A server sits in a data centre you have never visited, in a rack you will never touch. One morning it stops responding. No SSH, no ping, nothing. The operating system has failed to boot after a kernel update, and every tool you normally use to fix a server depends on that same operating system being alive. This is the exact problem IPMI was built to solve.
So what is IPMI? It is a small, independent computer built into the server itself, one that stays awake even when the main machine is switched off, frozen, or refusing to start. Through it, you can power-cycle the hardware, watch the boot screen, mount an installation image, and repair the system, all from your desk, as though you were standing in front of a monitor plugged into the physical box.
For anyone renting a dedicated server, this is the difference between a five-minute fix and a support ticket that takes a day.
📖 New to dedicated infrastructure?
If terms like root access and single tenancy are new, start with the basics. Read What Is a Dedicated Server?, a plain introduction to how dedicated hardware works and what full control of it means.
What IPMI Actually Is
IPMI stands for Intelligent Platform Management Interface. It is an open specification led by Intel and developed jointly with Dell, HP, and NEC, first published in 1998 and adopted across the server hardware industry since. The name is unhelpful, so set it aside and picture the hardware instead.
Every server-grade machine contains a second, tiny processor called the Baseboard Management Controller, or BMC. This chip has its own network connection, its own power draw, and its own miniature operating system. It runs independently of the main server. When the machine is powered down but still plugged in, the BMC is awake. When the main operating system has crashed, the BMC is unaffected. It watches the hardware from the inside, and it answers to you from outside.
IPMI is the standardised language this controller speaks. It defines how you talk to the BMC over the network: how you ask it to report a temperature, cut the power, or hand you a live view of the screen.
Because the controller sits below the operating system, it does not care what has gone wrong above it. A corrupted kernel, a misconfigured firewall, a full disk that halts the boot: none of these touch the BMC. That independence is the entire point, and it is why the industry calls this out-of-band management. The management channel runs outside the normal path, the one that breaks precisely when you need it most.
Why “Out-of-Band” Is the Whole Idea
Most remote administration happens in-band. You connect over SSH, which runs as a service inside the operating system, over the network the operating system controls. It works beautifully, right up until the operating system stops working. Then the very channel you would use to investigate is the channel that has gone dark.
Out-of-band management removes that dependency. The BMC has a separate network interface and needs nothing from the main system to function. Consequently, the moments when in-band access fails are exactly the moments when out-of-band access earns its keep.
Consider the failures that lock an administrator out completely. A firewall rule applied in the wrong order, sealing off the SSH port. A network configuration change that severs the machine from the network the instant it is applied. A kernel upgrade that leaves the server unable to boot. In every case, SSH is gone, and in every case, IPMI remains.
📖 The classic lock-out scenario
Firewall misconfiguration is the most common way to lock yourself out of a new server. Read How to Setup a Dedicated Server, which covers the safe order for enabling SSH and firewall rules so you never need the recovery in the first place.
What You Can Do Through IPMI
The capabilities divide into three groups, and together they replicate almost everything you could do standing at the machine.
1. Power control. You can turn the server on, turn it off, and force a hard reset when it has frozen and will not respond to a graceful reboot. This alone resolves a large share of incidents, because a hung machine that ignores every network request will still obey a power command sent to its controller.
2. Console access. This is the capability that matters most, and it is often called KVM-over-IP, for keyboard, video, and mouse. It streams the actual screen output of the server to your browser, from the manufacturer logo at power-on, through the BIOS, into the boot loader, and on to the operating system. You see what a monitor plugged into the server would show, and your keystrokes reach it as though from a directly attached keyboard. When a server hangs mid-boot, this is how you read the error that a remote tool could never capture.
3. Hardware monitoring. The BMC reads the physical sensors on the board: temperatures, fan speeds, voltages, power-supply health. It reports a failing fan or an overheating component before that fault escalates into a crash, which turns some outages from emergencies into scheduled maintenance.
Many controllers add virtual media on top of these. You attach an operating-system image from your own computer, and the server treats it as though a technician had walked over and inserted a physical disk. That capability lets you reinstall an operating system from scratch, remotely, on a machine that currently has none.
A Realistic Recovery, Start to Finish
Picture the kernel-update failure from the opening, and walk through the repair.
The update installed cleanly and requested a reboot. The server went down and never came back. SSH times out, because there is no operating system listening to accept the connection. In a world without out-of-band access, the next step is a support ticket and a wait measured in hours.
With IPMI, you open the controller’s web interface in your browser, on its separate network address. You launch the console and watch the boot in real time. There, frozen on screen, is a kernel panic naming the exact module that failed. You use the power control to force a reset, and as the machine restarts you catch the boot menu and select the previous, known-good kernel. The server boots. You are back in through SSH, and now you diagnose the broken kernel at your own pace, from the safety of a running system.
The whole recovery takes minutes. Nothing left the data centre, no technician was dispatched, and no ticket was raised. The independence of the controller turned a potential day-long outage into a brief interruption.
