface the new password is sent across the network
as clear text. This could be observed and then used to attack the remote
system. It is thus recommended that IPMI password management only be done
over IPMIv2.0 lanplus interface or the system interface on the
local station.
For IPMI v1.5, the maximum password length is 16 characters.
Passwords longer than 16 characters will be truncated.
For IPMI v2.0, the maximum password length is 20 characters;
longer passwords are truncated.
COMMANDS
- help
-
This can be used to get command-line help on ipmitool
commands. It may also be placed at the end of commands
to get option usage help.
ipmitool help
Commands:
bmc Deprecated. Use mc
channel Configure Management Controller channels
chassis Get chassis status and set power state
dcmi Data Center Management Interface
delloem Manage Dell OEM Extensions.
echo Used to echo lines to stdout in scripts
ekanalyzer run FRU-Ekeying analyzer using FRU files
event Send events to MC
exec Run list of commands from file
firewall Configure Firmware Firewall
fru Print built-in FRU and scan for FRU locators
fwum