Query IPMI with cnspec

Query and inventory your servers using cnspec and the Intelligent Platform Management Interface (IPMI). IPMI is a baseboard management controller (BMC) interface that provides management and monitoring capabilities independently of the host system's CPU, firmware (BIOS or UEFI), and operating system. Use the IPMI provider inside your own policies to check chassis state, firmware revisions, and management controller hygiene.

For newer servers that expose the DMTF Redfish REST API, see Scan Redfish BMCs with cnspec. New to cnspec? Start with the quickstart.

Prerequisites

To query IPMI interfaces with cnspec, you must have:

• cnspec installed on your workstation
• Network access to the IPMI interface (typically on a dedicated management port)
• IPMI credentials (username and password)

Connect to an IPMI interface

To query an IPMI interface, provide the username and host address:

cnspec shell ipmi USER@HOST

For example:

cnspec shell ipmi admin@192.168.1.100 --ask-pass
Enter password:

You can also provide the password directly:

cnspec shell ipmi admin@192.168.1.100 --password YOUR_PASSWORD

Example queries

Once connected, you can query IPMI resources.

Retrieve the device ID information

cnspec> ipmi.deviceID
deviceID: {
  deviceAvailable: true
  deviceRevision: 1
  firmwareRevision: "2.45"
  ...
}

Retrieve the chassis status

cnspec> ipmi.chassis.status
ipmi.chassis.status: {
  systemPower: true
  ...
}

Retrieve the management controller GUID

cnspec> ipmi.guid
guid: "12345678-1234-1234-1234-123456789abc"

Example security checks

The IPMI provider also reports the security state of the BMC itself: its channels, user accounts, LAN and Serial-over-LAN configuration, system event log, and watchdog timer.

List the BMC user accounts

cnspec> ipmi.users { id name privilegeLimit enabled }

Ensure no channel accepts anonymous logins

cnspec> ipmi.channels.none( anonymousLoginEnabled )
[ok] value: true

Ensure cipher suite 0 is disabled

Cipher suite 0 negotiates authentication and then performs none, so any password opens a session:

cnspec> ipmi.lanConfig.cipherZeroEnabled == false
[ok] value: false

Ensure failed password attempts lock the account

A threshold of zero means password guessing is unbounded:

cnspec> ipmi.lanConfig.badPasswordThreshold > 0
[ok] value: 5

Ensure Serial-over-LAN traffic is encrypted

cnspec> ipmi.solConfig { enabled forceEncryption privilegeLevel }

Ensure the system event log is recording

cnspec> ipmi.sel.loggingEnabled
[ok] value: true

Learn more

• To learn more about how the MQL query language works, read Write Effective MQL.

• For a list of all the IPMI resources and fields you can query, read the IPMI Resource Pack Reference.