📖 When recovery is not enough
IPMI recovers a single machine. Surviving hardware failure without any interruption needs more. Read High Availability Hosting Explained, on redundancy and failover for workloads that cannot go down at all.
The Security Warning That Must Accompany Any IPMI Guide
Everything that makes IPMI powerful also makes it dangerous, and no honest explanation can leave this out.
The BMC is, by design, a computer that can power the server on and off and view its screen, running independently of every security control the operating system enforces. If an attacker reaches the controller, they own the machine beneath it. Worse, BMC firmware has historically shipped with default passwords, has been slow to receive security patches, and has contained serious vulnerabilities that stayed unfixed for long periods.
The consequence is a firm rule: the IPMI interface must never be exposed to the public internet. Its network address belongs on a private management network or behind a VPN, reachable only by the people who administer the server. Exposing a BMC to the open internet adds the single most privileged component of the machine to its attack surface, and search engines exist that catalogue exactly these exposed controllers for attackers to find.
This is the same logic as a default-deny firewall. The controller should be reachable by those who need it and invisible to everyone else. Treat it as the master key to the building, because that is what it is.
IPMI, iDRAC, iLO, and the Naming Confusion
You will meet several names for what is largely the same thing, and the overlap is worth untangling.
IPMI is the open standard. Major hardware vendors build their own controllers on top of it and market them under brand names. Dell calls its version iDRAC. HPE calls its version iLO. These branded controllers offer the same core out-of-band capabilities, power, console, monitoring, usually wrapped in a more polished interface and extended with vendor-specific features.
For a tenant, the practical takeaway is simple. Whether the provider’s hardware exposes plain IPMI or a branded equivalent, the function you care about is the same: independent remote access to the machine when the operating system cannot help you.
Dedicated servers with real remote management
Every Swify dedicated server runs on HP ProLiant Gen10 hardware with out-of-band management built in, from a Netherlands data centre connected to AMS-IX. Full root access, enterprise SSD storage, and 1Gbps unmetered bandwidth, from €120/month.
→ Explore Swify Dedicated ServersFrequently Asked Questions
What is IPMI used for on a dedicated server?
IPMI gives you remote control of a dedicated server independently of its operating system. Through it you can power the machine on or off, force a reset when it has frozen, watch the boot process live through a remote console, and read hardware sensors such as temperature and fan speed. Its defining use is recovery: reaching a server when SSH is gone because the operating system has failed to boot.
This matters most after a change that locks you out, such as a broken kernel update or a firewall misconfiguration. Read How to Setup a Dedicated Server for the setup steps where that risk arises.
Is IPMI the same as SSH?
No, and the difference is what makes IPMI valuable. SSH is in-band: it runs as a service inside the operating system and depends on that system being alive and on the network functioning. IPMI is out-of-band: it runs on a separate controller with its own network connection, independent of the operating system entirely.
In everyday administration you use SSH. IPMI is what remains when SSH fails, because the operating system has crashed or the machine will not boot. The two are complementary, not alternatives. Read SSH Security: Brute Force Protection for how to secure the in-band channel.
Is it safe to expose IPMI to the internet?
No. Exposing an IPMI or BMC interface to the public internet is one of the most serious mistakes in server administration. The controller can power the machine and view its console independently of every operating-system security control, so an attacker who reaches it effectively owns the hardware. BMC firmware has also shipped with default credentials and slow security patching.
The controller belongs on a private management network or behind a VPN, never on a public address. This follows the same principle as a restrictive firewall. Read What Is a Firewall and How Does It Protect Your Server? for the default-deny approach that applies here.
What is the difference between IPMI, iDRAC, and iLO?
IPMI is the open standard for out-of-band server management. iDRAC and iLO are vendor implementations built on the same idea: iDRAC is Dell’s version, iLO is HPE’s. All three provide the same core functions, remote power control, console access, and hardware monitoring, with the branded versions adding a more refined interface and extra vendor-specific features.
For someone renting a server, the brand matters less than the capability. What counts is having independent remote access when the operating system cannot help. Read What Is a Dedicated Server? for how this fits into dedicated hosting overall.
Can I reinstall an operating system through IPMI?
Yes, when the controller supports virtual media, which most modern ones do. Virtual media lets you attach an operating-system image from your own computer to the remote server as though it were a physically inserted disk. Combined with console access, this means you can reinstall an operating system entirely remotely, even on a machine that currently has none.
This is what makes a fresh start possible without dispatching a technician. Read How to Setup a Dedicated Server for what to configure first on a newly installed system.
Does every dedicated server include IPMI?
Most server-grade hardware includes a BMC, so out-of-band management is common on genuine dedicated servers, though the exact features and interface vary by manufacturer. What differs is how a provider exposes it: some offer full self-service access to the controller, while others keep it internal and act on your behalf when recovery is needed.
It is worth confirming the access model before renting, because it determines how quickly you can recover from a lock-out yourself. Read How to Choose a Dedicated Server Provider for the questions worth asking before signing.