Scan Redfish BMCs with cnspec

Query and inventory your servers using cnspec and Redfish, the DMTF standard REST API exposed by modern baseboard management controllers (BMCs). Like IPMI, Redfish operates out-of-band: it runs independently of the host system's CPU, firmware (BIOS or UEFI), and operating system, so you can audit hardware whether or not it is powered on.

Redfish is the successor to IPMI, and most server vendors expose it through their own BMC products:

• HPE Integrated Lights-Out (iLO)
• Dell Integrated Dell Remote Access Controller (iDRAC)
• Supermicro BMCs

cnspec connects to the Redfish service and scans the managed systems, management controllers, chassis, user accounts, and firmware inventory against your security and compliance best practices, without installing anything on the server. Use the Redfish provider inside your own policies to check firmware levels, UEFI Secure Boot status, BMC accounts, and controller hygiene.

Prefer the older Intelligent Platform Management Interface? See Scan IPMI BMCs with cnspec. New to cnspec? Start with the quickstart.

Prerequisites

To scan Redfish BMCs with cnspec, you must have:

• cnspec installed on your workstation
• Network access to the BMC's management interface (typically on a dedicated management port)
• BMC credentials (username and password) with permission to read the Redfish service

The Redfish provider works with any BMC that implements the DMTF Redfish standard, including HPE iLO, Dell iDRAC, and Supermicro controllers.

Connect to a Redfish BMC

To query a Redfish BMC, provide the username and host address:

cnspec shell redfish USER@HOST

For example:

cnspec shell redfish admin@192.168.1.100 --ask-pass
Enter password:

You can also provide the password directly:

cnspec shell redfish admin@192.168.1.100 --password YOUR_PASSWORD

To scan a Redfish BMC against a policy instead of opening an interactive shell, use cnspec scan:

cnspec scan redfish admin@192.168.1.100 --ask-pass

Example queries

Once connected, you can query Redfish resources. cnspec normalizes the data model across vendors, so the same queries work against HPE iLO, Dell iDRAC, and Supermicro hardware.

Inventory the managed system

cnspec> redfish.system { model manufacturer serialNumber powerState biosVersion }
redfish.system: {
  manufacturer: "HPE"
  model: "ProLiant DL380 Gen11"
  serialNumber: "SGH123ABCD"
  powerState: "On"
  biosVersion: "U54 v2.10"
}

Check the management controller firmware

cnspec> redfish.manager { model firmwareVersion managerType }
redfish.manager: {
  model: "iLO 6"
  firmwareVersion: "1.55"
  managerType: "BMC"
}

Confirm UEFI Secure Boot is enabled

cnspec> redfish.system.secureBootEnabled
redfish.system.secureBootEnabled: true

Audit the local BMC accounts

cnspec> redfish.accounts { userName roleId enabled }
redfish.accounts: [
  {
    userName: "admin"
    roleId: "Administrator"
    enabled: true
  }
]

Review the firmware inventory

cnspec> redfish.firmware { name version }
redfish.firmware: [
  {
    name: "BIOS"
    version: "U54 v2.10"
  },
  {
    name: "iLO"
    version: "1.55"
  }
]

Query vendor-specific extensions

When you connect to hardware from a specific vendor, cnspec populates the matching extension resource. These resources are empty on hardware from other vendors.

Read the HPE iLO license edition:

cnspec> redfish.hpe { licenseLabel licenseType }
redfish.hpe: {
  licenseLabel: "iLO Advanced"
  licenseType: "Perpetual"
}

Read the Dell iDRAC hardware generation and BIOS release date:

cnspec> redfish.dell { generation biosReleaseDate }
redfish.dell: {
  generation: "16G"
  biosReleaseDate: "2025-03-14"
}

Check whether Supermicro BMC system lockdown is engaged:

cnspec> redfish.supermicro.systemLockdownEnabled
redfish.supermicro.systemLockdownEnabled: true

Learn more

• To learn more about how the MQL query language works, read Write Effective MQL.

• For a list of all the Redfish resources and fields you can query, read the Redfish Resource Pack Reference.